Displayign what user is running sudo commands

jakev383 · 08-04-2009, 02:55 PM

I was asked this today, and I did not know the answer.
How do you display what users are running sudo commands, and what commands they are running as sudo?

Since I didn't know the answer I tried to google it, but only came back with results on how to use sudo and configure it - not exactly what I was looking for.
Anyone have a quick answer for me?
Thanks!

MensaWater · 08-04-2009, 03:01 PM

Usually /var/log/secure will show you which commands have been run with sudo and by which users.

e.g.
Aug 4 15:01:09 atlema02 sudo: jlightne : TTY=pts/1 ; PWD=/home/jlightne ; USER=root ; COMMAND=/bin/su -

This line shows me that user, jlightne, rand command "/bin/su -".

It will also log unsuccessful attempts.