While reading about Linux, especially about sudo, I got:

A message such as the following would appear in a system log file (usually /var/log/secure) when trying to execute sudo bash without successfully authenticating the user:

authentication failure; logname=op uid=0 euid=0 tty=/dev/pts/6 ruser=op rhost= user=op
conversation failed
auth could not identify password for [op]
op : 1 incorrect password attempt ;
TTY=pts/6 ; PWD=/var/log ; USER=root ; COMMAND=/bin/bash

Then I tried it in my shell prompt:

anupam@JAZZ:~$ sudo bash
[sudo] password for anupam: 

then when I looked for /var/log/secure, it was not there

anupam@JAZZ:~$ more /var/log/secure
/var/log/secure: No such file or directory
anupam@JAZZ:~$ ls /var/log
alternatives.log       auth.log         dmesg           gpu-manager.log  mysql.log              pm-suspend.log.2.gz  upstart
alternatives.log.1     auth.log.1       dmesg.0         hp               mysql.log.1.gz         samba                wtmp
alternatives.log.2.gz  auth.log.2.gz    dmesg.1.gz      installer        mysql.log.2.gz         speech-dispatcher    wtmp.1
apache2                auth.log.3.gz    dmesg.2.gz      jetty            mysql.log.3.gz         syslog               Xorg.0.log
apport.log             auth.log.4.gz    dmesg.3.gz      kern.log         mysql.log.4.gz         syslog.1             Xorg.0.log.old
apport.log.1           boot.log         dmesg.4.gz      kern.log.1       mysql.log.5.gz         syslog.2.gz          Xorg.1.log
apport.log.2.gz        bootstrap.log    dpkg.log        kern.log.2.gz    mysql.log.6.gz         syslog.3.gz          Xorg.1.log.old
apport.log.3.gz        btmp             dpkg.log.1      kern.log.3.gz    mysql.log.7.gz         syslog.4.gz
apport.log.4.gz        btmp.1           dpkg.log.2.gz   kern.log.4.gz    pm-powersave.log       syslog.5.gz
apport.log.5.gz        ConsoleKit       faillog         lastlog          pm-powersave.log.1     syslog.6.gz
apport.log.6.gz        cups             fontconfig.log  lightdm          pm-powersave.log.2.gz  syslog.7.gz
apport.log.7.gz        dbconfig-common  fsck            mysql            pm-suspend.log         udev
apt                    dist-upgrade     gdm             mysql.err        pm-suspend.log.1       unattended-upgrades

Is there any alternative for /var/log/secure in my system?


This type of log events is usually found in /var/log/auth.log in Debian and its derivatives including Ubuntu.

| improve this answer | |
  • I guess the last 4 linesOct 10 11:26:26 JAZZ sudo: anupam : TTY=pts/1 ; PWD=/home/anupam ; USER=root ; COMMAND=/bin/bash Oct 10 11:26:26 JAZZ sudo: pam_unix(sudo:session): session opened for user root by anupam(uid=0) Oct 10 11:39:01 JAZZ CRON[3178]: pam_unix(cron:session): session opened for user root by (uid=0) Oct 10 11:39:01 JAZZ CRON[3178]: pam_unix(cron:session): session closed for user root was exactly what I was looking for ,,isn't it?? – lazarus Oct 10 '14 at 6:31
  • 2
    Seems likely :) – Marcin Kaminski Oct 10 '14 at 6:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.