HP-UX 11i September 2002 Release Notes

General System Administration and Performance Monitoring
syslog File Logging Changes for su and login
Chapter 9
180
syslog File Logging Changes for su and login
new at 11i
original release
This change will only affect you if you write or use programs or scripts that parse the
syslog file.
The format of text messages logged in the syslog file by the su and login commands has
changed slightly. Specifically, su events are now preceded by ‘su:’ and login events are
now preceded by ‘login:’. As a result, syslog output is now more consistent with the
format of messages generated by other commands. It is also easier for programs to
operate that parse syslog output.
Aside from affecting the text logged in the syslog file, this change may possibly impact
any programs that parse the syslog file, such as certain security monitoring tools.
Programs that read syslog files looking for su and login events will need to take this
change into account.