1. A method for detecting possible security violations and issues in a computer system related to user ID substituting and switching, said computer system having a log of user ID substitutions and switches, said method comprising the steps of: providing a set of rules which define conditions of user ID substitutions and switches which are to be considered possible security issues; providing a process adapted to evaluate said log of user ID substitutions and switches according to said set of rules; evaluating said log of user ID substitutions and switches to find any entries in said log which meet one or more defined conditions in said set of rules; and outputting an alert responsive to finding one or more log entries which meet said conditions.