_ssss_uuuu_llll_oooo_gggg - log of all su attempts
DDDDEEEESSSSCCCCRRRRIIIIPPPPTTTTIIIIOOOONNNN
The _ssss_uuuu command attempts to write an entry to the file specified by SSSSUUUULLLLOOOOGGGG
in ////eeeettttcccc////ddddeeeeffffaaaauuuulllltttt////ssssuuuu (_////_vvvv_aaaa_rrrr_////_aaaa_dddd_mmmm_////_ssss_uuuu_llll_oooo_gggg by default) each time it is invoked,
regardless of outcome. If _ssss_uuuu_llll_oooo_gggg doesn't exist, _s_u attempts to create it,
setting owner and group to that of the directory in which the file
resides (root.sys if _////_vvvv_aaaa_rrrr_////_aaaa_dddd_mmmm), and mode to read/write for owner only.
(Because _s_u executes with root privileges, this operation should succeed;
if it does fail, however, subsequent invocations of _s_u will be recorded
only by other logging mechanisms selected in ////eeeettttcccc////ddddeeeeffffaaaauuuulllltttt////ssssuuuu, if any; see
_s_u(1M)).
_ssss_uuuu_llll_oooo_gggg is an ASCII file, and each of its entries (or _r_e_c_o_r_d_s) contains 6
fields of information about a particular _s_u invocation, using a single
space character as delimiter. Field 1 is always "SU". Field 2 contains
the date in "mm/dd" format, with "mm" ranging from "01" to "12", "dd"
from "01 to "31". Field 3 is the 24-hour time in "hh:mm" format, with
"hh" ranging from "01" to "23", "mm" from "00" to "59". Field 4
indicates the outcome of the _s_u: '+' means it succeeded, '-' means it was
disallowed. Field 5 is the tty on which the _s_u executed (as determined by
_t_t_y_n_a_m_e(3C)), or "???" if the process had no controlling terminal. Field
6 identifies the usernames involved, and has the format "olduser-
newuser", where "olduser" is the invoking username, "newuser" the