diff --git a/bundles/icinga2/files/check_by_sshmon b/bundles/icinga2/files/check_by_sshmon
index 3138c78..c9a31df 100644
--- a/bundles/icinga2/files/check_by_sshmon
+++ b/bundles/icinga2/files/check_by_sshmon
@@ -16,7 +16,7 @@ then
     exit $UNKNOWN
 fi
 
-ssh sshmon@"$SSHMON_HOST" "$SSHMON_COMMAND"
+ssh sshmon@"$SSHMON_HOST" "sudo $SSHMON_COMMAND"
 
 exitcode=$?
 
diff --git a/bundles/monitored/metadata.py b/bundles/monitored/metadata.py
index e2cccd9..f6d4cb7 100644
--- a/bundles/monitored/metadata.py
+++ b/bundles/monitored/metadata.py
@@ -33,7 +33,8 @@ def default_check_command(metadata):
 
 
 @metadata_reactor.provides(
-    'users/sshmon/authorized_users'
+    'users/sshmon/authorized_users',
+    'sudoers/sshmon',
 )
 def user(metadata):
     return {
@@ -44,4 +45,11 @@ def user(metadata):
                 }
             },
         },
+        'sudoers': {
+            'sshmon': {
+                conf['vars.command']
+                    for conf in metadata.get('monitoring/services').values()
+                    if conf['check_command'] == 'sshmon'
+            },
+        },
     }