Mar 23 05:26:17 alghy43bi su(pam_unix)[12031]: session opened for user root by samuel(uid=500) Mar 23 05:26:24 alghy43bi su(pam_unix)[12060]: session opened for user samuel by samuel(uid=0)
Note that the second shows the second SU starting at uid=0, and the source and destination username are the same.
It would be pretty easy to put together a perl pattern to search for this.
Klotz, Brian wrote:
Does anyone know of a way to list all of the users currently logged in, including when someone has su-ed to become another user?
--
Stephen Samuel +1(604)876-0426 [EMAIL PROTECTED]
http://www.bcgreen.com/~samuel/
Powerful committed communication, reaching through fear, uncertainty and
doubt to touch the jewel within each person and bring it to life.