The Title of the image might give us a clue:
He sees you when you're sleeping, he knows when you're awake, he's copied on
/var/spool/mail/root, so be good for goodness' sake.
/var/spool/mail/root contain? Uhh, for me nothing as a normal user:
cat: /var/spool/mail/root: No such file or directory
And the same with
sudo. For me, there is no
It turns out, Ubuntu is different - by default root's mail goes to
/dev/null, or the black hole in your computer.
To find our logs, we need to look in
And lo and behold, a
sudo cat gives us this line:
Jun 25 22:45:07 Hairy14 sudo: nonsudo : user NOT in sudoers ; TTY=pts/21 ; PWD=/home/tim ; USER=root ; COMMAND=/usr/bin/hello
Note that sometimes (e.g. if your account has no password, is disabled) it will simply not let you run the command - but it will still be reported in the same way:
Jun 25 22:44:17 Hairy14 sudo: nonsudo : user NOT in sudoers ; TTY=pts/21 ; PWD=/home/tim ; USER=root ; COMMAND=/usr/bin/hello
Note that there is a lot of other text along with the "naughty" reports. You may need to grep.