On 14:25 20 Mar 2003, Klotz, Brian <[EMAIL PROTECTED]> wrote: | I teach a Linux basics course and each term I have the problem of students | who do an su to become root, then rather than exiting, they su again to go | back to their regular account. The trouble is identifying when someone has | done this (they usually don't remember). The "who" command only shows login | shells (AFAIK) so it does not reveal when someone has su-ed. | | Does anyone know of a way to list all of the users currently logged in, | including when someone has su-ed to become another user?
As others have stated, this should be showing up in your /var/log/messages file. Running a simple: #cat /var/log/messages | grep su should do the trick w/out a problem. You could easily set this up as a cron job that saves to a file, such as : #cat /var/log/messages | grep su > /homedir/su.txt --Dave
