Log Dejargonizer

sudo / su · Event authentication failure

Authentication failure: a sudo or su attempt was rejected

Someone tried to escalate privileges and gave the wrong password, or tried to use sudo without permission. A typo looks identical to a probe — the difference is who the account is and whether they were entitled to escalate at all.

Also written as authentication failure lognamesudo authentication failuresu authentication failure3 incorrect password attempts

What it means for you

On a personal computer

An administrator password was typed incorrectly. Normal if it was you.

For an analyst

Separate the two cases sharply. A wrong password from someone who does have sudo rights is a typo. A 'user is not in the sudoers file' message is someone attempting escalation they were never granted, and that deserves a conversation regardless of intent.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Aug 28 09:46:31 web-01 sudo: pam_unix(sudo:auth): authentication failure; logname=jbrooks uid=1000 euid=0 tty=/dev/pts/1 ruser=jbrooks rhost=  user=jbrooks
Aug 28 09:46:40 web-01 sudo:  mchen : user NOT in sudoers ; TTY=pts/2 ; PWD=/home/mchen ; USER=root ; COMMAND=/bin/bash

The fields that decide it

Everything else in the log line is context.

logname / user
The account that attempted the escalation.
rhost
The remote host, when the session came over the network.
tty
The terminal the attempt came from.
ruser
The real user behind the attempt.
Message variant
Which failure this is. The distinction is the whole event.
  • authentication failureWrong password. Usually a typo.
  • user NOT in sudoersThe account has no sudo rights and tried anyway. Worth investigating.
  • 3 incorrect password attemptsRepeated failures in one session. More than a slip.
  • command not allowedThe account has sudo rights but not for that command.

Ordinary reasons this happens

Most of the time it is one of these.

  • A user mistyping their password.
  • Someone forgetting they are not an administrator on a particular host.
  • A script with an outdated credential.
  • A user typing their password into the wrong prompt.
  • Password managers filling the wrong field.

When it is not ordinary

Testing which accounts can escalate.

What gives it away'user NOT in sudoers' entries for accounts that have never attempted sudo before.

ATT&CK T1548.003

A compromised account probing its own privileges.

What gives it awayEscalation attempts from an account shortly after an unusual login, particularly from an unfamiliar source.

ATT&CK T1078

Trying commands outside a permitted set.

What gives it away'command not allowed' entries where the account has restricted sudo rights and is testing the boundaries.

ATT&CK T1548.003

What to do next

  1. Read which failure variant it is. A wrong password and a sudoers refusal are different situations.
  2. Check whether the account is supposed to have sudo rights at all.
  3. Look at the login that preceded the attempt and where it came from.
  4. Count attempts. Repeated failures across a session are more than a slip.
  5. For 'NOT in sudoers' entries, ask the user directly — it is often curiosity, and confirming that is quick.

Queries to run

grep All three escalation failure variants together. 
grep -E 'sudo:.*(authentication failure|NOT in sudoers|command not allowed)' /var/log/auth.log
grep Accounts attempting escalation they do not have. Short list, and worth reading all of it. 
grep 'NOT in sudoers' /var/log/auth.log | grep -oP '^\S+ \S+ \S+ \S+ \s*\K\S+' | sort | uniq -c | sort -rn
splunk 
index=linux sourcetype=linux_secure ("NOT in sudoers" OR "authentication failure") | stats count by user host | sort -count

Common questions

What does 'user NOT in sudoers' mean and should I worry?

The account tried to use sudo without having been granted the right. It is often simple curiosity or someone forgetting which server they are on, and the message includes 'This incident will be reported' precisely because sudo treats it as noteworthy. Worth a quick conversation with the user — repeated attempts, or attempts from an account that just logged in from somewhere unusual, deserve more than that.

Why do I see authentication failures for sudo when the password was correct?

Most often the user typed their own password when sudo wanted a different account's, or a password manager filled the wrong field. It also happens when PAM is configured with an unexpected authentication order. If it is persistent for one user, check whether their account is locked or their password has expired.

Read next

Vendor documentation

Last reviewed 28 August 2026