The next step in securing the system is to enable sudo logging. There are several ways to log sudo activity but the coolest way is with sudoreplay.
To enable sudo logging we will be editing the sudoers file. Before that I highly recommend using visudo to do so. For one thing you don't have to remember the fie path just type visudo. Also if there are errors in you configuration it will notify you. Visudo will be what I using in the examples.
Add the following to your sudoers file.
The above enables output logging except for sudoreplay and reboot.
If a user were to sudo su the whole session could be replayed in real time, speed up, or slowed down.
Sudo logging was enabled and with that accountability for privileged commands has been established.