In RHEL systems and its derivatives, it logs to /var/log/secure, and in debian derivatives, /var/log/auth.log.
When you use sudo, where does it log by default?
In RHEL systems and its derivatives, it logs to /var/log/secure, and in debian derivatives, /var/log/auth.log.