If a non-admin types a sudo command in Terminal, this will appear after they enter their password:
User is not in the sudoers file. This incident will be reported.
Where is this reported to?
Ask Different is a question and answer site for power users of Apple hardware and software. It only takes a minute to sign up.Sign up to join this community
The event will be logged in
/var/log/secure.log and a mail will be sent to root (which by default goes to
/dev/null which is Unix speak for it is discarded).
In older versions of OS X (through 10.6 or maybe 10.7), the disallowed sudo attempt would be logged in
/var/log/secure.log; in more recent versions it's recorded in the ASL (Apple System Log) database, in
/var/log/asl/*. You can read this with the
ALL MESSAGESin the sidebar, then if you can't find them use the search field in the upper right to search for
sudo). You can also use the command-line
syslogcommand to query the database (
syslog -k Facility authpriv -k Sender sudoshould do it). Note that with either Console.app or
syslog, the entries will only be visible if you are running as an admin or root.
For Debain, it's put into /var/log/auth.log
it will be emailed to their apple id, i have found