Review successful and failed sudo activity for today
Build a paste-ready command, then review its compatibility and effects before running it.
journalctl _COMM=sudo --since today -o short-iso --no-pagercautionrequires privileges Compatibility
LinuxVerified for Linux using bash, zsh syntax.
Operational knowledgereview due 2027-01-19
Requirementsjournalctljournalctl must be installed and available on PATH.Elevated accessReview the exact scope before using an elevated account.
Version supportjournalctl Current supported releasesVerified for linux using bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signals2026-07-23T08:41:12+0200 web-01 sudo[8812]: ada : TTY=pts/1 ; PWD=/srv/api ; USER=root ; COMMAND=/usr/bin/systemctl reload nginxRepresentative successful output; values vary with the selected target and system state.
Known errorsjournalctl: command not foundjournalctl is missing or is not available on PATH.Permission deniedThe current identity does not have the required access.
Verifyjournalctl _COMM=sudo --since today -o short-iso --no-pagerRe-run the corresponding read-only inspection and confirm the intended state.Rollback noteNo universal automatic rollback is available. Capture the current state and use the tool-specific recovery procedure before applying changes.
Command breakdown
01journalctlCommandRuns the journalctl stage of this one-liner.
02_COMM=sudoArgumentPasses _COMM=sudo to journalctl.
03--sinceOptionLimits results to entries after the supplied time.
04todayArgumentPasses today to journalctl.
05-oOptionSelects an output file or output format for this command.
06short-isoArgumentPasses short-iso to journalctl.
07--no-pagerOptionPrints directly instead of opening an interactive pager.
This advanced community-curated one-liner combines several stages. Review every option and placeholder before running it.
Example input
journalctl _COMM=sudo --since today -o short-iso --no-pager
Example output
2026-07-23T08:41:12+0200 web-01 sudo[8812]: ada : TTY=pts/1 ; PWD=/srv/api ; USER=root ; COMMAND=/usr/bin/systemctl reload nginx
2026-07-23T09:02:18+0200 web-01 sudo[9127]: grace : 3 incorrect password attempts
Illustrative output — exact values vary by system and data.
Official sources