Hi there, The following message is on Solaris 10 platform. When I do a su, the messages from kernel always come. I did not see that message when I use syslog daemon. Is this a normal behavior in rsyslog? Is there something to do in compilation because I did not see it on RHEL?
2011-10-11T16:35:21-04:00 h8-420r-01 su: [ID 805675 auth.notice] User : root Service : su TTY : /dev/pts/2 Remote Host : N/A Remote User : N/A Status : AUTHENTICATED 2011-10-11T16:35:21.179019-04:00 h8-420r-01 kernel: Oct 11 16:35:21 su: [ID 805675 auth.notice] User : root Service : su TTY : /dev/pts/2 Remote Host : N/A Remote User : N/A Status : AUTHENTICATED 2011-10-11T16:35:21-04:00 h8-420r-01 su: [ID 366847 auth.notice] 'su root' succeeded for vl10243 on /dev/pts/2 2011-10-11T16:35:21.182744-04:00 h8-420r-01 kernel: Oct 11 16:35:21 su: [ID 366847 auth.notice] 'su root' succeeded for vl10243 on /dev/pts/2 2011-10-11T16:36:39.450123-04:00 h8-420r-01 kernel: Oct 11 16:36:39 su: [ID 805675 auth.notice] User : root Service : su TTY : /dev/pts/2 Remote Host : N/A Remote User : N/A Status : AUTHENTICATED 2011-10-11T16:36:39-04:00 h8-420r-01 su: [ID 805675 auth.notice] User : root Service : su TTY : /dev/pts/2 Remote Host : N/A Remote User : N/A Status : AUTHENTICATED 2011-10-11T16:36:39-04:00 h8-420r-01 su: [ID 366847 auth.notice] 'su root' succeeded for vl10243 on /dev/pts/2 2011-10-11T16:36:39.454056-04:00 h8-420r-01 kernel: Oct 11 16:36:39 su: [ID 366847 auth.notice] 'su root' succeeded for vl10243 on /dev/pts/2 Thanks Victor _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
