su.log

[ReeferMac]

OK, I'm really showing my Solaris background... but you folks have always shown me Linux is up to snuff...

I miss /var/adm/su.log

The system would log all su attempts/successes. Is that function available in Linux? I remember having to turn it on somehow in Solaris, but forget how (and wouldn't know if it's the same in Linux).
Thanks for putting up w/ the questions.

- Mac

[rtn]

That should be included in /var/log/auth.log

--rtn

[lwithers]

You should be able to configure your logger to output to that file if you wish. I use syslog-ng and have done this; I know you can also do it with metalog as well.

[dannycool]

Use syslog-ng as a logger, it's amazing what you can configure it to do... I think it can play tetris in /var/log/messages if you tell it to. Oh and speaking of /var/log/messages, that's where su related messages should end up if you didn't set it up in any other way.

[ReeferMac]

[n3mo]

If you want you could start here: http://www.balabit.com/products/syslog_ng/reference/book1.html

I think that looking at this could be very useful: http://www.gentoo.org/doc/en/gentoo-security.xml#doc_chap4

.....Gentoo best documented distro ever.......

[rtn]