Solaris

Hey bartus thanks for the reply - I see now that dtrace is real-time so it's no good to me unless it is running on the machine at the time of the infraction and I manage over 22K servers for a large organisation and they're all eventually being converted to Linux so I guess I'm screwed. In any event it was an interesting tool to view - thank you for your help!

If successful login attempts normally show in "last", ask you administrator to take a look at the unsuccessful login attempts with "lastb" (if "btmp" is enabled). I'm not certain if Solaris has the "lastb" command.

The problem is, OP was asking about outgoing SSH logins, not the incoming ones

My mistake. The information recorded in btmp on the remote computer is enough to identify the source computer and the destination account, but not the source account.

This just seems kind of weird unless you have dTrace and according to what I've read that is only for Solaris. The only other thing I can think of is if the admin checks each users' bash_history but even that is really questionable. If someone's bash history shows someone initiating an ssh attempt to that host it does not necessarily they conducted it at the specific time of the occurrence. Secondly, if someone is using ksh or other shell I am not aware of a history file associated with these shells.

There is another option: process auditing. But it is way more difficult to setup than this DTrace one-liner. It also introduces overhead to the system (DTrace does not do that). You can read about Solaris auditing services here: Oracle Solaris Auditing - System Administration Guide: Security Services. There is probably something similar in Linux.

Bartus - thank you for your help! We're moving all 33K machines to Linux - not sure how long that will take but I believe once we're all Linux they better have some additional auditing system otherwise I'm not sure how we're going to get that information if dtrace is the only one that is known and from what I read it is for SunOS / Solaris only.