Where does sudoer reports go?

Question

So I'm testing out a small CentOS build (rackspace cloud). I set up my user and went to do some sudo'ing. Well, I forgot the step to add my user to the sudoers file with visudo. So of course, I get this error:

is not in the sudoers file. This incident will be reported.

Never saw it before, so now I'm wondering. Where does this get reported? Does it just get sent to mail, or is it logged somewhere?

Thanks for any help

score 18 · Accepted Answer · answered Jun 23 '11 at 20:23

It will typically get logged /var/log/secure, and mail will be sent to root on the local system. You can control this behavior in your /etc/sudoers file. There are a suite of mail_* configuration options that determine when sudo sends out mail, and there are additional options that control how it logs to syslog.

score 16 · Answer 2 · answered Jun 23 '11 at 20:30

16

XKCD Source: http://xkcd.com/838/

(for the real answer, look at larsks's answer instead).

answered Jun 23 '11 at 20:30

wildpeaks

465
2
11

hah, looks like i'm getting coal for christmas this year :( – Derek Downey Jun 23 '11 at 20:31

Where does sudoer reports go?

2 Answers2