sudo logging record (Rsyslog)

1, check the software

Rpm-qa|egrep "Sudo|rsyslog"

2, edit sudoers

echo "Defaults Logfile=/var/log/sudo.log" >>/etc/sudoers

Tail-1/etc/sudoers
Visudo-c

3, edit Rsyslog and restart service
[Email protected] ~]# tail-1/etc/rsyslog.conf
Local2.debug/var/log/sudo.log

Etc/init.d/rsyslog restart

4, inspection

[Email protected] ~]# tail-f/var/log/sudo.log
Jul 01:08:50:LANNY:TTY=PTS/1; Pwd=/home/lanny; User=root;
COMMAND=/BIN/SU-

[[email protected] ~]$ sudo echo "Kaifa01 all= (All) Nopasswd:all" >>/etc/sudoers
-bash:/etc/sudoers:permission denied

5, principle

sudoers------>local2.debug (device)----->rsyslog write to File

6, centralized log processing scheme

6.1inotify+rsync

6.2rsyslog comes with

sudo logging record (Rsyslog)