2008/8/20 Gabriel Parrondo <[EMAIL PROTECTED]> > You may want to look into some kind of logwatch. Every time someone uses > su, this comes out on /var/log/auth.log: > Aug 20 22:30:00 localhost su[5120]: + pts/1 gabriel:root > > You should configure your logwatch to look for it (shouldn't be hard, > take a look at logwatch and log2mail) and e-mail on you. >
This sounds like the easiest way for me to achieve what I'm after. Many thanks! Sam
