A Sudo Logs audit reviews and analyzes recorded privileged command activity. It captures the timestamp, the user, the terminal used, and the exact commands run with elevated privileges.
Supported platforms
macOS and Linux
Input parameters
The following input parameters are available for this audit.
Name | Platform | Type | Required | Repeatable | Usage |
|---|---|---|---|---|---|
Preserve times | Linux | Bool | FALSE | FALSE | Manually reset last access times for audited files. |
Date Regex | macOS, Linux | String | FALSE | FALSE | Specify the date to match against the log entries found. |
Username regex | macOS, Linux | String | FALSE | FALSE | Specify a username to match against the log entries found. |
Command-line content Regex | macOS, Linux | String | FALSE | FALSE | Specify command-line content to match against found log entries. |
Note
On SUSE Linux Enterprise endpoints, Sudo Logs audit returns correct results only if sudo logs are present in the /var/log/messages file.