SELECT time,facility,tag,message FROM syslog WHERE tag = 'sudo' AND message GLOB '*COMMAND*';