Log File for Event Recording

[Trevor]

Audience:  RHCE and below

Question:  Which log file is used on a Linux system to record login 
authentication?

Question:  Which log file is used on a Linux system to record the 
usage of sudo?

[ric · Accepted solution]

Hi, @Trevor 

Your Question: Which log file is used on a Linux system to record login
authentication?

My Answer: I would say /var/log/secure records login authentication:

Nov 9 14:22:15 rhel93 systemd[2290]: pam_unix(systemd-user:session): session opened for user ric(uid=1000) by (uid=0)

Your Question:  Which log file is used on a Linux system to record the usage of sudo?

My answer: I would say /var/log/secure also fulfills that requirement:

Nov 9 14:22:32 rhel93 sudo[3118]: pam_unix(sudo-i:session): session opened for user root(uid=0) by (uid=1000)

[Trevor]

And ric, I would say, you are 100% correct!!!

Thank you for your response!