Sudo Authentication Failures Belong in the Security Timeline

Repeated sudo failures may be operator error, expired credentials or suspicious privilege-escalation attempts, and they often happen outside application logs. What made the issue measurable was sudo authentication failure count over a ten-minute window. Host authorization events provide context for changes that application monitoring cannot see and are especially useful around deployment windows.

I classify this as host security event monitoring. The useful debugging sequence is to confirm the signal, compare it with the neighboring subsystem, then look at logs or detailed metrics only after the failure domain is smaller.

The production rule that came out of it is: Alert on bursts, retain the matching journal lines, and compare the timing with SSH sessions and configuration changes before drawing conclusions. This is deliberately more specific than adding another broad alert with no response procedure.

Commit b65d5d4 is the repository evidence behind the note. It provides the concrete configuration or fix that turned the observation into a repeatable monitoring control.