https://community.splunk.com/t5/Getting-Data-In/How-to-Monitor-Linux-ssh-connection-with-quot-super-user-quot/m-p/657208#M111278 <P>Hello Splunkers !<BR /><BR />I am looking for a way to monitor and retrieve the user that logged into my Linux machine, <STRONG>but only the user part of the root or wheel groups</STRONG>, or who are present <STRONG>in any sudoers file.</STRONG></P> <P>I was able to get the user who ssh into my machine using the 'var/log/secure' file but my challenge was to check if the user "have a lot of rights or not". I have some idea in mind to achieve this but maybe there were something out of the box with Splunk or the TA Nix Add-On....</P> <P>If somebody already tried to so something similar, any help would be appreciated !</P> <P>Thanks !<BR />GaetanVP</P> Mon, 11 Sep 2023 16:43:27 GMT GaetanVP 2023-09-11T16:43:27Z https://community.splunk.com/t5/Getting-Data-In/How-to-Monitor-Linux-ssh-connection-with-quot-super-user-quot/m-p/657208#M111278 <P>Hello Splunkers !<BR /><BR />I am looking for a way to monitor and retrieve the user that logged into my Linux machine, <STRONG>but only the user part of the root or wheel groups</STRONG>, or who are present <STRONG>in any sudoers file.</STRONG></P> <P>I was able to get the user who ssh into my machine using the 'var/log/secure' file but my challenge was to check if the user "have a lot of rights or not". I have some idea in mind to achieve this but maybe there were something out of the box with Splunk or the TA Nix Add-On....</P> <P>If somebody already tried to so something similar, any help would be appreciated !</P> <P>Thanks !<BR />GaetanVP</P> Mon, 11 Sep 2023 16:43:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-Monitor-Linux-ssh-connection-with-quot-super-user-quot/m-p/657208#M111278 GaetanVP 2023-09-11T16:43:27Z