Summarize sudo Commands by User

You need to extract sudo users and command paths from auth log lines.

Command

sed -n 's/.*sudo: *\([^: ]*\).*COMMAND=\(.*\)$/\1 -> \2/p' fixtures/user-access-audit/logs/auth.log | sort

Before you run this

Risk: safe. Do not assume this covers every privileged action; rotated logs, journal data, and direct root sessions may add context.

Expected output

A sorted list of sudo users mapped to the commands they ran.

System impact

Nothing changes. The command filters sudo log lines and extracts the acting user plus command.

Recovery / rollback: no state is changed.

When to use it

Use during access reviews, incident triage, or post-change checks when privilege use matters.

When not to use it

Do not assume this covers every privileged action; rotated logs, journal data, and direct root sessions may add context.

Watch this command run

Example output from a temporary Linux lab

This example uses disposable sample files and sanitized output so you can inspect the shape of the result before touching a real system.

demo@lab:~$

$ grep 'sudo:' sample-files/user-access-audit/logs/auth.log

Jun 25 08:12:19 host sudo:     alex : TTY=pts/0 ; PWD=/srv/app ; USER=root ; COMMAND=/usr/bin/systemctl reload nginx
Jun 25 09:04:02 host sudo:   deploy : TTY=pts/1 ; PWD=/srv/app ; USER=root ; COMMAND=/usr/bin/journalctl -u app.service
Jun 25 10:16:02 host sudo: breakglass : TTY=pts/2 ; PWD=/root ; USER=root ; COMMAND=/usr/bin/passwd alex

$ sed -n 's/.*sudo: *$[^: ]*$.*COMMAND=$.*$$/\1 -> \2/p' sample-files/user-access-audit/logs/auth.log | sort

alex -> /usr/bin/systemctl reload nginx
breakglass -> /usr/bin/passwd alex
deploy -> /usr/bin/journalctl -u app.service

View reproducible demo details

This page shows the sanitized shell transcript and the setup steps needed to reproduce the example.