Red Hat 5 SU Logs

mccartjd · 08-06-2010, 07:42 AM

Really new at Red Hat. Can anyone tell me where I cand find the SU Logs or how to direct SU activity (successful and bad) to a file?

A million thanks,
John

acid_kewpie · 08-06-2010, 07:50 AM

authentications will go into /var/log/secure. afaik there's no (easy) way to specifically send su to a different file, as you're at the mercy of syslog fac and pri's alone with normal syslog. syslog-ng can do this now I think about it though, but in general I'd suggest you don't really want to do it anyway.

mccartjd · 08-06-2010, 08:45 AM

If I grep on the secure file for "su:" I get the data I need. Thanks for pointing me to the file it helped me extract what I needed.