/var/log/secure is a Linux log file that records security-related events, including sudo activity on many systems. Administrators use it to review successful and failed privileged commands, investigate misuse, and confirm which accounts exercised elevated access. It supports basic accountability and operational monitoring.
What /var/log/secure Captures and Why It Matters
/var/log/secure is the Linux security audit trail for privileged and authentication-related activity on many systems. It is the first place administrators look when they need to verify who attempted or executed elevated commands, whether access was approved, and whether a control failure or misuse occurred.
Because it records events around sudo and related security actions, the file is less about application behaviour and more about accountability: it shows which account acted, when the action happened, and whether the system accepted or rejected it. That makes it a practical evidence source for operational review, incident triage, and basic privilege oversight.
What Information Typically Appears in the Log
Entries in /var/log/secure commonly include successful and failed privileged commands, authentication attempts, and other security-relevant messages emitted by system services. On some distributions, the same file can also capture PAM-related events, SSH authentication detail, and other components that feed the host security record.
The value of the file comes from correlation. A single line may be ambiguous, but a sequence of entries can reveal repeated failed logins, unexpected command elevation, or a session pattern that deserves investigation. Administrators often use it alongside time stamps, usernames, source addresses, and command context to reconstruct what happened on the host.
How Administrators Use It for Accountability and Review
/var/log/secure supports accountability by tying privileged activity to a specific account and time window. That makes it useful for post-incident review, change verification, and checking whether an administrative action was legitimate or unexpected.
It is also useful for routine oversight. Teams may review the log to confirm that privileged access is being used as expected, to spot repeated authentication failures, or to validate that operational procedures are not relying on hidden or informal elevation paths.
For broader control context, host logs like this align with the intent of audit and access controls in NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where privileged activity must be reviewable and traceable.
Limitations, Retention, and Operational Dependencies
/var/log/secure is only useful if the host is configured to retain it, protect it from tampering, and keep the relevant services writing to it. If logging is disabled, rotated too aggressively, or not forwarded, investigators may lose the very evidence they need.
Its usefulness is also bounded by scope. It captures host-level security events, not every layer of the environment. If an attacker gains sufficient control of the system, local logs can be altered or erased, so organisations often pair on-host review with central log collection and immutable retention.
For system hardening and log preservation, the general operating principle is to reduce the chance that privileged activity can occur without a durable record.
Risk and Threat Considerations
/var/log/secure is valuable precisely because it can expose misuse of privileged access, but that also makes it a target. If an attacker obtains administrative control, they may try to clear or alter the log to hide sudo abuse, credential attacks, or post-compromise actions.
Failure mechanism: Local log files can be overwritten, truncated, rotated out, or manipulated after compromise, especially when the same privileged access that generated the event can also modify the record.
Impact: Loss or distortion of /var/log/secure weakens forensic reconstruction, complicates incident response, and reduces confidence in privileged-account accountability.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | /var/log/secure is a host security event record that supports auditable privileged activity. |
| AU-6 — Audit Record Review, Analysis, and Reporting | The log is used to review sudo misuse, failures, and suspicious privilege events. | |
| AU-9 — Protection of Audit Information | The file must be protected so privileged actors cannot alter evidence after compromise. | |
| Recommendation — Define and retain host security events needed to trace privileged actions and investigations. Review privileged activity logs for anomalies and report suspicious command elevation. Protect audit logs from modification, deletion, and unauthorized access. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The term is fundamentally about collecting, reviewing, and protecting security logs. |
| Recommendation — Centralize and review security logs to detect privileged misuse and preserve evidence. | ||
Practitioner Guidance
What to watch for: Treat repeated authentication failures, unusual sudo patterns, and gaps in expected logging as conditions that deserve review, not as routine noise. The file is most useful when operators know what “normal” privileged activity looks like on that host and can spot deviations quickly.
Governance implication: Logging policy should define how long this record is retained, who can access it, and how it is protected from tampering. If the log is central to accountability, it should be treated as security evidence, not as an ordinary text file.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
