Cybersecurity Triage
Read-only, sensitive outputShow Recent sudo Commands
You need to see recent sudo commands from auth logs.
Command
grep 'sudo:' logs/auth.log | tail -n 10Before you run this
System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.
When not to use it: Do not assume all privileged actions use sudo; also inspect service logs and shell history where appropriate.
Expected output
Recent sudo log lines including user, working directory, target user, and command.
System impact
Read-only, sensitive output. Nothing changes. The command filters sudo lines and shows the newest matches in file order.
May require elevated permissions on protected paths or service-owned files.
Recovery / rollback: no state is changed.
When to use it
Use during incident triage or after unexpected service changes.
When not to use it
Do not assume all privileged actions use sudo; also inspect service logs and shell history where appropriate.
next steps
Related commands
Show Successful Logins and sudo Use
Access reviews need both who logged in and who elevated privileges.
grep -E 'Accepted publickey|sudo:' /var/log/auth.log 2>/dev/null
Show Accepted SSH Logins
During first response, successful logins matter more than background noise.
grep 'Accepted publickey' logs/auth.log
Review a Breakglass Account
Emergency accounts should be easy to find and hard to ignore.
sudo grep -Rhn 'breakglass' /etc /home /var/log/auth.log 2>/dev/null
Summarize sudo Commands by User
Privilege history is easier to review when users and commands are separated.
sed -n 's/.*sudo: *\([^: ]*\).*COMMAND=\(.*\)$/\1 -> \2/p' /var/log/auth.log 2>/dev/null | sort
Review sudo Grants
Privilege paths should be visible before you remove or approve access.
awk -F: '$1=="sudo" {print "sudo group: " $4}' /etc/group; sudo grep -RhnE '^[^#].*ALL=' /etc/sudoers /etc/sudoers.d 2>/dev/null
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.