email on sudo usage
 

Hello,

An old Fedora server I'm working on sends out emails immediately whenever sudo is used.

I've looked in '/etc/sudoers' and there are NO entries for:

mailto
mail_always on

And logwatch doesn't appear to be running so I'm just wondering how is it sending emails that sudo has been used?

Thanks,

Hi,

That's pretty hard to answer with so little information since there are several ways to obtain that functionality. Is there for example any remote logserver in use, for example syslog-ng? Or look at the different cron locations if anything is put in place to parse the secure log. Do the mails get sent out instantly when someone uses sudo or periodically (with a delay)?. Just some ideas.

Kind regards,

Eric