Where are sudo incidents reported?
The report is sent as an email to the root
user. Many Linux distributions will automatically setup an alias for that user directing the mail to the first account created during the install process.
Nevermind, I just found the answer in the alt-text at xkcd:
Replace root
with your username, in my case ryan
, so the log is found with:
cat /var/spool/mail/ryan