Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

"X is not in the sudoers file. This incident will be reported."

Where is it reported?

share|improve this question
3  
The same place as your "permanent record" from elementary school. –  Spiff Nov 16 '13 at 18:35
2  
Probably here: xkcd.com/838 ;) –  jb. Nov 16 '13 at 21:06
1  
@jb. Check the alt-text. It says where it is reported, though it uses the depreciated location to make it fit in the song structure. –  Compro01 Nov 17 '13 at 15:52

3 Answers 3

up vote 2 down vote accepted

In older versions of OS X (through 10.6 or maybe 10.7), the disallowed sudo attempt would be logged in /var/log/secure.log; in more recent versions it's recorded in the ASL (Apple System Log) database, in /var/log/asl/*. You can read this with the Console.app utility (select ALL MESSAGES in the sidebar, then if you can't find them use the search field in the upper right to search for 'sudo'). You can also use the command-line syslog command to query the database (syslog -k Facility authpriv -k Sender sudo should do it). Note that with either Console.app or syslog, the entries will only be visible if you are running as an admin or root.

share|improve this answer

Apparently Santa get the reports. On a serious mode:

The event will be logged in /var/log/secure.log and a mail will be sent to root (which by default goes to /dev/null which is Unix speak for it is discarded).

Thanks to patrix.

So, you can check the /var/log/secure.log file for all the events. mail isn't reliable because is redirected to the oblivion (anything that goes to /dev/null get lost)

share|improve this answer
    
I am unable to find that log file at that location on my Mavericks machine. –  Ben Nov 16 '13 at 16:10
    
I can however find something under /var/log/module/com.apple.securityd/security.log.<datetime> –  Ben Nov 16 '13 at 16:13
    
mm... I don't have a Mac... but the people that know (in Ask Different) says that there is one... maybe they were lying... –  Braiam Nov 16 '13 at 22:31

As far as I remember it could be viewed by command mail But this was in Debian, dont know how it is in OSX

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.