[ossec-list] AIX 5.3 sshd logins and sudo

["Carlos Eduardo Pedroza Santiviago" <segfault@xxxxxxxxxxxxxxx>]

Hi,

Below is an output of my sshd logins, its currently an AIX 5.3:

Oct  9 09:50:40 MACHINE auth|security:info sshd[229596]: Accepted
password for USER from 172.29.14.41 port 55839 ssh2

After that, i issue a "sudo su", and then it gets logged as:

Oct  9 09:50:41 MACHINE auth|security:notice sudo:  USER : TTY=pts/22
; PWD=/home/USER ; USER=root ; COMMAND=/usr/bin/su
Oct  9 09:50:41 MACHINE auth|security:notice su: from root to root at
/dev/pts/22

Could this be added as a standard rule or should i create a customized
version here?

More information about the system:

(MACHINE:/var/log)$ uname -a
AIX MACHINE 3 5 00C3541E4C00
(MACHINE:/var/log)$ oslevel -r
5300-04

thank you,
-- 
Carlos Eduardo Pedroza Santiviago
http://softwarelivre.net | Passo-a-passo rumo à liberdade!