Where are sudo incidents reported?

user1717828 picture user1717828 · Nov 25, 2012 · Viewed 52k times · Source

Attempting something devious on my machine leads to

ryan@debian:~$ sudo EAT_ALL_THE_COOKIES_BEFORE_DINNER
[sudo] password for ryan: 
ryan is not in the sudoers file.  This incident will be reported.

Where is this incident reported, and how do I get the log of all the nasty attempted commands?

Answer

user1717828 picture user1717828 · Nov 25, 2012

Nevermind, I just found the answer in the alt-text at xkcd:

xkcd838

Replace root with your username, in my case ryan, so the log is found with:

cat /var/spool/mail/ryan