Who was really root: auditd and the login UID
Every command ran as uid 0, but auditd keeps the login UID (auid) of whoever started the session. Read the EXECVE records, decode a hex-encoded argument, and name the person.
Briefing
Two people have sudo on app-09. auditd is configured to record every command run as root (key root-exec). Someone archived and uploaded something last night.
auid is set at login and survives sudo and su, so it names the human behind uid=0. auditd writes an argument as hex when it contains a space or a special character.
app-09 · Linux log triage
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.