1: SUDOREPLAY(1m) MAINTENANCE COMMANDS SUDOREPLAY(1m)
2:
3:
4:
5: NNAAMMEE
6: sudoreplay - replay sudo session logs
7:
8: SSYYNNOOPPSSIISS
9: ssuuddoorreeppllaayy [--hh] [--dd _d_i_r_e_c_t_o_r_y] [--ff _f_i_l_t_e_r] [--mm _m_a_x___w_a_i_t] [--ss
10: _s_p_e_e_d___f_a_c_t_o_r] ID
11:
12: ssuuddoorreeppllaayy [--hh] [--dd _d_i_r_e_c_t_o_r_y] -l [search expression]
13:
14: DDEESSCCRRIIPPTTIIOONN
15: ssuuddoorreeppllaayy plays back or lists the output logs created by ssuuddoo. When
16: replaying, ssuuddoorreeppllaayy can play the session back in real-time, or the
17: playback speed may be adjusted (faster or slower) based on the command
18: line options.
19:
20: The _I_D should either be a six character sequence of digits and upper
21: case letters, e.g. 0100A5, or a pattern matching the _i_o_l_o_g___f_i_l_e option
22: in the _s_u_d_o_e_r_s file. When a command is run via ssuuddoo with _l_o_g___o_u_t_p_u_t
23: enabled in the _s_u_d_o_e_r_s file, a TSID=ID string is logged via syslog or
24: to the ssuuddoo log file. The _I_D may also be determined using ssuuddoorreeppllaayy's
25: list mode.
26:
27: In list mode, ssuuddoorreeppllaayy can be used to find the ID of a session based
28: on a number of criteria such as the user, tty or command run.
29:
30: In replay mode, if the standard output has not been redirected,
31: ssuuddoorreeppllaayy will act on the following keys:
32:
33: ' ' (space)
34: Pause output; press any key to resume.
35:
36: '<' Reduce the playback speed by one half.
37:
38: '>' Double the playback speed.
39:
40: OOPPTTIIOONNSS
41: ssuuddoorreeppllaayy accepts the following command line options:
42:
43: -d _d_i_r_e_c_t_o_r_y
44: Use _d_i_r_e_c_t_o_r_y to for the session logs instead of the
45: default, _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o.
46:
47: -f _f_i_l_t_e_r By default, ssuuddoorreeppllaayy will play back the command's
48: standard output, standard error and tty output. The _-_f
49: option can be used to select which of these to output. The
50: _f_i_l_t_e_r argument is a comma-separated list, consisting of
51: one or more of following: _s_t_d_o_u_t, _s_t_d_e_r_r, and _t_t_y_o_u_t.
52:
53: -h The --hh (_h_e_l_p) option causes ssuuddoorreeppllaayy to print a short
54: help message to the standard output and exit.
55:
56: -l [_s_e_a_r_c_h _e_x_p_r_e_s_s_i_o_n]
57: Enable "list mode". In this mode, ssuuddoorreeppllaayy will list
58: available sessions in a format similar to the ssuuddoo log file
59: format, sorted by file name (or sequence number). If a
60: _s_e_a_r_c_h _e_x_p_r_e_s_s_i_o_n is specified, it will be used to restrict
61: the IDs that are displayed. An expression is composed of
62: the following predicates:
63:
64: command _c_o_m_m_a_n_d _p_a_t_t_e_r_n
65: Evaluates to true if the command run matches
66: _c_o_m_m_a_n_d _p_a_t_t_e_r_n. On systems with POSIX regular
67: expression support, the pattern may be an extended
68: regular expression. On systems without POSIX
69: regular expression support, a simple substring
70: match is performed instead.
71:
72: cwd _d_i_r_e_c_t_o_r_y
73: Evaluates to true if the command was run with the
74: specified current working directory.
75:
76: fromdate _d_a_t_e
77: Evaluates to true if the command was run on or
78: after _d_a_t_e. See "Date and time format" for a
79: description of supported date and time formats.
80:
81: group _r_u_n_a_s___g_r_o_u_p
82: Evaluates to true if the command was run with the
83: specified _r_u_n_a_s___g_r_o_u_p. Note that unless a
84: _r_u_n_a_s___g_r_o_u_p was explicitly specified when ssuuddoo was
85: run this field will be empty in the log.
86:
87: runas _r_u_n_a_s___u_s_e_r
88: Evaluates to true if the command was run as the
89: specified _r_u_n_a_s___u_s_e_r. Note that ssuuddoo runs commands
90: as user _r_o_o_t by default.
91:
92: todate _d_a_t_e
93: Evaluates to true if the command was run on or
94: prior to _d_a_t_e. See "Date and time format" for a
95: description of supported date and time formats.
96:
97: tty _t_t_y Evaluates to true if the command was run on the
98: specified terminal device. The _t_t_y should be
99: specified without the _/_d_e_v_/ prefix, e.g. _t_t_y_0_1
100: instead of _/_d_e_v_/_t_t_y_0_1.
101:
102: user _u_s_e_r _n_a_m_e
103: Evaluates to true if the ID matches a command run
104: by _u_s_e_r _n_a_m_e.
105:
106: Predicates may be abbreviated to the shortest unique string
107: (currently all predicates may be shortened to a single
108: character).
109:
110: Predicates may be combined using _a_n_d, _o_r and _! operators as
111: well as '(' and ')' for grouping (note that parentheses
112: must generally be escaped from the shell). The _a_n_d
113: operator is optional, adjacent predicates have an implied
114: _a_n_d unless separated by an _o_r.
115:
116: -m _m_a_x___w_a_i_t Specify an upper bound on how long to wait between key
117: presses or output data. By default, ssuuddoo__rreeppllaayy will
118: accurately reproduce the delays between key presses or
119: program output. However, this can be tedious when the
120: session includes long pauses. When the _-_m option is
121: specified, ssuuddoorreeppllaayy will limit these pauses to at most
122: _m_a_x___w_a_i_t seconds. The value may be specified as a floating
123: point number, .e.g. _2_._5.
124:
125: -s _s_p_e_e_d___f_a_c_t_o_r
126: This option causes ssuuddoorreeppllaayy to adjust the number of
127: seconds it will wait between key presses or program output.
128: This can be used to slow down or speed up the display. For
129: example, a _s_p_e_e_d___f_a_c_t_o_r of _2 would make the output twice as
130: fast whereas a _s_p_e_e_d___f_a_c_t_o_r of <.5> would make the output
131: twice as slow.
132:
133: -V The --VV (version) option causes ssuuddoorreeppllaayy to print its
134: version number and exit.
135:
136: DDaattee aanndd ttiimmee ffoorrmmaatt
137: The time and date may be specified multiple ways, common formats
138: include:
139:
140: HH:MM:SS am MM/DD/CCYY timezone
141: 24 hour time may be used in place of am/pm.
142:
143: HH:MM:SS am Month, Day Year timezone
144: 24 hour time may be used in place of am/pm, and month and day
145: names may be abbreviated. Note that month and day of the week
146: names must be specified in English.
147:
148: CCYY-MM-DD HH:MM:SS
149: ISO time format
150:
151: DD Month CCYY HH:MM:SS
152: The month name may be abbreviated.
153:
154: Either time or date may be omitted, the am/pm and timezone are
155: optional. If no date is specified, the current day is assumed; if no
156: time is specified, the first second of the specified date is used. The
157: less significant parts of both time and date may also be omitted, in
158: which case zero is assumed. For example, the following are all valid:
159:
160: The following are all valid time and date specifications:
161:
162: now The current time and date.
163:
164: tomorrow
165: Exactly one day from now.
166:
167: yesterday
168: 24 hours ago.
169:
170: 2 hours ago
171: 2 hours ago.
172:
173: next Friday
174: The first second of the next Friday.
175:
176: this week
177: The current time but the first day of the coming week.
178:
179: a fortnight ago
180: The current time but 14 days ago.
181:
182: 10:01 am 9/17/2009
183: 10:01 am, September 17, 2009.
184:
185: 10:01 am
186: 10:01 am on the current day.
187:
188: 10 10:00 am on the current day.
189:
190: 9/17/2009
191: 00:00 am, September 17, 2009.
192:
193: 10:01 am Sep 17, 2009
194: 10:01 am, September 17, 2009.
195:
196: FFIILLEESS
197: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o The default I/O log directory.
198:
199: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_l_o_g
200: Example session log info.
201:
202: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_i_n
203: Example session standard input log.
204:
205: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_o_u_t
206: Example session standard output log.
207:
208: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_e_r_r
209: Example session standard error log.
210:
211: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_t_y_i_n
212: Example session tty input file.
213:
214: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_t_y_o_u_t
215: Example session tty output file.
216:
217: _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_i_m_i_n_g
218: Example session timing file.
219:
220: Note that the _s_t_d_i_n, _s_t_d_o_u_t and _s_t_d_e_r_r files will be empty unless ssuuddoo
221: was used as part of a pipeline for a particular command.
222:
223: EEXXAAMMPPLLEESS
224: List sessions run by user _m_i_l_l_e_r_t:
225:
226: sudoreplay -l user millert
227:
228: List sessions run by user _b_o_b with a command containing the string vi:
229:
230: sudoreplay -l user bob command vi
231:
232: List sessions run by user _j_e_f_f that match a regular expression:
233:
234: sudoreplay -l user jeff command '/bin/[a-z]*sh'
235:
236: List sessions run by jeff or bob on the console:
237:
238: sudoreplay -l ( user jeff or user bob ) tty console
239:
240: SSEEEE AALLSSOO
241: _s_u_d_o(1m), _s_c_r_i_p_t(1)
242:
243: AAUUTTHHOORR
244: Todd C. Miller
245:
246: BBUUGGSS
247: If you feel you have found a bug in ssuuddoorreeppllaayy, please submit a bug
248: report at http://www.sudo.ws/sudo/bugs/
249:
250: SSUUPPPPOORRTT
251: Limited free support is available via the sudo-users mailing list, see
252: http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search
253: the archives.
254:
255: DDIISSCCLLAAIIMMEERR
256: ssuuddoorreeppllaayy is provided ``AS IS'' and any express or implied warranties,
257: including, but not limited to, the implied warranties of
258: merchantability and fitness for a particular purpose are disclaimed.
259: See the LICENSE file distributed with ssuuddoo or
260: http://www.sudo.ws/sudo/license.html for complete details.
261:
262:
263:
264: 1.8.5 April 16, 2012 SUDOREPLAY(1m)
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sudoreplay.cat CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc