[sudo-users] Does AIX properly forward to a Linux logsrvd? Endian Issues?

[Todd C. Miller]

It looks like you've found a bug since that should definitely work.

Based on your description I think I've been able to reproduce the
problem.  Is your system using AIX authentication or PAM?  Based
on the symptoms I'd guess it is not PAM unless pam_session and
pam_setcred are disabled in sudoers.

What is happening (at least on my system) is that sudo is directly
executing the command before the data is sent to the log server.
This doesn't happen on PAM systems by default since sudo needs to
close the PAM session when the command finishes.

The following commit fixes the bug and will be present in sudo
1.9.12:

    https://www.sudo.ws/repos/sudo/rev/11976aa84040

 - todd