Summarize sudo Commands by User

You need to extract sudo users and command paths from auth log lines.

Command

sed -n 's/.*sudo: *\([^: ]*\).*COMMAND=\(.*\)$/\1 -> \2/p' fixtures/user-access-audit/logs/auth.log | sort

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not assume this covers every privileged action; rotated logs, journal data, and direct root sessions may add context.

Expected output

A sorted list of sudo users mapped to the commands they ran.

System impact

Read-only, sensitive output. Nothing changes. The command filters sudo log lines and extracts the acting user plus command.

May require elevated permissions on protected paths or service-owned files.

Recovery / rollback: no state is changed.

When to use it

Use during access reviews, incident triage, or post-change checks when privilege use matters.

When not to use it

Do not assume this covers every privileged action; rotated logs, journal data, and direct root sessions may add context.

Watch this command run

Command transcript

This sanitized transcript shows the commands and output shape without exposing host details.

demo@lab:~$

$ grep 'sudo:' sample-files/user-access-audit/logs/auth.log

Jun 25 08:12:19 host sudo:     alex : TTY=pts/0 ; PWD=/srv/app ; USER=root ; COMMAND=/usr/bin/systemctl reload nginx
Jun 25 09:04:02 host sudo:   deploy : TTY=pts/1 ; PWD=/srv/app ; USER=root ; COMMAND=/usr/bin/journalctl -u app.service
Jun 25 10:16:02 host sudo: breakglass : TTY=pts/2 ; PWD=/root ; USER=root ; COMMAND=/usr/bin/passwd alex

$ sed -n 's/.*sudo: *$[^: ]*$.*COMMAND=$.*$$/\1 -> \2/p' sample-files/user-access-audit/logs/auth.log | sort

alex -> /usr/bin/systemctl reload nginx
breakglass -> /usr/bin/passwd alex
deploy -> /usr/bin/journalctl -u app.service

View commands shown

These are the commands shown in the sanitized transcript.