Annotation of embedaddon/sudo/doc/sudoreplay.cat, revision 1.1.1.5
1.1.1.3 misho 1: SUDOREPLAY(1m) System Manager's Manual SUDOREPLAY(1m)
1.1 misho 2:
3: NNAAMMEE
1.1.1.3 misho 4: ssuuddoorreeppllaayy - replay sudo session logs
1.1 misho 5:
6: SSYYNNOOPPSSIISS
1.1.1.5 ! misho 7: ssuuddoorreeppllaayy [--hh] [--dd _d_i_r] [--ff _f_i_l_t_e_r] [--mm _n_u_m] [--ss _n_u_m] ID
1.1 misho 8:
1.1.1.5 ! misho 9: ssuuddoorreeppllaayy [--hh] [--dd _d_i_r] --ll [search expression]
1.1 misho 10:
11: DDEESSCCRRIIPPTTIIOONN
1.1.1.3 misho 12: ssuuddoorreeppllaayy plays back or lists the output logs created by ssuuddoo. When
13: replaying, ssuuddoorreeppllaayy can play the session back in real-time, or the
14: playback speed may be adjusted (faster or slower) based on the command
15: line options.
1.1 misho 16:
1.1.1.3 misho 17: The _I_D should either be a six character sequence of digits and upper case
18: letters, e.g. 0100A5, or a pattern matching the _i_o_l_o_g___f_i_l_e option in the
19: _s_u_d_o_e_r_s file. When a command is run via ssuuddoo with _l_o_g___o_u_t_p_u_t enabled in
20: the _s_u_d_o_e_r_s file, a TSID=ID string is logged via syslog or to the ssuuddoo
21: log file. The _I_D may also be determined using ssuuddoorreeppllaayy's list mode.
1.1 misho 22:
1.1.1.3 misho 23: In list mode, ssuuddoorreeppllaayy can be used to find the ID of a session based on
24: a number of criteria such as the user, tty or command run.
1.1 misho 25:
1.1.1.3 misho 26: In replay mode, if the standard output has not been redirected,
27: ssuuddoorreeppllaayy will act on the following keys:
1.1 misho 28:
1.1.1.3 misho 29: ` ' (space) Pause output; press any key to resume.
1.1 misho 30:
1.1.1.3 misho 31: `<' Reduce the playback speed by one half.
1.1 misho 32:
1.1.1.3 misho 33: `>' Double the playback speed.
1.1 misho 34:
1.1.1.3 misho 35: The options are as follows:
1.1 misho 36:
1.1.1.5 ! misho 37: --dd _d_i_r, ----ddiirreeccttoorryy=_d_i_r
! 38: Store session logs in _d_i_r instead of the default,
! 39: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o.
! 40:
! 41: --ff _f_i_l_t_e_r, ----ffiilltteerr=_f_i_l_t_e_r
! 42: Select which I/O type(s) to display. By default, ssuuddoorreeppllaayy
! 43: will display the command's standard output, standard error
! 44: and tty output. The _f_i_l_t_e_r argument is a comma-separated
! 45: list, consisting of one or more of following: _s_t_d_o_u_t, _s_t_d_e_r_r,
! 46: and _t_t_y_o_u_t.
! 47:
! 48: --hh, ----hheellpp Display a short help message to the standard output and exit.
! 49:
! 50: --ll, ----lliisstt [_s_e_a_r_c_h _e_x_p_r_e_s_s_i_o_n]
! 51: Enable ``list mode''. In this mode, ssuuddoorreeppllaayy will list
! 52: available sessions in a format similar to the ssuuddoo log file
! 53: format, sorted by file name (or sequence number). If a
! 54: _s_e_a_r_c_h _e_x_p_r_e_s_s_i_o_n is specified, it will be used to restrict
! 55: the IDs that are displayed. An expression is composed of the
! 56: following predicates:
! 57:
! 58: command _p_a_t_t_e_r_n
! 59: Evaluates to true if the command run matches _p_a_t_t_e_r_n.
! 60: On systems with POSIX regular expression support, the
! 61: pattern may be an extended regular expression. On
! 62: systems without POSIX regular expression support, a
! 63: simple sub-string match is performed instead.
! 64:
! 65: cwd _d_i_r_e_c_t_o_r_y
! 66: Evaluates to true if the command was run with the
! 67: specified current working directory.
! 68:
! 69: fromdate _d_a_t_e
! 70: Evaluates to true if the command was run on or after
! 71: _d_a_t_e. See _D_a_t_e _a_n_d _t_i_m_e _f_o_r_m_a_t for a description of
! 72: supported date and time formats.
! 73:
! 74: group _r_u_n_a_s___g_r_o_u_p
! 75: Evaluates to true if the command was run with the
! 76: specified _r_u_n_a_s___g_r_o_u_p. Note that unless a
! 77: _r_u_n_a_s___g_r_o_u_p was explicitly specified when ssuuddoo was
! 78: run this field will be empty in the log.
! 79:
! 80: runas _r_u_n_a_s___u_s_e_r
! 81: Evaluates to true if the command was run as the
! 82: specified _r_u_n_a_s___u_s_e_r. Note that ssuuddoo runs commands
! 83: as user _r_o_o_t by default.
! 84:
! 85: todate _d_a_t_e
! 86: Evaluates to true if the command was run on or prior
! 87: to _d_a_t_e. See _D_a_t_e _a_n_d _t_i_m_e _f_o_r_m_a_t for a description
! 88: of supported date and time formats.
! 89:
! 90: tty _t_t_y _n_a_m_e
! 91: Evaluates to true if the command was run on the
! 92: specified terminal device. The _t_t_y _n_a_m_e should be
! 93: specified without the _/_d_e_v_/ prefix, e.g. _t_t_y_0_1
! 94: instead of _/_d_e_v_/_t_t_y_0_1.
! 95:
! 96: user _u_s_e_r _n_a_m_e
! 97: Evaluates to true if the ID matches a command run by
! 98: _u_s_e_r _n_a_m_e.
! 99:
! 100: Predicates may be abbreviated to the shortest unique string
! 101: (currently all predicates may be shortened to a single
! 102: character).
! 103:
! 104: Predicates may be combined using _a_n_d, _o_r and _! operators as
! 105: well as `(' and `)' grouping (note that parentheses must
! 106: generally be escaped from the shell). The _a_n_d operator is
! 107: optional, adjacent predicates have an implied _a_n_d unless
! 108: separated by an _o_r.
! 109:
! 110: --mm, ----mmaaxx--wwaaiitt _m_a_x___w_a_i_t
! 111: Specify an upper bound on how long to wait between key
! 112: presses or output data. By default, ssuuddoorreeppllaayy will
! 113: accurately reproduce the delays between key presses or
! 114: program output. However, this can be tedious when the
! 115: session includes long pauses. When the --mm option is
! 116: specified, ssuuddoorreeppllaayy will limit these pauses to at most
! 117: _m_a_x___w_a_i_t seconds. The value may be specified as a floating
! 118: point number, e.g. _2_._5.
! 119:
! 120: --ss, ----ssppeeeedd _s_p_e_e_d___f_a_c_t_o_r
! 121: This option causes ssuuddoorreeppllaayy to adjust the number of seconds
! 122: it will wait between key presses or program output. This can
! 123: be used to slow down or speed up the display. For example, a
! 124: _s_p_e_e_d___f_a_c_t_o_r of _2 would make the output twice as fast whereas
! 125: a _s_p_e_e_d___f_a_c_t_o_r of _._5 would make the output twice as slow.
1.1 misho 126:
1.1.1.5 ! misho 127: --VV, ----vveerrssiioonn
! 128: Print the ssuuddoorreeppllaayy versions version number and exit.
1.1 misho 129:
130: DDaattee aanndd ttiimmee ffoorrmmaatt
1.1.1.3 misho 131: The time and date may be specified multiple ways, common formats include:
1.1 misho 132:
1.1.1.3 misho 133: HH:MM:SS am MM/DD/CCYY timezone
134: 24 hour time may be used in place of am/pm.
1.1 misho 135:
1.1.1.3 misho 136: HH:MM:SS am Month, Day Year timezone
137: 24 hour time may be used in place of am/pm, and month and day
138: names may be abbreviated. Note that month and day of the week
139: names must be specified in English.
1.1 misho 140:
1.1.1.3 misho 141: CCYY-MM-DD HH:MM:SS
142: ISO time format
1.1 misho 143:
1.1.1.3 misho 144: DD Month CCYY HH:MM:SS
145: The month name may be abbreviated.
1.1 misho 146:
1.1.1.3 misho 147: Either time or date may be omitted, the am/pm and timezone are optional.
148: If no date is specified, the current day is assumed; if no time is
149: specified, the first second of the specified date is used. The less
150: significant parts of both time and date may also be omitted, in which
151: case zero is assumed.
1.1 misho 152:
1.1.1.3 misho 153: The following are all valid time and date specifications:
1.1 misho 154:
1.1.1.3 misho 155: now The current time and date.
1.1 misho 156:
1.1.1.3 misho 157: tomorrow
158: Exactly one day from now.
1.1 misho 159:
1.1.1.3 misho 160: yesterday
161: 24 hours ago.
1.1 misho 162:
1.1.1.3 misho 163: 2 hours ago
164: 2 hours ago.
1.1 misho 165:
1.1.1.3 misho 166: next Friday
1.1.1.5 ! misho 167: The first second of the Friday in the next (upcoming) week. Not
! 168: to be confused with ``this friday'' which would match the friday
! 169: of the current week.
! 170:
! 171: last week
! 172: The current time but 7 days ago. This is equivalent to ``a week
! 173: ago''.
1.1 misho 174:
1.1.1.3 misho 175: a fortnight ago
176: The current time but 14 days ago.
1.1 misho 177:
1.1.1.3 misho 178: 10:01 am 9/17/2009
179: 10:01 am, September 17, 2009.
1.1 misho 180:
1.1.1.3 misho 181: 10:01 am
182: 10:01 am on the current day.
1.1 misho 183:
1.1.1.3 misho 184: 10 10:00 am on the current day.
1.1 misho 185:
1.1.1.3 misho 186: 9/17/2009
187: 00:00 am, September 17, 2009.
1.1 misho 188:
1.1.1.3 misho 189: 10:01 am Sep 17, 2009
190: 10:01 am, September 17, 2009.
1.1 misho 191:
1.1.1.5 ! misho 192: Note that relative time specifications do not always work as expected.
! 193: For example, the ``next'' qualifier is intended to be used in conjunction
! 194: with a day such as ``next Monday''. When used with units of weeks,
! 195: months, years, etc the result will be one more than expected. For
! 196: example, ``next week'' will result in a time exactly two weeks from now,
! 197: which is probably not what was intended. This will be addressed in a
! 198: future version of ssuuddoorreeppllaayy.
! 199:
1.1 misho 200: FFIILLEESS
1.1.1.3 misho 201: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o The default I/O log directory.
1.1 misho 202:
1.1.1.3 misho 203: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_l_o_g
1.1 misho 204: Example session log info.
205:
1.1.1.3 misho 206: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_i_n
1.1 misho 207: Example session standard input log.
208:
1.1.1.3 misho 209: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_o_u_t
1.1 misho 210: Example session standard output log.
211:
1.1.1.3 misho 212: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_e_r_r
1.1 misho 213: Example session standard error log.
214:
1.1.1.3 misho 215: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_t_y_i_n
1.1 misho 216: Example session tty input file.
217:
1.1.1.3 misho 218: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_t_y_o_u_t
1.1 misho 219: Example session tty output file.
220:
1.1.1.3 misho 221: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_i_m_i_n_g
1.1 misho 222: Example session timing file.
223:
1.1.1.3 misho 224: Note that the _s_t_d_i_n, _s_t_d_o_u_t and _s_t_d_e_r_r files will be empty unless ssuuddoo
225: was used as part of a pipeline for a particular command.
1.1 misho 226:
227: EEXXAAMMPPLLEESS
1.1.1.3 misho 228: List sessions run by user _m_i_l_l_e_r_t:
1.1 misho 229:
1.1.1.3 misho 230: # sudoreplay -l user millert
1.1 misho 231:
1.1.1.3 misho 232: List sessions run by user _b_o_b with a command containing the string vi:
1.1 misho 233:
1.1.1.3 misho 234: # sudoreplay -l user bob command vi
1.1 misho 235:
1.1.1.3 misho 236: List sessions run by user _j_e_f_f that match a regular expression:
1.1 misho 237:
1.1.1.3 misho 238: # sudoreplay -l user jeff command '/bin/[a-z]*sh'
1.1 misho 239:
1.1.1.3 misho 240: List sessions run by jeff or bob on the console:
1.1 misho 241:
1.1.1.3 misho 242: # sudoreplay -l ( user jeff or user bob ) tty console
1.1 misho 243:
244: SSEEEE AALLSSOO
1.1.1.3 misho 245: sudo(1m), script(1)
1.1 misho 246:
1.1.1.3 misho 247: AAUUTTHHOORRSS
248: Todd C. Miller
1.1 misho 249:
250: BBUUGGSS
1.1.1.3 misho 251: If you feel you have found a bug in ssuuddoorreeppllaayy, please submit a bug
252: report at http://www.sudo.ws/sudo/bugs/
1.1 misho 253:
254: SSUUPPPPOORRTT
1.1.1.3 misho 255: Limited free support is available via the sudo-users mailing list, see
256: http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search the
257: archives.
1.1 misho 258:
259: DDIISSCCLLAAIIMMEERR
1.1.1.3 misho 260: ssuuddoorreeppllaayy is provided ``AS IS'' and any express or implied warranties,
261: including, but not limited to, the implied warranties of merchantability
262: and fitness for a particular purpose are disclaimed. See the LICENSE
263: file distributed with ssuuddoo or http://www.sudo.ws/sudo/license.html for
264: complete details.
1.1 misho 265:
1.1.1.5 ! misho 266: Sudo 1.8.8 September 11, 2013 Sudo 1.8.8
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sudoreplay.cat CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc