When root's shell is /sbin/pmksh, and when running "su - root -c <command>", PMSHELL_USER does not contain the login of the invoking user, it contains "root".
This is the expected behaviour if the command is being executed without pmrun since the original user will not be passed through. Prefixing the commands with pmrun will allow the original user to be captured and recorded via PMSHELL_USER.
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center