su Post: 17470

Sponsored Content

Top Forums UNIX for Dummies Questions & Answers su Post 17470 by rwb1959 on Friday 15th of March 2002 02:22:58 PM

03-15-2002

Registered User

You didn't mention what "flavor" of UNIX.
Different UNIX systems utilize log files in different locations and with different names.
The log file structure on Solaris 7 is...

All successful and unsuccessful su attempts are
logged to /var/adm/sulog. Keeping track of who is
using the su command specifically who is
attempting to su to root is critical for
successful security monitoring.

To log failed login in attempts Solaris uses
/var/adm/loginlog. This file must be created
manually be owned by root and group sys, and must
have the permissions of 600. Log entries will be
created after five failed login attempts by
default.

The last command monitors who is logged into your
systems, and when, and from where. It's
information is logged to the /var/adm/wtmpx file.
This file is stored in binary format and the last
command must be used to read the file.

System events including software and hardware.
Events are logged into the /var/adm/messages file.
These include hardware errors, Operating System
errors, and security related messages. These
messages could be generated from successful and
failed logins, connections from TCP-Wrappers, su
attempts, and from sshd.

rwb1959

View Public Profile for rwb1959

Find all posts by rwb1959

LEARN ABOUT OPENDARWIN

wtmpx

utmpx(4)							   File Formats 							  utmpx(4)

NAME

       utmpx, wtmpx - utmpx and wtmpx database entry formats

SYNOPSIS

       #include <utmpx.h>
       /var/adm/utmpx
       /var/adm/wtmpx

DESCRIPTION

       The utmpx and wtmpx files are extended database files that have superseded the obsolete utmp and wtmp database files.

       The  utmpx database contains user access and accounting information for commands such as who(1), write(1), and login(1). The wtmpx database
       contains the history of user access and accounting information for the  utmpx database.

USAGE

       Applications should not access these databases directly, but should use the functions described on the getutxent(3C) manual page to  inter-
       act with the utmpx and wtmpx databases to ensure that they are maintained consistently.

FILES

       /var/adm/utmpx	       user access and adminstration information

       /var/adm/wtmpx	       history of user access and adminstrative information

SEE ALSO

       getutxent(3C), wait(3C)wait.h(3HEAD)

SunOS 5.10							    22 Feb 1999 							  utmpx(4)