Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Would it be possible to check if the root user (or sudo) has been accessed on my server.

I ask this because I am creating a server monitoring tool and I wanted to know if there was a way to check this.

If it is possible where would I go to check it.

I am currently testing my application on Arch Linux and Ubuntu 11.04

Any help would be much appreciated.

Thanks!

share|improve this question
up vote 4 down vote accepted

Normally using grep on /var/log/auth.log should show you who/what got root privileges.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .