03-15-2002
438,
1
Join Date: Aug 2001
Last Activity: 16 October 2009, 2:04 PM EDT
Location: Virginia, USA
Posts: 438
Thanks Given: 0
Thanked 1 Time in 1 Post
You didn't mention what "flavor" of UNIX.
Different UNIX systems utilize log files in different locations and with different names.
The log file structure on Solaris 7 is...
All successful and unsuccessful su attempts are
logged to /var/adm/sulog. Keeping track of who is
using the su command specifically who is
attempting to su to root is critical for
successful security monitoring.
To log failed login in attempts Solaris uses
/var/adm/loginlog. This file must be created
manually be owned by root and group sys, and must
have the permissions of 600. Log entries will be
created after five failed login attempts by
default.
The last command monitors who is logged into your
systems, and when, and from where. It's
information is logged to the /var/adm/wtmpx file.
This file is stored in binary format and the last
command must be used to read the file.
System events including software and hardware.
Events are logged into the /var/adm/messages file.
These include hardware errors, Operating System
errors, and security related messages. These
messages could be generated from successful and
failed logins, connections from TCP-Wrappers, su
attempts, and from sshd.
su