Hi All
I have a requirement in which during sudo logging, I must get the year details also in sudo log file. As below output is not mentioning the year due to this I will not able to idenfiy that this log belong to 2012 or 2011 or 2010
Dec 12 11:30:21 XYZ sudo: [ID 702911 local2.notice] user1 : TTY=pts/5 ; PWD=/export/home/user1 ; USER=root ; COMMAND=/usr/bin/cat /var/log/sudo.log
Please let me know how can we do that
You could rotate the log out yearly or monthly, with the date bits in the file name.
You could also add a cron job to add a timestamp including the year into the log once in a while.
The man pages for sudo seem to vary for some reason (depending on the OS I guess), but there is an option which allows including the year in the logging that can be added into the sudoers file:
Defaults log_year
It is best practices to have a file life cycle that supports keeping system records together by time. A system log file that is never rotated or truncated is just not healthy, may grow to be a problem.