On 27.Aug.2013, at 21:02, Eero Volotinen wrote: > Is there nice way to get more logging for all su - logins? pam? What exactly do you want to be logged? I get entries in /var/log/secure Aug 28 00:38:51 xxx su: pam_unix(su-l:session): session opened for user root ... Aug 28 00:39:23 xxx su: pam_unix(su-l:session): session closed for user root