We have set up in our servers sudoers config the following configuration in order to log the console output for auditing purposes

Defaults:%administrators log_output
Defaults logfile=/var/log/sudo

This works in our servers except on one Debian 6 server

$ cat /etc/issue
Debian GNU/Linux 6.0 

$ cat /etc/debian_version 

Here is for example the output of a ls command in the home folder

$ cat /var/log/sudo-io/00/00/03/ttyout 
                        ����+���rIG�F���8���)�g����g����d���*KG�*�Vd�pArb��~Yb�~N~�~qiJ�nf����@�8@,��@.�H�C_���*�K�$/�|70k���9��q6Pㄾ����n؆+�g���.��D{�, ����Q����ğ>�n�d�4��O�/{������)Ϟ��v�~��$,eZ�cQRgS]d��:��]u��^�����kd��|5}Jȳ��4>�,/6h`�|ͳ�^�,K�oӝ����u4����Msh����`'7���c


Is there any known issue we are missing that explains this behaviour?


Seems that in this server the log files were being stored compressed using gzip as default.

The log files can be seen using zcat or zless.

  • please, choose this answer as a solution to help others.
    – Jakuje
    Dec 29 '15 at 10:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.