Skip to main content
Sumo Logic

1.3 You want to find failed attempts to sudo as root


Looking for two things at once can be complicated.


(su OR sudo) AND (fail* OR error)


Use this solution as a template for any situation in which you are searching for an object-verb condition. In this case, the object is the sudo or superuser command and the verb is failure or error.