find user su to support login

[peac3]

Hi guys,

we had script has run under 'support' login, we know when/what time the script was running, but we need to know which ID did su to 'support' login and triggered the script.

Do you guys have any idea how to find this out?

Cheers guys,

 

[feherke]

Hi

Probably is operating system dependent, on my Linux I would start with :

grep 'support' /var/log/secure

Feherke.

http://rootshell.be/~feherke/

 

[AnotherAlan]

On Solaris there is a log called /var/adm/sulog which will show all su activity.

Not sure on linux.

 

[peac3]

OS : Unix Solaris 10

 

[KenCunningham]

As Alan says, in SOlaris 10 /var/adm/sulog should show you su activity. Perhaps grep it for 'support'.

I want to be good, is that not enough?

 

[peac3]

Thanks guys, but unfortunately I don't have access to that log

 

[Mike042]

You could try the last command. (See the man pages for more info and I would pipe the output through more).

last | more
or
last | grep support


I hope that helps.

Mike

 

[KenCunningham]

In fact, Mike, just last support | pg will do, with most recent entries at the start of the listing.

I want to be good, is that not enough?

 

[Mike042]

TIMTOWTDI (pronounced: Tim Toady) as 'Perl people' in particular would say.

Regards.

Mike

 

[PHV]

Anyway, since when should the last command be aware of su activities ?

Hope This Helps, PH.
FAQ219-2884
FAQ181-2886

 

[columb]

Thanks guys, but unfortunately I don't have access to that log

Maybe you should buy your sysadmin a beer and suggest he allows you to use sudo to grep out the entries from sulog.

On the internet no one knows you're a dog

Columb Healy

 

[KenCunningham]

PHV pricks our pretensions as always! Good call.

I want to be good, is that not enough?

 

[peac3]

Anyway, since when should the last command be aware of su activities ?

exactly, I tried it only give us the client host name.
support pts/2 wny99sat9xmkz61.n Wed Feb 11 12:24 - 13:06 (00:42)