From which log can I get details about sudo commands executed by any user. It should contain the working directory, command, user. It will be helpful if you could provide me a shell script to do so
Depending on your distro; simply:
$ sudo grep sudo /var/log/secure
$ sudo grep sudo /var/log/auth.log
Nov 14 09:07:31 vm1 sudo: pam_unix(sudo:auth): authentication failure; logname=gareth uid=1000 euid=0 tty=/dev/pts/19 ruser=gareth rhost= user=gareth Nov 14 09:07:37 vm1 sudo: gareth : TTY=pts/19 ; PWD=/home/gareth ; USER=root ; COMMAND=/bin/yum update Nov 14 09:07:53 vm1 sudo: gareth : TTY=pts/19 ; PWD=/home/gareth ; USER=root ; COMMAND=/bin/grep sudo /var/log/secure
The user running the command is after the
gareth in this case.
PWD is the directory.
USER is the user that
gareth is running as -
root in this example.
COMMAND is the command ran.
Therefore, in the example above,
sudo to run
yum update and then ran this example. Before that he typed in the incorrect password.
On newer systems:
$ sudo journalctl _COMM=sudo
gives a very similar output.