The sulog file lists every use of the su command, not only the su attempts that are used to switch from user to superuser.
Become superuser or assume an equivalent role.
Monitor the contents of the /var/adm/sulog file on a regular basis.
# more /var/adm/sulog SU 12/20 16:26 + pts/0 nathan-root SU 12/21 10:59 + pts/0 nathan-root SU 01/12 11:11 + pts/0 root-janedoe SU 01/12 14:56 + pts/0 pmorph-root SU 01/12 14:57 + pts/0 pmorph-root |
The entries display the following information:
The date and time that the command was entered
If the attempt was successful
A + indicates a successful attempt. A - indicates an unsuccessful attempt.
The port from which the command was issued
The name of the user and the name of the switched identity
The su logging in this file is enabled by default through the following entry in the /etc/default/su file:
SULOG=/var/adm/sulog |