Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to log as much as possible when users a doing su *...
Best would be to log all commands especially for the case root does something as a user. We can assume root would not change this logging behaviour.
I think the matching deal would be something like SULOG in debian.
How can I get that running?

share|improve this question

pam_tty_audit(8) was written for exactly this problem:


Audit all administrative actions.


required pam_tty_audit.so disable=* enable=root

You could place this is /etc/pam.d/sudo for auditing only sudo(8), or in /etc/pam.d/common-session if you wanted to audit everything root does at any console.

share|improve this answer
Thanks, sounds fine. I used the common-session way. But - where goes the logging to? And - when beeing root it resulted in two entries in /var/log/messages: changed status from 0 to 1 immediately followed by restored status to 0. Any more hints? – Bastian Ebeling Jul 11 '11 at 8:34
@Bastian, no idea on the /var/log/messages entries. The logging will go to your /var/log/audit/audit.log file -- perhaps ausearch(1) can make the logs easier to search or read. – sarnold Jul 11 '11 at 21:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.