阅读中文版本

Enable sudo Command Logging

Log every sudo invocation to syslog with the invoking user and command so privileged actions are auditable.

echo 'Defaults logfile="/var/log/sudo.log"' | sudo tee /etc/sudoers.d/logging
echo 'Defaults log_input, log_output' | sudo tee -a /etc/sudoers.d/logging
sudo visudo -c

sudo id
sudo tail -n 2 /var/log/sudo.log

What this recipe does

Configure sudo to record all invocations and verify the audit trail.

Privileged commands leave no trace, making it impossible to attribute risky changes to a person or session.

Prerequisites

• A Linux host with sudo
• Rsyslog or journald
• Root or sudo access

Procedure

1. Enable logging and separate sudo output.

echo 'Defaults logfile="/var/log/sudo.log"' | sudo tee /etc/sudoers.d/logging
echo 'Defaults log_input, log_output' | sudo tee -a /etc/sudoers.d/logging
sudo visudo -c

Expected result: sudo writes a dedicated audit log; visudo -c confirms the config is valid.

2. Generate and inspect a logged event.

sudo id
sudo tail -n 2 /var/log/sudo.log

Expected result: The log records the user, command, and working directory of the invocation.

How to confirm it worked

Run the commands above and confirm every expected result in order. If a step does not produce the stated output, use the troubleshooting notes before continuing. A passing run shows each sudo invocation appears in the audit log with user and command, and log rotation is configured.

Troubleshooting

Log file grows without bound — Add logrotate for the sudo log and forward to a central collector.

log_output stores session content — Consider privacy and retention; enable it only where justified.

Limitations

• Local logs can be tampered with by root.
• log_output consumes space.
• Does not cover privilege gained via other means.