huge sulog file

[shoux]

hi all

the file size is 40mb. there is 700 users online. Howcome, each time users logged in the root will execute su command to them.this will caused the sulog size is growth.it seems that root is succesfuly

below is the snapshoot of the sulog file.
SU 08/25 08:43 + tty?? root-a20
SU 05/25 08:43 + tty?? root-a60
SU 08/25 08:43 + tty?? root-a16
SU 08/25 08:44 + tty?? root-al2
SU 08/25 08:44 + tty?? root-b10

thank you

shoux

 

[alexhu]

1) cut down those users who have access to root

OR

2) edit the file and make it smaller

Alex

 

[KenCunningham]

To empty the file completely, use cat /dev/null > sulog

This will at least give you a blank canvass from which you can monitor and assess who's accessing as root and, as Alex says, may give you ammunition to argue for more restricted access, perhaps using sudo.

 

[alexhu]

In fact your file shows root 'suing' to a number of users

Why is it doing that ?

Alex

 

[shoux]

hi all

as alex said, why the root user suing to other user. I do not know whether the system config. is wrong. i noticed each time user logged in the root will executed the command.

Please help me

Thank you

shoux

 

[alexhu]

What are you running on the system ?

Alex

 

[KenCunningham]

Is there anything in /etc/profile which might be causing this? I would have expected at least a prompt for a password if that's the case.

 

[aixmurderer]

Perhaps a root cron job which uses "su <user> -c" regulary?

Quick way to clear the log - ">sulog"

IBM Certified Confused - MQSeries
IBM Certified Flabbergasted - AIX 5 pSeries System Administration
MS Certified Windblows Rebooter

 

[hfaix]

My internal and external auditors would throw a fit if I blanked out the sulog. I would do the following:

make sure it's not in use

cd /var/adm
fuser sulog

I would save atleast one years worth of data. This is represented with "N"

tail -N /var/adm/sulog > /var/adm/sulog.new

mv /var/adm/sulog.new /var/adm/sulog

chmod 600 /var/adm/sulog

aixmurder is probably onto it. It's probaby a cron entry under roots cron, or is a job schedule just as ESP which runs as root but su's to approved/appropriate users.

 

[KenCunningham]

Those pesky auditors!! ;-)