SU logging configuration on RHEL 5.4

kmslick · 05-14-2010, 03:44 PM

I believe that SU log messages are supposed to be appended to /var/log/messages but I'm not getting any log entries.

I edited the /etc/syslog.conf and added the line below
su.* /var/log/sulog

Then ran /etc/rc.d/init.d/syslog restart (I also ran this prior to editing the syslog.conf file just in case).

I'm still not getting any SU log messages.

Any help is appreciated.

anomie · 05-14-2010, 03:46 PM

Don't quote me on this, but I believe su(1) uses the authpriv facility.

The place to look for chatter is /var/log/secure.

kmslick · 05-17-2010, 08:33 AM

That was it - Thanks!