Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Where are unauthorized sudo attempts reported to?

When you attempt to use sudo, and are not allowed, a message says that the attempt will be reported.

Is this only reported in var/log/auth.log ? or is there another place? The reason I ask, is because the log contains so much that it's not a very good way of viewing often.

share|improve this question
up vote 5 down vote accepted

It is reported in that file in ubuntu. It quite easy to change that. Just add this line in your sudeers-file. Use sudo visudo

Defaults    logfile=/var/log/sudo.log 

You can change the file name to whatever you think is appropriate.

share|improve this answer
Thanks this helps accomplish what I was wanting. – Frantumn Jan 23 '13 at 19:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.