Annotation of embedaddon/sudo/doc/sudoreplay.cat, revision 1.1.1.3
1.1.1.3 ! misho 1: SUDOREPLAY(1m) System Manager's Manual SUDOREPLAY(1m)
1.1 misho 2:
3: NNAAMMEE
1.1.1.3 ! misho 4: ssuuddoorreeppllaayy - replay sudo session logs
1.1 misho 5:
6: SSYYNNOOPPSSIISS
1.1.1.3 ! misho 7: ssuuddoorreeppllaayy [--hh] [--dd _d_i_r_e_c_t_o_r_y] [--ff _f_i_l_t_e_r] [--mm _m_a_x___w_a_i_t]
! 8: [--ss _s_p_e_e_d___f_a_c_t_o_r] ID
1.1 misho 9:
1.1.1.3 ! misho 10: ssuuddoorreeppllaayy [--hh] [--dd _d_i_r_e_c_t_o_r_y] --ll [search expression]
1.1 misho 11:
12: DDEESSCCRRIIPPTTIIOONN
1.1.1.3 ! misho 13: ssuuddoorreeppllaayy plays back or lists the output logs created by ssuuddoo. When
! 14: replaying, ssuuddoorreeppllaayy can play the session back in real-time, or the
! 15: playback speed may be adjusted (faster or slower) based on the command
! 16: line options.
1.1 misho 17:
1.1.1.3 ! misho 18: The _I_D should either be a six character sequence of digits and upper case
! 19: letters, e.g. 0100A5, or a pattern matching the _i_o_l_o_g___f_i_l_e option in the
! 20: _s_u_d_o_e_r_s file. When a command is run via ssuuddoo with _l_o_g___o_u_t_p_u_t enabled in
! 21: the _s_u_d_o_e_r_s file, a TSID=ID string is logged via syslog or to the ssuuddoo
! 22: log file. The _I_D may also be determined using ssuuddoorreeppllaayy's list mode.
1.1 misho 23:
1.1.1.3 ! misho 24: In list mode, ssuuddoorreeppllaayy can be used to find the ID of a session based on
! 25: a number of criteria such as the user, tty or command run.
1.1 misho 26:
1.1.1.3 ! misho 27: In replay mode, if the standard output has not been redirected,
! 28: ssuuddoorreeppllaayy will act on the following keys:
1.1 misho 29:
1.1.1.3 ! misho 30: ` ' (space) Pause output; press any key to resume.
1.1 misho 31:
1.1.1.3 ! misho 32: `<' Reduce the playback speed by one half.
1.1 misho 33:
1.1.1.3 ! misho 34: `>' Double the playback speed.
1.1 misho 35:
1.1.1.3 ! misho 36: The options are as follows:
1.1 misho 37:
1.1.1.3 ! misho 38: --dd _d_i_r_e_c_t_o_r_y Use _d_i_r_e_c_t_o_r_y to for the session logs instead of the
1.1 misho 39: default, _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o.
40:
1.1.1.3 ! misho 41: --ff _f_i_l_t_e_r By default, ssuuddoorreeppllaayy will play back the command's
! 42: standard output, standard error and tty output. The --ff
1.1 misho 43: option can be used to select which of these to output. The
44: _f_i_l_t_e_r argument is a comma-separated list, consisting of
45: one or more of following: _s_t_d_o_u_t, _s_t_d_e_r_r, and _t_t_y_o_u_t.
46:
1.1.1.3 ! misho 47: --hh The --hh (_h_e_l_p) option causes ssuuddoorreeppllaayy to print a short
1.1 misho 48: help message to the standard output and exit.
49:
1.1.1.3 ! misho 50: --ll [_s_e_a_r_c_h _e_x_p_r_e_s_s_i_o_n]
! 51: Enable ``list mode''. In this mode, ssuuddoorreeppllaayy will list
1.1.1.2 misho 52: available sessions in a format similar to the ssuuddoo log file
53: format, sorted by file name (or sequence number). If a
54: _s_e_a_r_c_h _e_x_p_r_e_s_s_i_o_n is specified, it will be used to restrict
55: the IDs that are displayed. An expression is composed of
56: the following predicates:
1.1 misho 57:
1.1.1.3 ! misho 58: command _p_a_t_t_e_r_n
1.1 misho 59: Evaluates to true if the command run matches
1.1.1.3 ! misho 60: _p_a_t_t_e_r_n. On systems with POSIX regular expression
! 61: support, the pattern may be an extended regular
! 62: expression. On systems without POSIX regular
! 63: expression support, a simple substring match is
! 64: performed instead.
1.1 misho 65:
66: cwd _d_i_r_e_c_t_o_r_y
67: Evaluates to true if the command was run with the
68: specified current working directory.
69:
70: fromdate _d_a_t_e
71: Evaluates to true if the command was run on or
1.1.1.3 ! misho 72: after _d_a_t_e. See _D_a_t_e _a_n_d _t_i_m_e _f_o_r_m_a_t for a
1.1 misho 73: description of supported date and time formats.
74:
75: group _r_u_n_a_s___g_r_o_u_p
76: Evaluates to true if the command was run with the
77: specified _r_u_n_a_s___g_r_o_u_p. Note that unless a
78: _r_u_n_a_s___g_r_o_u_p was explicitly specified when ssuuddoo was
79: run this field will be empty in the log.
80:
81: runas _r_u_n_a_s___u_s_e_r
82: Evaluates to true if the command was run as the
83: specified _r_u_n_a_s___u_s_e_r. Note that ssuuddoo runs commands
84: as user _r_o_o_t by default.
85:
86: todate _d_a_t_e
87: Evaluates to true if the command was run on or
1.1.1.3 ! misho 88: prior to _d_a_t_e. See _D_a_t_e _a_n_d _t_i_m_e _f_o_r_m_a_t for a
1.1 misho 89: description of supported date and time formats.
90:
1.1.1.3 ! misho 91: tty _t_t_y _n_a_m_e
! 92: Evaluates to true if the command was run on the
! 93: specified terminal device. The _t_t_y _n_a_m_e should be
! 94: specified without the _/_d_e_v_/ prefix, e.g. _t_t_y_0_1
1.1 misho 95: instead of _/_d_e_v_/_t_t_y_0_1.
96:
97: user _u_s_e_r _n_a_m_e
98: Evaluates to true if the ID matches a command run
99: by _u_s_e_r _n_a_m_e.
100:
101: Predicates may be abbreviated to the shortest unique string
102: (currently all predicates may be shortened to a single
103: character).
104:
105: Predicates may be combined using _a_n_d, _o_r and _! operators as
1.1.1.3 ! misho 106: well as `(' and `)' grouping (note that parentheses must
! 107: generally be escaped from the shell). The _a_n_d operator is
! 108: optional, adjacent predicates have an implied _a_n_d unless
! 109: separated by an _o_r.
1.1 misho 110:
1.1.1.3 ! misho 111: --mm _m_a_x___w_a_i_t Specify an upper bound on how long to wait between key
! 112: presses or output data. By default, ssuuddoorreeppllaayy will
1.1 misho 113: accurately reproduce the delays between key presses or
114: program output. However, this can be tedious when the
1.1.1.3 ! misho 115: session includes long pauses. When the --mm option is
1.1 misho 116: specified, ssuuddoorreeppllaayy will limit these pauses to at most
117: _m_a_x___w_a_i_t seconds. The value may be specified as a floating
1.1.1.3 ! misho 118: point number, e.g. _2_._5.
1.1 misho 119:
1.1.1.3 ! misho 120: --ss _s_p_e_e_d___f_a_c_t_o_r
1.1 misho 121: This option causes ssuuddoorreeppllaayy to adjust the number of
122: seconds it will wait between key presses or program output.
123: This can be used to slow down or speed up the display. For
124: example, a _s_p_e_e_d___f_a_c_t_o_r of _2 would make the output twice as
1.1.1.3 ! misho 125: fast whereas a _s_p_e_e_d___f_a_c_t_o_r of _._5 would make the output
1.1 misho 126: twice as slow.
127:
1.1.1.3 ! misho 128: --VV The --VV (_v_e_r_s_i_o_n) option causes ssuuddoorreeppllaayy to print its
1.1 misho 129: version number and exit.
130:
131: DDaattee aanndd ttiimmee ffoorrmmaatt
1.1.1.3 ! misho 132: The time and date may be specified multiple ways, common formats include:
1.1 misho 133:
1.1.1.3 ! misho 134: HH:MM:SS am MM/DD/CCYY timezone
! 135: 24 hour time may be used in place of am/pm.
1.1 misho 136:
1.1.1.3 ! misho 137: HH:MM:SS am Month, Day Year timezone
! 138: 24 hour time may be used in place of am/pm, and month and day
! 139: names may be abbreviated. Note that month and day of the week
! 140: names must be specified in English.
1.1 misho 141:
1.1.1.3 ! misho 142: CCYY-MM-DD HH:MM:SS
! 143: ISO time format
1.1 misho 144:
1.1.1.3 ! misho 145: DD Month CCYY HH:MM:SS
! 146: The month name may be abbreviated.
1.1 misho 147:
1.1.1.3 ! misho 148: Either time or date may be omitted, the am/pm and timezone are optional.
! 149: If no date is specified, the current day is assumed; if no time is
! 150: specified, the first second of the specified date is used. The less
! 151: significant parts of both time and date may also be omitted, in which
! 152: case zero is assumed.
1.1 misho 153:
1.1.1.3 ! misho 154: The following are all valid time and date specifications:
1.1 misho 155:
1.1.1.3 ! misho 156: now The current time and date.
1.1 misho 157:
1.1.1.3 ! misho 158: tomorrow
! 159: Exactly one day from now.
1.1 misho 160:
1.1.1.3 ! misho 161: yesterday
! 162: 24 hours ago.
1.1 misho 163:
1.1.1.3 ! misho 164: 2 hours ago
! 165: 2 hours ago.
1.1 misho 166:
1.1.1.3 ! misho 167: next Friday
! 168: The first second of the next Friday.
1.1 misho 169:
1.1.1.3 ! misho 170: this week
! 171: The current time but the first day of the coming week.
1.1 misho 172:
1.1.1.3 ! misho 173: a fortnight ago
! 174: The current time but 14 days ago.
1.1 misho 175:
1.1.1.3 ! misho 176: 10:01 am 9/17/2009
! 177: 10:01 am, September 17, 2009.
1.1 misho 178:
1.1.1.3 ! misho 179: 10:01 am
! 180: 10:01 am on the current day.
1.1 misho 181:
1.1.1.3 ! misho 182: 10 10:00 am on the current day.
1.1 misho 183:
1.1.1.3 ! misho 184: 9/17/2009
! 185: 00:00 am, September 17, 2009.
1.1 misho 186:
1.1.1.3 ! misho 187: 10:01 am Sep 17, 2009
! 188: 10:01 am, September 17, 2009.
1.1 misho 189:
190: FFIILLEESS
1.1.1.3 ! misho 191: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o The default I/O log directory.
1.1 misho 192:
1.1.1.3 ! misho 193: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_l_o_g
1.1 misho 194: Example session log info.
195:
1.1.1.3 ! misho 196: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_i_n
1.1 misho 197: Example session standard input log.
198:
1.1.1.3 ! misho 199: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_o_u_t
1.1 misho 200: Example session standard output log.
201:
1.1.1.3 ! misho 202: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_e_r_r
1.1 misho 203: Example session standard error log.
204:
1.1.1.3 ! misho 205: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_t_y_i_n
1.1 misho 206: Example session tty input file.
207:
1.1.1.3 ! misho 208: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_t_y_o_u_t
1.1 misho 209: Example session tty output file.
210:
1.1.1.3 ! misho 211: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_i_m_i_n_g
1.1 misho 212: Example session timing file.
213:
1.1.1.3 ! misho 214: Note that the _s_t_d_i_n, _s_t_d_o_u_t and _s_t_d_e_r_r files will be empty unless ssuuddoo
! 215: was used as part of a pipeline for a particular command.
1.1 misho 216:
217: EEXXAAMMPPLLEESS
1.1.1.3 ! misho 218: List sessions run by user _m_i_l_l_e_r_t:
1.1 misho 219:
1.1.1.3 ! misho 220: # sudoreplay -l user millert
1.1 misho 221:
1.1.1.3 ! misho 222: List sessions run by user _b_o_b with a command containing the string vi:
1.1 misho 223:
1.1.1.3 ! misho 224: # sudoreplay -l user bob command vi
1.1 misho 225:
1.1.1.3 ! misho 226: List sessions run by user _j_e_f_f that match a regular expression:
1.1 misho 227:
1.1.1.3 ! misho 228: # sudoreplay -l user jeff command '/bin/[a-z]*sh'
1.1 misho 229:
1.1.1.3 ! misho 230: List sessions run by jeff or bob on the console:
1.1 misho 231:
1.1.1.3 ! misho 232: # sudoreplay -l ( user jeff or user bob ) tty console
1.1 misho 233:
234: SSEEEE AALLSSOO
1.1.1.3 ! misho 235: sudo(1m), script(1)
1.1 misho 236:
1.1.1.3 ! misho 237: AAUUTTHHOORRSS
! 238: Todd C. Miller
1.1 misho 239:
240: BBUUGGSS
1.1.1.3 ! misho 241: If you feel you have found a bug in ssuuddoorreeppllaayy, please submit a bug
! 242: report at http://www.sudo.ws/sudo/bugs/
1.1 misho 243:
244: SSUUPPPPOORRTT
1.1.1.3 ! misho 245: Limited free support is available via the sudo-users mailing list, see
! 246: http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search the
! 247: archives.
1.1 misho 248:
249: DDIISSCCLLAAIIMMEERR
1.1.1.3 ! misho 250: ssuuddoorreeppllaayy is provided ``AS IS'' and any express or implied warranties,
! 251: including, but not limited to, the implied warranties of merchantability
! 252: and fitness for a particular purpose are disclaimed. See the LICENSE
! 253: file distributed with ssuuddoo or http://www.sudo.ws/sudo/license.html for
! 254: complete details.
1.1 misho 255:
1.1.1.3 ! misho 256: Sudo 1.8.6 July 12, 2012 Sudo 1.8.6
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sudoreplay.cat CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc