From which log can I get details about sudo commands executed by any user. It should contain the working directory, command, user. It will be helpful if you could provide me a shell script to do so

2 Answers 2


Depending on your distro; simply:

$ sudo grep sudo /var/log/secure


$ sudo grep sudo /var/log/auth.log

which gives:

Nov 14 09:07:31 vm1 sudo: pam_unix(sudo:auth): authentication failure; logname=gareth uid=1000 euid=0 tty=/dev/pts/19 ruser=gareth rhost=  user=gareth
Nov 14 09:07:37 vm1 sudo: gareth : TTY=pts/19 ; PWD=/home/gareth ; USER=root ; COMMAND=/bin/yum update
Nov 14 09:07:53 vm1 sudo: gareth : TTY=pts/19 ; PWD=/home/gareth ; USER=root ; COMMAND=/bin/grep sudo /var/log/secure

The user running the command is after the sudo: - gareth in this case.

PWD is the directory.

USER is the user that gareth is running as - root in this example.

COMMAND is the command ran.

Therefore, in the example above, gareth used sudo to run yum update and then ran this example. Before that he typed in the incorrect password.

Note also that there may be rolled log files, like /var/log/secure*

On newer systems:

$ sudo journalctl _COMM=sudo

gives a very similar output.

  • This is a great answer for users that use sudo for each individual command, but for a user that does sudo -i (for example), you get no such details. At least on my Debian-based system, I see session opened and session closed - but nothing in between. I wonder if that's down to a setting in the sudoers file?
    – Seamus
    Jan 27, 2022 at 21:47

A "results filter" for Gareth's solution. (for those that arrived by title of post, not description)

Gives you a clean list of commands-only, run as sudo, by all users.

$sudo journalctl _COMM=sudo  | sed -e '/COMMAND/!d' -e 's/.*COMMAND=//' -e 's/.*bin\///'

Workaround if sed unavailable

$sudo journalctl _COMM=sudo | grep COMMAND

C&P results into Google sheets

In cell B1 C&P this formula


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .