Polachak, Jason wrote: > configuration file. So if someone "su -" where does it log this? Does > it log by default? Check /var/log/secure : May 17 14:45:12 blondie su: pam_unix(su-l:session): session opened for user root by beres(uid=1000020) -- BÉRES László RHCE, RHCX senior IT engineer, trainer -- redhat-list mailing list unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe https://www.redhat.com/mailman/listinfo/redhat-list