On Tue, 1 Jun 2004, jimmie james wrote:
> Doing login accounting:
> total 1438.65
> jimmie 1435.18
> root 3.46
> This all makes perfect sense, though I was wondering,
> if there's an easy way to get the script to log how
> many times (and optionally, who) uses "su" or "su -"
> and to what account they jumped to.
> Unfortunaly, I'm not a code monkey, so digging around
> in the source, and trying myself would probably break
You can do this easily enough by polling /var/log/messages for any use of
grep -i su /var/log/messages | sort +6
Set this up as a daily crontab item and the results will be emailed to you
[EMAIL PROTECTED] mailing list
To unsubscribe, send any mail to "[EMAIL PROTECTED]"