track sudo user

mikeshn · 10-28-2003, 06:27 PM

If a user has sudo privileges and make some changes to the system. Is there a way to distinct who did these changes.

Example:
If user="Tom" has sudo privileges and reboot the system. Can I truck who exactly reboot the system?

P.S In this case just user can reboot the system.

ToniT · 10-28-2003, 07:04 PM

In the /var/log/auth.log you should see the things done with sudo privilegies.

micxz · 10-28-2003, 07:12 PM

Hint: syslog

Code:

grep sudo /var/log/messages