25

If a non-admin types a sudo command in Terminal, this will appear after they enter their password:

User is not in the sudoers file. This incident will be reported.

Where is this reported to?

Improve this question
4
  • 16
    Mandatory xkcd reference: xkcd.com/838
    – Javier
    Commented Nov 3, 2011 at 9:55
  • It's always irritated me to no end that sudo is so crabby in responding to almost always perfectly innocent errors.
    – Reid
    Commented Nov 9, 2011 at 1:59
  • 3
    /var/spool/mail/<USERNAME> source: stackoverflow.com/questions/13546933/…
    – user35334
    Commented Nov 25, 2012 at 17:01
  • to the POLICE! hahahaha ;-)
    – Michael
    Commented Sep 15, 2014 at 3:43

3 Answers 3

Reset to default
25

The event will be logged in /var/log/secure.log and a mail will be sent to root (which by default goes to /dev/null which is Unix speak for it is discarded).

Improve this answer
2
  • +1 Sending the mail shouldn't fail, but probably won't be read. It is possible to have it sent to a different user, but the chances of that modification are about the same as someone reading root's mail.
    – ughoavgfhw
    Commented Nov 2, 2011 at 22:08
  • I had a look at the log file in the mean time, mail to root goes to /dev/null.
    – nohillside ♦
    Commented Nov 2, 2011 at 22:11
5

In older versions of OS X (through 10.6 or maybe 10.7), the disallowed sudo attempt would be logged in /var/log/secure.log; in more recent versions it's recorded in the ASL (Apple System Log) database, in /var/log/asl/*. You can read this with the Console.app utility (select ALL MESSAGES in the sidebar, then if you can't find them use the search field in the upper right to search for sudo). You can also use the command-line syslog command to query the database (syslog -k Facility authpriv -k Sender sudo should do it). Note that with either Console.app or syslog, the entries will only be visible if you are running as an admin or root.

Source

Improve this answer
2
  • "Note that with either Console.app or syslog, the entries will only be visible if you are running as an admin or root." @Braiam does that mean I could run the above command with sudo if I'm in the sudoers file? Like: sudo syslog -k Facility authpriv -k Sender sudo
    – Alex Ixeras
    Commented Jul 29, 2017 at 13:33
  • @AlexIxeras well, sudo makes you effectively root.
    – Braiam
    Commented Jul 29, 2017 at 13:59
-2

it will be emailed to their apple id, i have found

Improve this answer
1
  • 1
    Who's AppleID? There could be many AppleIDs associated with many users on one OS X machine.
    – Ian C.
    Commented Sep 15, 2014 at 2:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .