43

When someone is not in the sudoers group and try to use sudo, get an error message like this one:

yzT is not in the sudoers file. This incident will be reported.

I'm trying to figure out in which log this information is logged, for check who tried to run a command with sudo for example, but can't find it.

The first Google search says /var/log/syslog but I don't see any information related to sudo there.

2

4 Answers 4

62

On redhat based linux systems like centos or fedora it is in:

  /var/log/secure

and for debian based systems like ubuntu it is in:

  /var/log/auth.log
3
  • 2
    But how can I know it on my own without googling it? Jun 12, 2018 at 13:17
  • 3
    Easy! Read the source code.
    – LadyCailin
    Oct 22, 2018 at 21:07
  • 1
    cat /var/log/auth.log | grep '3 incorrect password attempts'
    – dedunu
    Jan 8, 2019 at 13:52
3

Never mind, it is in /var/log/auth.log.

1
  • Notices should also be emailed to root by default, though that is configurable.
    – depquid
    Mar 31, 2013 at 13:21
3

in Fedora it is in /var/log/audit/audit.log

1
  • 2
    it depends to the /etc/sudoers file, you should search for this record: Default logfile = /var/log/file_name Sep 8, 2015 at 15:04
3

On Arch linux (and I assume other distros with systemd), sudo events are logged to the systemd journal and can be accessed with the journalctl command.

Use journalctl -e to see the recent logs, which will include a handful of messages for each successful or unsuccessful sudo call from various sources including sudo itself and the kernel.

Just the recent kernel audit messages can be seen with journalctl -ke. Look for the messages containing kernel: audit: [...] exe="/usr/bin/sudo" [...]

You must log in to answer this question.