I haven’t tried it looking at sudo events, but if you are trying to auth remotely you definitely get signs of the authentication failing. I just don’t have access to my systems right now, so I can’t post what I see. I’ll loop back later.