HIDS 5402
From Atomicorp Wiki
Example log message:
Server sudo: tortix : TTY=unknown ; PWD=/var/asl/www ; USER=root ; COMMAND=/var/asl/bin/asl --validate_gui
Explanation:
This means that a user or process successfully used [sudo] to execute a command as root.
Notes:
Careful analysis of sudo logs is recommended to ensure that users authorized to run root level commands, via sudo, are not exceeding their authority.
Known ASL use of sudo
These sudo events are caused by ASL, and may be ignored:
sudo: tortix : TTY=unknown ; PWD=/var/asl/www ; USER=root ; COMMAND=/var/asl/bin/asl -s -f -t
sudo: tortix : TTY=unknown ; PWD=/var/asl/www ; USER=root ; COMMAND=/var/asl/bin/asl --validate_gui
