38

When someone is not in the sudoers group and try to use sudo, get an error message like this one:

yzT is not in the sudoers file. This incident will be reported.

I'm trying to figure out in which log this information is logged, for check who tried to run a command with sudo for example, but can't find it.

The first Google search says /var/log/syslog but I don't see any information related to sudo there.

2
55

On redhat based linux systems like centos or fedora it is in:

  /var/log/secure

and for debian based systems like ubuntu it is in:

  /var/log/auth.log
3
  • 1
    But how can I know it on my own without googling it? Jun 12 '18 at 13:17
  • 3
    Easy! Read the source code.
    – LadyCailin
    Oct 22 '18 at 21:07
  • cat /var/log/auth.log | grep '3 incorrect password attempts'
    – dedunumax
    Jan 8 '19 at 13:52
3

Never mind, it is in /var/log/auth.log.

1
  • Notices should also be emailed to root by default, though that is configurable.
    – depquid
    Mar 31 '13 at 13:21
3

in Fedora it is in /var/log/audit/audit.log

1
  • 1
    it depends to the /etc/sudoers file, you should search for this record: Default logfile = /var/log/file_name Sep 8 '15 at 15:04
1

On Arch linux (and I assume other distros with systemd), sudo events are logged to the systemd journal and can be accessed with the journalctl command.

Use journalctl -e to see the recent logs, which will include a handful of messages for each successful or unsuccessful sudo call from various sources including sudo itself and the kernel.

Just the recent kernel audit messages can be seen with journalctl -ke. Look for the messages containing kernel: audit: [...] exe="/usr/bin/sudo" [...]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.