The UNIX and Linux Forums  

Go Back   The UNIX and Linux Forums > Top Forums > UNIX for Dummies Questions & Answers
Google UNIX.COM



View Single Post in UNIX Forums - Click on the Thread or Permalink to View Entire Thread -->
  #2 (permalink)  
Old 02-28-2006
RTM's Avatar
RTM RTM is offline
Hog Hunter
 

Join Date: Apr 2002
Location: On my motorcycle
Posts: 3,039
If both are logged in as root, you could possibly tell from the output of the who command - just associate the terminal connection with the userid (found with ps -ef|grep root). Then, with the who command, look for that terminal to see where they are coming from - you would then have to look on that server to try to find who was logging in as root (if this is what they are doing).

If a person logs in as root on console, then you don't have a way of doing this (unless there are console logs which may or may not have information on the person).

If you are in charge of this server, you should consider setting up the root account so it can only be accessed from console - so anyone signing in can not log in as root (and this will make it easier to find who is using it via the su logs).
Reply With Quote