838: Incident

2026-05-23T13:57:25Z

240F:54:FF25:1:41CA:20E2:E145:AB98:

{{comic
| number = 838
| date = December 24, 2010
| title = Incident
| image = incident.png
| titletext = He sees you when you're sleeping, he knows when you're awake, he's copied on /var/spool/mail/root, so be good for goodness' sake.
}}

==Explanation==
This comic was posted on {{w|Christmas Eve}}. While {{w|Christmas}} is principally a {{w|Christian}} holiday, there are many traditions around it, among them {{w|Christmas Eve#Gift_giving|a tradition}} that on {{w|Christmas Eve}} {{w|Santa Claus}} will make his round delivering gifts to good children. [[Rob]] (identified by his username, <code>robm</code>) sits behind a UNIX computer and tried to change his user account from his normal access to the access of a super user by using the command "<code>sudo su</code>". {{w|Sudo}} is a famous phrase in xkcd lore, made famous by comic [[149: Sandwich]]. Before allowing administrator access (as root user), it asks for a password. The field is blank because, in most UNIX systems, the characters of the password are invisible to protect privacy. Even though the password is correct, Rob's account is not in the list of accounts that can use <code>sudo</code> (the <code>sudoers</code> file). The error message says that the incident "will be reported" (usually to the system administrator, so they can see if someone is making repeated attempts at accessing administrator privileges).

In the comic, however, sudo and the system report the incidents to {{w|Santa Claus}}, who, in Christmas lore, makes a list of who is naughty and who is nice. If you are nice then you get presents, while if you are naughty, you get a lump of coal. When sudo reports to Santa that Rob's account is not authorized, he puts Rob on the naughty list. The message "… is not in the sudoers file. This incident will be reported." is a real message that the <code>sudo</code> program used to output in this situation. It was changed in 2022 to "This incident has been reported to the administrator", citing this comic: [https://github.com/sudo-project/sudo/commit/6aa320c96a37613663e8de4c275bd6c490466b01][https://github.com/sudo-project/sudo/commit/9757d29a24ac1872872cf09757b0439c54089707].

In the title text, which is a parody of the famous Christmas song, "Santa Claus Is Coming To Town", <code>/var/spool/mail/root</code> is the root (superuser) mailbox on a Linux system, where the incident described in the comic would commonly be reported to.

==Transcript==
:[Rob is sitting at a computer. The computer's prompt is shown.]
robm@homebox~$ sudo su
Password:
robm is not in the sudoers file. This incident will be reported.
robm@homebox~$ █

:[Megan approaches.]
:Rob: Hey — who does sudo report these "incidents" ''to''?
:Megan: You know, I've never checked.

:[Santa Claus is sitting at a desk supported by candy canes, with a red monitor. On the wall are two lists labeled 'naughty' and 'nice'. He is in the process of adding a line to the 'naughty' list.]

{{comic discussion}}
[[Category:Comics featuring Rob]]
[[Category:Comics featuring Megan]]
[[Category:Comics with color]]
[[Category:Linux]]
[[Category:Christmas]]
[[Category:Comics with a Spanish translation]]
[[Category:Comics with lowercase text]]

explain xkcd - User contributions [en]

838: Incident