Hi,
is it possible to trace everything about user that changes from its own user to root user, failed and successful attempts (I would need user and IP address of user that was trying to do that)?
I tried adding auth.notice and auth.info in syslog.conf but it only tracks user withoud IP address but I would need more information about user that tried to switch to root user.
thanks in advance
As a start, from the man page of su :
...
Each time the su command is executed, an entry is made in the /var/adm/sulog file. The /var/adm/sulog file records the following information: date, time, system name, and login name. The
/var/adm/sulog file also records whether or not the login attempt was successful: a + (plus sign) indicates a successful login, and a - (minus sign) indicates an unsuccessful login.
...
I know all that but is it possible to get user IP address?
When you know all this, you could pick the date, login and system name entry for the suspicous line and could cross check with the output of last and find out which line relates to it.
If you need more information, you can maybe set up Auditing:
Monitoring Events with AIX Audit
Accounting and Auditing on AIX 5L
You can also check if sudo's log gives more information at once.
As Zaxxon, mentioned. 1st look at the sulog file under "/var/adm", and then check 'last' command. Or other way for last command is cd to /var/adm and run "who -u wtmp" (same o/p as last, as last command reads the o/p from this file itself).
You should be able to track the user by username, its terminal, hostname/IP address, date and time.
su, and the sulog, assumes that the user is already logged in - so their is no IP address - other than their login shell.
The danger of relying on sulog is that is only fairly certain to tell about the failed attempts - as long as they are only failures. Once successful, a good (at it) hacker will edit that file - removing their entries.
1) to get IP addresses you will need to use the audit mechanism. I will look into that - thanks for the topic for my next blog 
,
2) to protect your logs you will need something to make them trustable. The solution "used to be" expensive tamper-proof, or near tamper-proof (such as WORM - write-once-read-many) devices. But this are hard (next to impossible) to attach to all virtual machines (aka LPAR/partition). The solution for AIX is to use the "Trusted Log" component of POWERSC.
Hope this helps - and thanks again for the blog idea.
Michael
We have a separate server that is just a syslog collector. In /etc/syslog.conf, we have the following entry added along with anything to local disk files you want to keep:-
*.debug @111.222.333.444
So anything written via syslog is immediate duplicated to that address.
This traps anything that you have set up to write to the syslog, including login, failed-login, FTP trace(if you have it) SSH connections etc. along with any catastrophic system failure, and the log may give you a clue to get restarted again.
We kept the definition as IP to stop anyone fiddling with the DNS entry first. Of course, then you have to defend the server collecting the syslog output, but that might be easier as you can write firewall rules pretty tightly around it and only let in the syslog traffic. Access for us is via the (virtual) console only and reports can be requested and out-bound FTP is allowed to get the reports to the LAN.
I think that the syslog collector uses software from the security company RSA, but I might be wrong. You could always use your own though.
Robin