Review sudo Activity with journalctl

See who ran sudo commands — and who failed authentication — by filtering the systemd journal for sudo entries.

LinuxlogsudosecurityMedium risk

Run journalctl _COMM=sudo --since today to list today's sudo usage, including failed authentication attempts.

01Command

Command

$ journalctl _COMM=sudo --since today

02What it does

Every sudo invocation is logged to the systemd journal, and journalctl can filter by any field: _COMM=sudo narrows to the sudo binary, while --since today (or -S "2026-09-01") bounds the time window. Each entry shows the invoking user, the TTY, and the command run; lines with "incorrect password attempts" or "user NOT in sudoers" flag failed or unauthorized tries. On Debian/Ubuntu, journalctl -q -g 'sudo|authentication failure' also catches login failures from other sources.

03Risk

RiskMedium risk

Requirementssystemd journal (default on Ubuntu, Debian, Fedora, Arch)

!Warning: By default the journal may not persist across reboots on some distros — set Storage=persistent in /etc/systemd/journald.conf if you need a lasting audit trail, and remember attackers with root can edit it.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

journalctl(1) — Linux manual page
man7.org · community · 2026-09-17
Evidence: Documents filtering journal output by fields such as _COMM and by time with --since.
journalctl(1) — Debian manual page
Debian · community · 2026-09-17
Evidence: Reference for journalctl field matching such as _COMM= and time filtering with --since.

Last verified: 2026-09-18 · Category: Security & Privacy

06Related solutions

Create an SSH key pair with ssh-keygen (Ed25519)

LinuxTerminaldevelopersecurity

Generate a modern Ed25519 public/private key pair in ~/.ssh for authenticating to servers and Git platforms without passwords.

Low risk ✓ 2026-09-17

Change file permissions with chmod

LinuxFilesTerminalsecurity

Add or remove read, write, and execute permission for the owner, group, or others using symbolic or octal modes.

Medium risk ✓ 2026-09-17

Allow a port through the firewall with ufw

Linuxnetworksecurity

Add a UFW rule to permit inbound traffic on a TCP or UDP port, such as SSH on port 22.

High risk ✓ 2026-09-17