Date: 11.04.2014 04:33 Subject: SECURITY information for server1

server1 : Apr 11 10:33:19 : test : user NOT in sudoers ; TTY=pts/0 ; PWD=/home/test ; USER=root ; COMMAND=/bin/su -

I assume you use rsyslog as logging daemon. Save the following configuration snippet as /etc/rsyslog.d/60-sudo-mails.conf.

# Load Mail output module

# Template for the "Subject:" line to dynamically set the affected hostname 
    name   = "mailSubject" 
    type   = "string" 
    string = "SECURITY information for %hostname%"

# If messages go to facility "authpriv" and have severity "warning" (or worse)
# and the program's name is "sudo", then perform the given action:
if ( prifilt("authpriv.warning") and ($programname == "sudo") ) then {

        type             = "ommail" 
        server           = "your_mail_server_here, e.g."
        port             = "25"
        mailfrom         = ""
        mailto           = ""
        body.enable      = "on"
        subject.template = "mailSubject"


Make sure you configure a mail server that allows to send emails without authentication. Usually this will be a mailserver in your local network but not GMail or something like that because rsyslog's output module ommail can currently not be configured for authentication (username/password). You may also want to add the parameter

action.execOnlyOnceEveryInterval = "600"

to the action so you get only one email every 10 minutes (the others are simply discarded). It depends on how often you expect such a message.

When done, restart rsyslog:

sudo systemctl restart rsyslog.service

Try out by either issueing a prohibited sudo command or by running

logger -p authpriv.warning -t sudo "This should be sent as an email"

The above configuration will put the logmessage "as is" into the mail body. If you prefer some formatting or different appearance then you need to supply a template for the email's body

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.