line-container-orgde782ee" class="outline-3">
<h3 id="security-analysis-of-sudo-use-in-auth-log-file"><span class="section-number-3">3.5</span> Security Analysis of sudo use in Auth Log File</h3>
<div class="outline-text-3" id="text-security-analysis-of-sudo-use-in-auth-log-file">
<p>
The Linux /var/log/auth.log file has timed records about <code>sudo</code> which
look like this:
</p>

<pre class="example">
May 17 00:36:15 localhost sudo:   alice : TTY=pts/2 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/