By default, sudoers logs both successful and unsuccessful attempts (as well as errors). The log_allowed and log_denied flags can be used to control this behavior. Messages can be logged to syslog(3), a log file, or both.
The default is to log to syslog(3) but this is configurable via the syslog and logfile settings. See LOG FORMAT for a description of the log file format.
sudoers is also capable of running a command in a pseudo-terminal and logging all input and/or output. The standard input, standard output and standard error can be logged even when not associated with a terminal. I/O logging is not on by default but can be enabled using the log_input and log_output options as well as the LOG_INPUT and LOG_OUTPUT command tags. See I/O LOG FILES for details on how I/O log files are stored.
Starting with version 1.9, the log_servers setting may be used to send event and I/O log data to a remote server running sudo_logsrvd or another service that implements the protocol described by sudo_logsrv.proto(5).