Re: Seeing who has su-ed

Under RedHat 8.1:

Mar 23 05:26:17 alghy43bi su(pam_unix)[12031]: session opened for user root by samuel(uid=500) Mar 23 05:26:24 alghy43bi su(pam_unix)[12060]: session opened for user samuel by samuel(uid=0)

Note that the second shows the second SU starting at uid=0, and the source and destination username are the same.

It would be pretty easy to put together a perl pattern to search for this.

Klotz, Brian wrote:
> Does anyone know of a way to list all of the users currently logged in,
> including when someone has su-ed to become another user?

-- 
Stephen Samuel +1(604)876-0426                samuel@bcgreen.com
		   
http://www.bcgreen.com/~samuel/
Powerful committed communication, reaching through fear, uncertainty and
doubt to touch the jewel within each person and bring it to life.