Checking if specific user used chown on specific directories?

Question

I recently granted one user sudo access rights on test server. This morning I see that server is screwed up. I see that owner rights where changed on many directories. For example many root directories ownership was changed to my user. I'm guessing that user used chown in a wrong place.

Is there an option to see if chown was used by specific user on specific directory?

Answer 1

sudo generally logs executed commands in e.g. /var/log/auth.log or /var/log/sudo.log depending on your distribution, so check there for sudo: lines.