Re: Send email on calls to su

["Sam Kuper" <spk30@cam.ac.uk>]

2008/8/20 Gabriel Parrondo <g.parrondo@gmail.com>

You may want to look into some kind of logwatch. Every time someone uses
su, this comes out on /var/log/auth.log:
Aug 20 22:30:00 localhost su[5120]: + pts/1 gabriel:root

You should configure your logwatch to look for it (shouldn't be hard,
take a look at logwatch and log2mail) and e-mail on you.

This sounds like the easiest way for me to achieve what I'm after.

Many thanks!

Sam