2

For some reason, the username of the user calling a command with sudo is not shown in the system log:

$ journalctl -ef
sudo[30160]: pam_unix(sudo:session): session opened for user root by (uid=0)
sudo[30160]: pam_unix(sudo:session): session closed for user root

I assume that the log message should actually be something like session opened for user root by myusername. It doesn't matter whether the sudo caller is a daemon process like telegraf or an interactive user via ssh.

How can I fix this? As it is, its impossible to see who actually called sudo by only checking the log files.

/etc/debian_version is 9.5
uname is Linux hostname 4.9.0-8-amd64 #1 SMP Debian 4.9.110-3+deb9u6 (2018-10-08) x86_64 GNU/Linux

Strayer
  • 121
  • 3

0 Answers0