Hello,

the sulog file on solaris does not record the user's attempts.
do i have to delete and create a new one or there is a better way?
in addition on the current sulog file is shown the month/day of the user's attempt but
i like to see the year also. there is a way to see the year or more
info about?

thanks,
grep

If you are not seeing the pass/fail attempts in the /var/adm/sulog, then check /etc/default/su for the location of the file (you would change it in this file). If it is set to /dev/null, then you are not getting any recording (not the way to go) OR if at the bottom of the file SYSLOG does not equal YES, then no record of su attempts.

Read the man page on sulog and su for further info (You won't get the year - I think it's because they expect folks to be looking at this file and watching security more than once a year or two).

THANK YOU.