Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this line in my /etc/sudoers file:

Cmnd_Alias MSGES = /usr/bin/tail -* /var/log/*, /bin/more * /var/log/*, /bin/cat * /var/log/*, /bin/grep * /var/log/*

And I have this:


The object is to allow the level2 user the ability to read log files in the /var/log folder.

But it ain't workin'. Is this the wrong way to do this? Do I have to set rights on the file differently?

Here's the rights on /var/log/messages:

-rw-r-----  1 root root 174161 2011-10-31 15:30 /var/log/messages
share|improve this question
up vote 2 down vote accepted

I just tried the following and it functions as expected.

Cmnd_Alias MSGES = /usr/bin/tail /var/log/*, /bin/more * /var/log/*, /bin/cat *\
/var/log/*, /bin/grep * /var/log/*

Looks like you are either missing the % for the group or the -* is the problem. I try to avoid doing wildcards like that for the command line options. I find it is easier to require them to be the last entries made.

EDIT - I would however suggest that you simply add the users to an admin group and allow that group read access to your log files. Totally your call however.

share|improve this answer
It was the wildcard characters. I took out the * from the more and cat commands and they seem to work. I need it for the grep and tail commands. so the new line is: Cmnd_Alias MSGES = /usr/bin/tail /var/log/*, /usr/bin/tail -* /var/log/*, /bin/more /var/log/*, /bin/cat /var/log/*, /bin/grep * /var/log/* – Ed Manet Oct 31 '11 at 19:54
The -* and * aren't a problem if you understand how to use them i.e. if you have them, then there must be something to act upon on the command line. – Iain Oct 31 '11 at 19:54
The above example is very very dangerous since the wildcard allows the users to specify additional files outside of /var/log. For example allowing the command pattern /usr/bin/tail /var/log/* allows the users to run the following: sudo tail /var/log/../../etc/shadow or sudo tail /var/log/messages /etc/shadow, both of which would then tail the shadow file. – David M. Syzdek May 8 '15 at 16:43

Try to change the group permissions of a files in the /var on "adm". After that, add yourself to the group.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.