When someone is not in the sudoers group and try to use sudo, get an error message like this one:

yzT is not in the sudoers file. This incident will be reported.

I'm trying to figure out in which log this information is logged, for check who tried to run a command with sudo for example, but can't find it.

The first Google search says /var/log/syslog but I don't see any information related to sudo there.


On redhat based linux systems like centos or fedora it is in:


and for debian based systems like ubuntu it is in:

| improve this answer | |
  • 1
    But how can I know it on my own without googling it? – Turkhan Badalov Jun 12 '18 at 13:17
  • 2
    Easy! Read the source code. – LadyCailin Oct 22 '18 at 21:07
  • cat /var/log/auth.log | grep '3 incorrect password attempts' – dedunumax Jan 8 '19 at 13:52

Never mind, it is in /var/log/auth.log.

| improve this answer | |
  • Notices should also be emailed to root by default, though that is configurable. – depquid Mar 31 '13 at 13:21

in Fedora it is in /var/log/audit/audit.log

| improve this answer | |
  • 1
    it depends to the /etc/sudoers file, you should search for this record: Default logfile = /var/log/file_name – Shahram Pezeshki Sep 8 '15 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.