Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If a non-admin types a sudo command in Terminal, this will appear after they enter their password:

User is not in the sudoers file. This incident will be reported.

Where is this reported to?

share|improve this question
+1 I've wondered this too! – daviesgeek Nov 2 '11 at 22:09
Mandatory xkcd reference: – Javier Nov 3 '11 at 9:55
It's always irritated me to no end that sudo is so crabby in responding to almost always perfectly innocent errors. – Reid Nov 9 '11 at 1:59
/var/spool/mail/<USERNAME> source:… – user35334 Nov 25 '12 at 17:01
to the POLICE! hahahaha ;-) – Michael Sep 15 '14 at 3:43
up vote 21 down vote accepted

The event will be logged in /var/log/secure.log and a mail will be sent to root (which by default goes to /dev/null which is Unix speak for it is discarded).

share|improve this answer
+1 Sending the mail shouldn't fail, but probably won't be read. It is possible to have it sent to a different user, but the chances of that modification are about the same as someone reading root's mail. – ughoavgfhw Nov 2 '11 at 22:08
I had a look at the log file in the mean time, mail to root goes to /dev/null. – patrix Nov 2 '11 at 22:11

In older versions of OS X (through 10.6 or maybe 10.7), the disallowed sudo attempt would be logged in /var/log/secure.log; in more recent versions it's recorded in the ASL (Apple System Log) database, in /var/log/asl/*. You can read this with the utility (select ALL MESSAGES in the sidebar, then if you can't find them use the search field in the upper right to search for sudo). You can also use the command-line syslog command to query the database (syslog -k Facility authpriv -k Sender sudo should do it). Note that with either or syslog, the entries will only be visible if you are running as an admin or root.


share|improve this answer

For Debain, it's put into /var/log/auth.log

share|improve this answer
While technically (probably) correct, this site focuses on OSX and iOS :-) – patrix Mar 24 '14 at 16:37
@patrix Maybe it's a Debain GNU/OS X ;-) – Michael Sep 15 '14 at 3:45
@ Michael I do have Debian on my Mac Mini PPC! ;) – leetNightshade Dec 19 '14 at 19:18

it will be emailed to their apple id, i have found

share|improve this answer
Who's AppleID? There could be many AppleIDs associated with many users on one OS X machine. – Ian C. Sep 15 '14 at 2:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.