Photo by Kelly Sikkema on Unsplash
Processing the new sudo logging format
Neat Packaging
The Linux sudo command helps Linux administrators run specific programs in the context of another user, typically root. In this way, non-privileged users can run management programs on a system. The tool writes to a log to keep track of users who used sudo to run programs. The default format has been plain text, but from version 1.9.4, it can be configured to log in JSON format.
sudo Logging
By default, sudo uses syslog to send log messages, which means that, on a Linux system, the messages end up in the system journal. You can choose between JSON and sudo plain text as the log format. Text ensures that the messages are easy to read while keeping the amount of information that ends up in the log to a minimum (Figure 1).
Figure 1: By default, sudo uses an easy-to-read plain text log format for all messages routed by syslog.
If you are looking for more information on a sudo log event, you can change the format of the log message to JSON, which makes several data fields available in the journal (Figure 2). You will find more detailed information on the individual fields of the log format by entering
man 5 sudoers
for the
...
Buy this article as PDF
(incl. VAT)
Buy ADMIN Magazine
US / Canada
UK / Australia
Related content
-
Log Management
One of the more mundane, perhaps boring, but necessary administration tasks is checking system logs – the source of knowledge or intelligence of what is happening in the cluster.
-
Installing and operating the Graylog SIEM solution
Graylog security information and event management combines real-time monitoring and immediate notification of rule violations with long-term archiving for analysis and reporting. -
A modern logging solution
As systems grow more complex and distributed, managing and making sense of logs used for monitoring, debugging, and troubleshooting can become a daunting task. Fluentd and its lighter counterpart Fluent Bit can help you unify data collection and consumption to make sense of logging data. -
Network monitoring with Zeek
Zeek offers an arsenal of scripts for monitoring popular network protocols and comes with its own policy scripting language for customization. -
Data center management with Ralph
The Ralph open source asset management system and configuration database keep things simple when it comes to managing data centers, but without compromising flexibility.