DE

↑ ↓ select, Enter open, Esc close

Show commands run with sudo from the journal

harmless rootSecuritydebian, ubuntu
Adjust the values, the command updates live
root@server
journalctl _COMM=sudo --since "7 days ago" --no-pager | grep 'COMMAND='

sudo logs every call with the calling user, working directory, target user and full command. The filter shows only these command lines from the selected time range. Useful for attributing system changes to a person and a point in time.

Note: Commands inside a root shell opened with sudo -i or sudo su are not recorded individually this way. With rsyslog, the entries are also in /var/log/auth.log.

Also searched as

  • sudo command history all users
  • who ran sudo commands
  • sudo log journalctl

Related one-liners

All in Security

Show successful SSH logins from the journal

#journalctl -u ssh --since "7 days ago" --no-pager | grep 'Accepted'
harmlessSSH

Find world-writable files and directories

$find /var/www/vhosts -xdev -perm -0002 ! -type l -ls 2>/dev/null
harmlessSecurity

IP addresses with the most failed SSH logins

#journalctl -u ssh --since "24 hours ago" --no-pager | grep -oE 'Failed password for .* from [0-9a-f.:]+' | awk '{print $NF}' | sort | uniq -c | sort -rn | head -20
harmlessSecurity

List all SSH keys authorized on the server

#find / -xdev -path '*/.ssh/authorized_keys' -type f -exec awk 'NF && !/^#/ {print FILENAME ": " $NF}' {} + 2>/dev/null
harmlessSecurity

List the members of the sudo group

$getent group sudo
harmlessSecurity

List user accounts with a login shell

$awk -F: '$7 !~ /(nologin|false)$/ {print $1, $3, $6, $7}' /etc/passwd
harmlessSecurity

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.