Linux audit question

Thought I'd pick some brains with some Linux experts.
Here is the scenario...
A user (not root or sudo) tries to run a privileged command, like useradd XXXX or userdel XXXX. Most time, you try to run this, and the OS will ask you to authenticate in order to run this command. For the ones mentioned, it does not, the OS just returns 'Permission Denied' and that's it.
I went looking in /var/log/audit/audit.log and there's no entry for this attempt. …

ask ask you audit authenticate command cybersecurity experts linux order privileged question root run scenario sudo thought try