From owner-freebsd-questions  Wed Nov 12 18:40:40 1997
Return-Path: <owner-freebsd-questions>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id SAA05070
          for questions-outgoing; Wed, 12 Nov 1997 18:40:40 -0800 (PST)
          (envelope-from owner-freebsd-questions)
Received: from odyssey.apana.org.au (odyssey.apana.org.au [203.11.114.1])
          by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id SAA04677
          for <freebsd-questions@freebsd.org>; Wed, 12 Nov 1997 18:34:44 -0800 (PST)
          (envelope-from dean@odyssey.apana.org.au)
Received: from dean (dialup01.odyssey.apana.org.au [203.11.114.101])
	by odyssey.apana.org.au (8.8.7/8.8.7) with SMTP id KAA00655;
	Thu, 13 Nov 1997 10:35:24 +0800 (WST)
Message-Id: <3.0.3.32.19971113103016.006ae03c@odyssey.apana.org.au>
X-Sender: dean@odyssey.apana.org.au
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32)
Date: Thu, 13 Nov 1997 10:30:16 +0800
To: "Fiore, William" <Fiowi01@mail.cai.com>
From: Dean Hollister <dean@odyssey.apana.org.au>
Subject: Re: where are attempted logins logged
Cc: freebsd-questions@freebsd.org
In-Reply-To: <314E26C1801AD1119C3000805FD40926128D76@usilms05.cai.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-questions@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

At 16:55 12/11/97 -0500, you wrote:

>I sort of remember it was /var/log/messages or some such.
>
>could someone refresh my memory?

In most cases, /var/log/messages will only log ROOT logins/su's.

Regards,

d.

+-------------------------------------------------------+
| Dean Hollister,           | deanh@iinet.net.au        |
| Region Co-Ordinator,      | dean@odyssey.apana.org.au*|
| APANA,                    |                           |
| Western Australia.        | *finger A/C for more info | 
+-------------------------------------------------------+
ST:VOY Kess: "I wish people would stop talking to me as if
              I'm still a child! I'm three years old now!"