Logging/syslog

s0n|k · 03-13-2006, 06:01 PM

I would think that when I su to another user that the info from the switch would be in the /var/log/secure file. Where does it go?

gilead · 03-13-2006, 06:41 PM

It does get logged to /var/log/secure on Slackware:

Code:

Mar 13 09:37:18 trinity su[15809]: + pts/1 steve-root

You could try something like the following to find where it's being logged on your system:

Code:

grep -l '\<su\>' /var/log/*

s0n|k · 03-13-2006, 07:36 PM

Thanks! I really need to get more educated with grep usage. This command really helped.