On Sat, 19 Feb 2022 20:36:29 +0100
Florian Zieboll via Dng <dng@???> wrote:

> On Sat, 19 Feb 2022 19:09:15 +0100
> "dng@???" <dng@???> wrote:
> >
> > Probably not helpful too but does auth.log show something from the
> > use of exec=¨/bin/su" ?
>
> Yes, as my standard user is not a "sudoer", I use to get a root shell
> by 'su'ing into the admin account and then 'sudo su -' from there, so
> I have numerous sets like the following in the auth.log:
>
> # cat /var/log/auth.log | grep -B2 -A5 '/bin/su'

Oh, I missed to grep for the "exec=" part! But no results for
'exec="/bin/su"' resp. '\ exec=' at all.