Skip to main content
Sumo Logic

1.3 You want to find failed attempts to sudo as root

Problem

Looking for two things at once can be complicated.

Solution

(su OR sudo) AND (fail* OR error)

Discussion

Use this solution as a template for any situation in which you are searching for an object-verb condition. In this case, the object is the sudo or superuser command and the verb is failure or error.