[root@gdyjdb01 ~]# tail -n 15 /var/log/secure Nov 12 08:30:02 gdyjdb01 su: pam_unix(su-l:session): session opened for user oracle by (uid=0) Nov 12 08:30:02 gdyjdb01 su: pam_unix(su-l:session): session closed for user oracle Nov 12 08:30:02 gdyjdb01 su: pam_unix(su-l:session): session opened for user oracle by (uid=0) Nov 12 08:30:02 gdyjdb01 su: pam_unix(su-l:session): session closed for user oracle Nov 13 04:03:04 gdyjdb01 runuser: pam_unix(runuser-l:session): session opened for user cyrus by (uid=0) Nov 13 04:03:04 gdyjdb01 runuser: pam_unix(runuser-l:session): session closed for user cyrus Nov 13 08:30:01 gdyjdb01 su: pam_unix(su-l:session): session opened for user oracle by (uid=0) Nov 13 08:30:02 gdyjdb01 su: pam_unix(su-l:session): session closed for user oracle Nov 13 08:30:02 gdyjdb01 su: pam_unix(su-l:session): session opened for user oracle by (uid=0) Nov 13 08:30:02 gdyjdb01 su: pam_unix(su-l:session): session closed for user oracle Nov 13 08:30:02 gdyjdb01 su: pam_unix(su-l:session): session opened for user oracle by (uid=0) Nov 13 08:30:02 gdyjdb01 su: pam_unix(su-l:session): session closed for user oracle Nov 13 11:20:40 gdyjdb01 passwd: pam_unix(passwd:auth): authentication failure; logname=root uid=0 euid=0 tty=pts/1 ruser= rhost= user=root Nov 13 11:21:18 gdyjdb01 passwd: pam_unix(passwd:auth): authentication failure; logname=root uid=0 euid=0 tty=pts/1 ruser= rhost= user=root Nov 13 11:26:59 gdyjdb01 passwd: pam_unix(passwd:auth): authentication failure; logname=root uid=0 euid=0 tty=pts/1 ruser= rhost= user=root