Where are logs stored about creating a user with root rights in Linux?

Question

linux

Where can I see or configure such logging?
This also applies to the issuance of rights (sudo)

Answer 1

Not speaking for SUSE, but in Ubuntu
grep useradd auth.log | grep "UID=0"
It's literally about creating a root user. The rights on sudo can be at the normal user (without UID=0).

This also applies to the issuance of rights (sudo)

Let's just say that the use of sudo is logged.
grep sudo auth.log
You can find out if a user has sudo rights as follows.
The /etc/sudoers file will show which users and groups are allowed to sudo. View user groups: groups имяпользователя
Ficus picus is that you can create a user and \ or add a user to a group without using the regular useradd, groupadd commands, but instead manually editing the files /etc/passwd, /etc/group, /etc/shadow , /etc/gshadow. It is easy to track down the logs that no one is trying to hide or confuse. For the rest, you have to add a head to the logs, because There are no ready-made recipes for everything in the world, and each specific case may require an individual approach to the investigation.

Answer 2

https://www.linux.org.ru/forum/