I depends on the version of 'su' you are using. There's at least two that I know of, Gnu's and Shadow util's. See man su and login.defs for Shadow utils. I don't know about the Gnu Coreutil's one. However, I can't find who the Shadow utils are being maintained by or where. The old site is down, all links dead.
/etc/login.defs:# Enable "syslog" logging of su activity - in addition to sulog file logging.
/etc/login.defs:# If defined, all su activity is logged to this file.
/etc/login.defs:SULOG_FILE /var/log/su-activity.log
|