topic Re: how to log sudo activities in separate log file in Operating System - Linux

how to log sudo activities in separate log file

senthil_kumar_1 — Tue, 07 Apr 2009 14:07:54 GMT

Hi

I am using Redhat, Suse and HP-UX.

There is some users are configured in sudo.

So i want to log all sudo activities in separate file.

Pls answer my following questions:

1) what is default log file where all sudo activities are stored in Redhat, suse and HP-UX

2) How to store sudo activities in separate log file in Redhat, Suse and HP-UX.

pls explain for each OS.

Re: how to log sudo activities in separate log file

Ivan Ferreira — Tue, 07 Apr 2009 14:31:58 GMT

1) Normally, sudo messages are sent to syslog.

2) Add a line like this to the defaults specification:

Defaults logfile=/var/log/sudo.log

Re: how to log sudo activities in separate log file

senthil_kumar_1 — Tue, 07 Apr 2009 14:44:15 GMT

Hi

in which file we have to add this line.

pls tell me for Redhat, suse and HP-UX separately.

is sudo logs only will be stored in /var/log/sudo.log after adding this entry?

or

is all the logs of /var/log/messages" is transfered to "/var/log/sudo.log"

Re: how to log sudo activities in separate log file

Avinash20 — Tue, 07 Apr 2009 16:54:34 GMT

sudo can log both successful and unsuccessful attempts (as well as errors) to syslog(3), a log file, or both. By default sudo will log via syslog(3) but this is changeable at configure time or via the sudoers file.

Re: how to log sudo activities in separate log file

Avinash20 — Tue, 07 Apr 2009 16:57:16 GMT

Refer to http://www.gratisoft.us/sudo/man/sudoers.html

and search for sudo.log

Re: how to log sudo activities in separate log file

Avinash20 — Tue, 07 Apr 2009 17:00:20 GMT

I would change the sudoers file with visudo to read this way:

Defaults logfile=/var/adm/sudo.log

The log file which we generally mention is
/var/log/sudo.local.log

Since /var/log does not exist, it get to the the default destination syslog.log

Re: how to log sudo activities in separate log file

Ivan Ferreira — Tue, 07 Apr 2009 18:38:24 GMT

>>> in which file we have to add this line.

Just run as root the visudo command

>>> pls tell me for Redhat, suse and HP-UX separately.

Same for all

>>> is sudo logs only will be stored in /var/log/sudo.log after adding this entry?

Only sudo logs