sudo I/O logging alternatives after sudo-rs

Q: How do I switch back to the original sudo on Ubuntu 26.04?

Run sudo apt install sudo, then sudo update-alternatives --set sudo /usr/bin/sudo.ws. Check with sudo --version | head -1. To return to sudo-rs, run sudo update-alternatives --auto sudo.

Ubuntu 25.10 and 26.04 LTS replaced sudo with sudo-rs, a Rust rewrite that can't record sessions. Your Defaults log_output line is now rejected, and sudoreplay is gone. If an audit control specifically requires sudo session logs, reinstall the original sudo, which Ubuntu still ships. If you need a record of everything that happened on a server, sudo logs were never enough, and you need a tool that records the whole login.

Get started free How shellz workslast verified November 3, 2026

Choose shellz if

You need the whole SSH session recorded, including file transfers, and most of it never touches sudo.
You'd rather keep Ubuntu's default sudo-rs than switch every server back to the original sudo.
You want to replay sessions in a browser and get email, Slack or webhook alerts without running your own log server.
Recordings must be encrypted on the server before they're uploaded (how it works).

Reinstall the original sudo if

Your audit control names sudo session logs or sudoreplay and won't accept anything else.
You need sudo rules that block commands. shellz records sessions but doesn't block commands or end them.
Recordings must stay on hardware you run. shellz can't be self-hosted.
You already run a sudo log server (sudo_logsrvd) and only need your servers sending to it again.

The options

01shellz
Records every login on the server from start to finish: SSH, local and serial consoles, su -, SFTP file transfers and one-off remote commands like ssh host cmd. Root shells from sudo -s, tmux and screen are captured inside the session, and container shells from docker exec are linked to the login they came from. If someone logs in a way that skips the recorder, the session is killed and you get an alert.
best for
Replaying whole logins across many servers without running a log server
pricing
Free for 10 active devices, keeping the newest 50 recordings. Commercial is $10 a member a month plus $1 per stored GB (pricing)
watch out
SaaS only. It doesn't block commands, and it can't export to a SIEM yet.
02Original sudo + sudo_logsrvd
Ubuntu 26.04 still ships the original sudo as the sudo package, alongside sudo-rs. Install it and make it the system's sudo command, and log_output and sudoreplay work again. sudo_logsrvd collects logs from many servers in one place. The steps are further down this page.
best for
Audit controls written around sudoers and sudoreplay
pricing
Free, open source
watch out
It records only commands run through sudo. Ubuntu plans to make sudo-rs the only sudo in its main archive in 26.10.
03tlog
Red Hat's session recorder. It sits between the terminal and the shell, saves each session as JSON, and plays it back in the terminal. Red Hat's browser player isn't packaged for Ubuntu.
best for
Red Hat shops that want recordings kept on their own servers
pricing
Free. Ships with RHEL, and is in Ubuntu 26.04's community (universe) archive
watch out
Red Hat's own docs say root can get around the recording, and if logs are kept only in memory they're lost on reboot.
04auditd + pam_tty_audit
The Linux kernel's audit system logs every program that runs and every change to files you choose to watch. The pam_tty_audit module adds what users typed. It sees activity that never went through sudo. It doesn't save what appeared on screen, so there's nothing to play back.
best for
Compliance checklists such as DISA STIGs that ask for kernel audit rules
pricing
Free. In Ubuntu 26.04's main archive
watch out
The rules take tuning, and you get a list of events rather than a session you can watch.
05Snoopy
Logs every command line run on the server, with the user, terminal and working directory, to the system log. On Ubuntu that's /var/log/auth.log.
best for
A cheap log of every command run, including from scripts and cron
pricing
Free (GPL-2.0). In Ubuntu 26.04's universe archive
watch out
Its README says it isn't a reliable auditing tool, because a user can change their environment to skip it. It logs commands only, with no output and no replay.
06Delinea Server Suite
A commercial privileged access suite. It lets Linux servers use Active Directory accounts, grants admin rights only when needed, adds MFA, and records sessions. Its 30 September 2026 release added Ubuntu 26.04 support.
best for
Linux and Windows servers joined to Active Directory, with admin rights and recording in one product
pricing
Quote only, no public price list
watch out
It depends on Active Directory, and its audit database runs on Microsoft SQL Server.

sudo-rs can't record sessions, and isn't planned to

sudo-rs is a memory-safe rewrite of sudo in Rust. Ubuntu made it the default sudo in 25.10 and kept it for 26.04 LTS. It reads your existing /etc/sudoers, but it rejects the settings that turn on session logging. log_output and iolog_dir fail as unknown settings, and so do mailto, logfile and syslog.

Session logging won't be added later. In April 2026 a sudo-rs maintainer wrote that it isn't planned, and that organizations required to have it should run the original sudo (issue 1553).

To check which sudo a server runs, use sudo --version | head -1. It prints either sudo-rs or Sudo version 1.9.17p2.

Switching back to the original sudo takes three commands

The original sudo is still in Ubuntu 26.04 as a separate package, installed as sudo.ws so it can sit next to sudo-rs. Keep a second root shell open while you switch, in case a mistake locks you out of the first.

This works on 26.04. Ubuntu plans to drop the original sudo from its main archive in 26.10, so check apt-cache policy sudo before you count on it there.

Install it: sudo apt install sudo
Make it the system's sudo: sudo update-alternatives --set sudo /usr/bin/sudo.ws
Check your sudoers file: sudo visudo -c
Test it: run sudo -s, exit, then run sudo sudoreplay.ws -l and look for the session you just made.

Logs from before the upgrade are still readable; the gap since isn't

Sessions recorded before the server moved to sudo-rs are still on disk, usually under /var/log/sudo-io. Ubuntu installs the replay tool as sudoreplay.ws, which is why plain sudoreplay says command not found. List the old sessions with sudo sudoreplay.ws -l.

Commands run while the server was on sudo-rs were never recorded, and nothing can recover them. If you run a central sudo log server, it has a gap for each server starting on the day that server upgraded.

To go back to sudo-rs later, run sudo update-alternatives --auto sudo.

Turn off password logging before you turn on keystroke logging

Once the original sudo is back, check one default. In the version Ubuntu 26.04 ships (1.9.17p2), log_passwords is on. If you also record keystrokes with log_input, passwords typed at hidden prompts end up in the session log. Upstream sudo switched this default off in October 2025, after the version Ubuntu ships.

Record what users saw with Defaults log_output. Add log_input only if you need keystrokes.
If you do log input, add Defaults !log_passwords. Set the same option in sudo_logsrvd.conf if a log server stores the sessions.
If sudo can't write its log, locally or to the log server, it stops the command. A full disk or an unreachable log server makes sudo commands fail.
Send logs to a central server over TLS on port 30344. The plaintext default is 30343.

sudo logs only ever covered part of a session

sudo records the commands people run through sudo. It misses what the user did before that, a direct root SSH login, su - with the root password, a file uploaded with scp, and a one-off command like ssh host 'rm -rf /srv/app' from an account that already owns the files. A deploy bot or AI agent with its own SSH key may never call sudo at all.

For a record of everything that happened on a server, record the whole login. tlog, Delinea and shellz do this and let you replay it. auditd and Snoopy log which commands ran but have nothing to replay. For how recording fits with access control, see the PAM vs session recording guide, shellz vs tlog and shellz vs auditd.

Questions

Does Defaults log_output work with sudo-rs?

No. sudo-rs rejects it as an unknown setting, Ubuntu's server docs list session logging as unsupported, and the sudo-rs maintainers have said they don't plan to add it.

Why does sudoreplay say command not found on Ubuntu 26.04?

sudo-rs has no replay tool. The original sudo package installs it as sudoreplay.ws. Run sudo apt install sudo, then sudo sudoreplay.ws -l.

How do I switch back to the original sudo on Ubuntu 26.04?

Run sudo apt install sudo, then sudo update-alternatives --set sudo /usr/bin/sudo.ws. Check with sudo --version | head -1. To return to sudo-rs, run sudo update-alternatives --auto sudo.

Do sudo session logs store passwords?

They can. With the sudo version in Ubuntu 26.04, recording keystrokes with log_input also records passwords typed at hidden prompts, unless you set Defaults !log_passwords. shellz never records hidden input such as sudo and passwd prompts.

Does shellz replace sudoers?

No, it runs alongside it. shellz records sessions. It doesn't enforce sudo rules, block commands or end sessions, so keep sudo-rs or the original sudo for that.

Related comparisons

Sources

Competitor details come from public documentation and pricing pages, last checked on November 3, 2026. Products change; if something here is out of date, tell us at hello@shellz.dev and we will correct it.

~ $ shellz --helpOne command. Two minutes. Every session recorded.

Get started free See pricing