[root@Centos ~]# rpm -qa|grep sudo
sudo-1.8.6p3-24.el6.x86_64
[root@Centos ~]# rpm -qa|grep rsyslog
rsyslog-5.8.10-10.el6_6.x86_64

檢查是否安裝兩種服務，如果沒有安裝，就使用下面的命令進行安裝

yum install sudo -y
yum install rsyslog -y

備註：Centos 5.x 為syslog，Centos 6.x 為rsyslog

2、配置服務

創建日誌保存目錄

[root@Centos ~]# mkdir -p /var/log/

服務器環境查看

[root@Centos ~]# cat /etc/redhat-release 
CentOS release 6.5 (Final)
[root@Centos ~]# uname -r
2.6.32-431.el6.x86_64

服務器環境為centos 6.5 所以syslog日誌配置文件為/etc/rsyslog.conf

[root@Centos ~]#echo "local2.debug /var/log/sudo.log">>/etc/rsyslog.conf

查看配置

[root@Centos ~]# tail -1 /etc/rsyslog.conf 
local2.debug  /var/log/sudo.log

如果服務器為centos 5.x 所以syslog日誌配置文件為/etc/syslog.conf

[root@Centos ~]#echo "local2.debug /var/log/sudo.log">>/etc/syslog.conf
[root@Centos ~]#echo "Defaults logfile=/var/log/sudo.log">>/etc/sudoers

查看配置

[root@Centos ~]# tail -1 /etc/syslog.conf 
local2.debug  /var/log/sudo.log

配置/etc/sudoers

[root@Centos ~]# echo "Defaults logfile=/var/log/sudo.log">>/etc/sudoers
[root@Centos ~]# tail -1 /etc/sudoers 
Defaults logfile=/var/log/sudo.log
[root@Centos ~]# visudo -c

4、重啟服務

[root@Centos ~]# /etc/init.d/rsyslog restart
Shutting down system logger:                               [  OK  ]
Starting system logger:                                    [  OK  ]

三：測試日記審計結果

[root@jenkins sudoers.d]# sudo ls
cloud-init
[root@jenkins sudoers.d]# cat /var/log/sudo.log
Jul  3 06:22:53 : root : TTY=pts/1 ; PWD=/etc/sudoers.d ; USER=root ;
    COMMAND=/bin/ls

配置sudo日誌審計