diff --git a/pam.spec b/pam.spec
index ec8f4ff..8a104a4 100644
--- a/pam.spec
+++ b/pam.spec
@@ -3,7 +3,7 @@
 Summary: An extensible library which provides authentication for applications
 Name: pam
 Version: 1.1.8
-Release: 1%{?dist}
+Release: 2%{?dist}
 # The library is BSD licensed with option to relicense as GPLv2+
 # - this option is redundant as the BSD license allows that anyway.
 # pam_timestamp, pam_loginuid, and pam_console modules are GPLv2+.
@@ -369,6 +369,9 @@ fi
 %doc doc/adg/*.txt doc/adg/html
 
 %changelog
+* Mon Oct 21 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.8-2
+- update lastlog with pam_lastlog also for su (#1021108)
+
 * Mon Oct 14 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.8-1
 - new upstream release
 - pam_tty_audit: allow the module to work with old kernels
diff --git a/postlogin.pamd b/postlogin.pamd
index 9ebb870..e036f4e 100644
--- a/postlogin.pamd
+++ b/postlogin.pamd
@@ -2,6 +2,6 @@
 # This file is auto-generated.
 # User changes will be destroyed the next time authconfig is run.
 
-session     [success=1 default=ignore] pam_succeed_if.so service !~ gdm* quiet
+session     [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
 session     [default=1]   pam_lastlog.so nowtmp showfailed
 session     optional      pam_lastlog.so silent noupdate showfailed