How to Log Every Sudo Command with IP | Tech Support Site

As a user, you may have encountered situations where you need to keep track of every sudo command executed on your system along with the IP address from which it was executed. This can be useful for security purposes and troubleshooting. In this article, we will guide you on how to log every sudo command with IP.

Step 1: Enable Sudo Logging

The first step is to enable sudo logging on your system. Open the terminal and run the following command:

This will open the sudoers file in the nano text editor. Look for the line that says Defaults env_reset. Below that line, add the following line:

Save the file and exit the text editor.

Step 2: Create a Log File

Next, we need to create the log file where the sudo commands and IP addresses will be recorded. Run the following command:

This will create an empty log file called sudo.log in the /var/log directory.

Step 3: Set Permissions

We need to set the appropriate permissions for the log file so that sudo can write to it. Run the following command:

This command sets the permissions of the log file to read and write for the owner, and read-only for the group and others.

Step 4: Test the Logging

Now that everything is set up, you can test if the logging is working correctly. Open the terminal and run any sudo command, such as:

After running the command, open the log file to see if the command and IP address are recorded:

You should see a line similar to the following:

If you see this line, it means that the logging is working correctly.

Step 5: Viewing the Logs

To view the logs, you can use any text editor or command-line tools. For example, to view the last 10 lines of the log file, you can run:

This will display the last 10 lines of the log file, which includes the timestamp, username, IP address, and command.

That's it! You have successfully set up sudo logging with IP address. Now you can keep track of every sudo command executed on your system.

References