Return to sudoreplay.cat CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc

v 1.8.8

    1: SUDOREPLAY(1m)               System Manager's Manual              SUDOREPLAY(1m)
    2: 
    3: NNAAMMEE
    4:      ssuuddoorreeppllaayy - replay sudo session logs
    5: 
    6: SSYYNNOOPPSSIISS
    7:      ssuuddoorreeppllaayy [--hh] [--dd _d_i_r] [--ff _f_i_l_t_e_r] [--mm _n_u_m] [--ss _n_u_m] ID
    8: 
    9:      ssuuddoorreeppllaayy [--hh] [--dd _d_i_r] --ll [search expression]
   10: 
   11: DDEESSCCRRIIPPTTIIOONN
   12:      ssuuddoorreeppllaayy plays back or lists the output logs created by ssuuddoo.  When
   13:      replaying, ssuuddoorreeppllaayy can play the session back in real-time, or the
   14:      playback speed may be adjusted (faster or slower) based on the command
   15:      line options.
   16: 
   17:      The _I_D should either be a six character sequence of digits and upper case
   18:      letters, e.g. 0100A5, or a pattern matching the _i_o_l_o_g___f_i_l_e option in the
   19:      _s_u_d_o_e_r_s file.  When a command is run via ssuuddoo with _l_o_g___o_u_t_p_u_t enabled in
   20:      the _s_u_d_o_e_r_s file, a TSID=ID string is logged via syslog or to the ssuuddoo
   21:      log file.  The _I_D may also be determined using ssuuddoorreeppllaayy's list mode.
   22: 
   23:      In list mode, ssuuddoorreeppllaayy can be used to find the ID of a session based on
   24:      a number of criteria such as the user, tty or command run.
   25: 
   26:      In replay mode, if the standard output has not been redirected,
   27:      ssuuddoorreeppllaayy will act on the following keys:
   28: 
   29:      ` ' (space)   Pause output; press any key to resume.
   30: 
   31:      `<'           Reduce the playback speed by one half.
   32: 
   33:      `>'           Double the playback speed.
   34: 
   35:      The options are as follows:
   36: 
   37:      --dd _d_i_r, ----ddiirreeccttoorryy=_d_i_r
   38:                  Store session logs in _d_i_r instead of the default,
   39:                  _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o.
   40: 
   41:      --ff _f_i_l_t_e_r, ----ffiilltteerr=_f_i_l_t_e_r
   42:                  Select which I/O type(s) to display.  By default, ssuuddoorreeppllaayy
   43:                  will display the command's standard output, standard error
   44:                  and tty output.  The _f_i_l_t_e_r argument is a comma-separated
   45:                  list, consisting of one or more of following: _s_t_d_o_u_t, _s_t_d_e_r_r,
   46:                  and _t_t_y_o_u_t.
   47: 
   48:      --hh, ----hheellpp  Display a short help message to the standard output and exit.
   49: 
   50:      --ll, ----lliisstt [_s_e_a_r_c_h _e_x_p_r_e_s_s_i_o_n]
   51:                  Enable ``list mode''.  In this mode, ssuuddoorreeppllaayy will list
   52:                  available sessions in a format similar to the ssuuddoo log file
   53:                  format, sorted by file name (or sequence number).  If a
   54:                  _s_e_a_r_c_h _e_x_p_r_e_s_s_i_o_n is specified, it will be used to restrict
   55:                  the IDs that are displayed.  An expression is composed of the
   56:                  following predicates:
   57: 
   58:                  command _p_a_t_t_e_r_n
   59:                          Evaluates to true if the command run matches _p_a_t_t_e_r_n.
   60:                          On systems with POSIX regular expression support, the
   61:                          pattern may be an extended regular expression.  On
   62:                          systems without POSIX regular expression support, a
   63:                          simple sub-string match is performed instead.
   64: 
   65:                  cwd _d_i_r_e_c_t_o_r_y
   66:                          Evaluates to true if the command was run with the
   67:                          specified current working directory.
   68: 
   69:                  fromdate _d_a_t_e
   70:                          Evaluates to true if the command was run on or after
   71:                          _d_a_t_e.  See _D_a_t_e _a_n_d _t_i_m_e _f_o_r_m_a_t for a description of
   72:                          supported date and time formats.
   73: 
   74:                  group _r_u_n_a_s___g_r_o_u_p
   75:                          Evaluates to true if the command was run with the
   76:                          specified _r_u_n_a_s___g_r_o_u_p.  Note that unless a
   77:                          _r_u_n_a_s___g_r_o_u_p was explicitly specified when ssuuddoo was
   78:                          run this field will be empty in the log.
   79: 
   80:                  runas _r_u_n_a_s___u_s_e_r
   81:                          Evaluates to true if the command was run as the
   82:                          specified _r_u_n_a_s___u_s_e_r.  Note that ssuuddoo runs commands
   83:                          as user _r_o_o_t by default.
   84: 
   85:                  todate _d_a_t_e
   86:                          Evaluates to true if the command was run on or prior
   87:                          to _d_a_t_e.  See _D_a_t_e _a_n_d _t_i_m_e _f_o_r_m_a_t for a description
   88:                          of supported date and time formats.
   89: 
   90:                  tty _t_t_y _n_a_m_e
   91:                          Evaluates to true if the command was run on the
   92:                          specified terminal device.  The _t_t_y _n_a_m_e should be
   93:                          specified without the _/_d_e_v_/ prefix, e.g. _t_t_y_0_1
   94:                          instead of _/_d_e_v_/_t_t_y_0_1.
   95: 
   96:                  user _u_s_e_r _n_a_m_e
   97:                          Evaluates to true if the ID matches a command run by
   98:                          _u_s_e_r _n_a_m_e.
   99: 
  100:                  Predicates may be abbreviated to the shortest unique string
  101:                  (currently all predicates may be shortened to a single
  102:                  character).
  103: 
  104:                  Predicates may be combined using _a_n_d, _o_r and _! operators as
  105:                  well as `(' and `)' grouping (note that parentheses must
  106:                  generally be escaped from the shell).  The _a_n_d operator is
  107:                  optional, adjacent predicates have an implied _a_n_d unless
  108:                  separated by an _o_r.
  109: 
  110:      --mm, ----mmaaxx--wwaaiitt _m_a_x___w_a_i_t
  111:                  Specify an upper bound on how long to wait between key
  112:                  presses or output data.  By default, ssuuddoorreeppllaayy will
  113:                  accurately reproduce the delays between key presses or
  114:                  program output.  However, this can be tedious when the
  115:                  session includes long pauses.  When the --mm option is
  116:                  specified, ssuuddoorreeppllaayy will limit these pauses to at most
  117:                  _m_a_x___w_a_i_t seconds.  The value may be specified as a floating
  118:                  point number, e.g. _2_._5.
  119: 
  120:      --ss, ----ssppeeeedd _s_p_e_e_d___f_a_c_t_o_r
  121:                  This option causes ssuuddoorreeppllaayy to adjust the number of seconds
  122:                  it will wait between key presses or program output.  This can
  123:                  be used to slow down or speed up the display.  For example, a
  124:                  _s_p_e_e_d___f_a_c_t_o_r of _2 would make the output twice as fast whereas
  125:                  a _s_p_e_e_d___f_a_c_t_o_r of _._5 would make the output twice as slow.
  126: 
  127:      --VV, ----vveerrssiioonn
  128:                  Print the ssuuddoorreeppllaayy versions version number and exit.
  129: 
  130:    DDaattee aanndd ttiimmee ffoorrmmaatt
  131:      The time and date may be specified multiple ways, common formats include:
  132: 
  133:      HH:MM:SS am MM/DD/CCYY timezone
  134:              24 hour time may be used in place of am/pm.
  135: 
  136:      HH:MM:SS am Month, Day Year timezone
  137:              24 hour time may be used in place of am/pm, and month and day
  138:              names may be abbreviated.  Note that month and day of the week
  139:              names must be specified in English.
  140: 
  141:      CCYY-MM-DD HH:MM:SS
  142:              ISO time format
  143: 
  144:      DD Month CCYY HH:MM:SS
  145:              The month name may be abbreviated.
  146: 
  147:      Either time or date may be omitted, the am/pm and timezone are optional.
  148:      If no date is specified, the current day is assumed; if no time is
  149:      specified, the first second of the specified date is used.  The less
  150:      significant parts of both time and date may also be omitted, in which
  151:      case zero is assumed.
  152: 
  153:      The following are all valid time and date specifications:
  154: 
  155:      now     The current time and date.
  156: 
  157:      tomorrow
  158:              Exactly one day from now.
  159: 
  160:      yesterday
  161:              24 hours ago.
  162: 
  163:      2 hours ago
  164:              2 hours ago.
  165: 
  166:      next Friday
  167:              The first second of the Friday in the next (upcoming) week.  Not
  168:              to be confused with ``this friday'' which would match the friday
  169:              of the current week.
  170: 
  171:      last week
  172:              The current time but 7 days ago.  This is equivalent to ``a week
  173:              ago''.
  174: 
  175:      a fortnight ago
  176:              The current time but 14 days ago.
  177: 
  178:      10:01 am 9/17/2009
  179:              10:01 am, September 17, 2009.
  180: 
  181:      10:01 am
  182:              10:01 am on the current day.
  183: 
  184:      10      10:00 am on the current day.
  185: 
  186:      9/17/2009
  187:              00:00 am, September 17, 2009.
  188: 
  189:      10:01 am Sep 17, 2009
  190:              10:01 am, September 17, 2009.
  191: 
  192:      Note that relative time specifications do not always work as expected.
  193:      For example, the ``next'' qualifier is intended to be used in conjunction
  194:      with a day such as ``next Monday''.  When used with units of weeks,
  195:      months, years, etc the result will be one more than expected.  For
  196:      example, ``next week'' will result in a time exactly two weeks from now,
  197:      which is probably not what was intended.  This will be addressed in a
  198:      future version of ssuuddoorreeppllaayy.
  199: 
  200: FFIILLEESS
  201:      _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o          The default I/O log directory.
  202: 
  203:      _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_l_o_g
  204:                                Example session log info.
  205: 
  206:      _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_i_n
  207:                                Example session standard input log.
  208: 
  209:      _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_o_u_t
  210:                                Example session standard output log.
  211: 
  212:      _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_e_r_r
  213:                                Example session standard error log.
  214: 
  215:      _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_t_y_i_n
  216:                                Example session tty input file.
  217: 
  218:      _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_t_y_o_u_t
  219:                                Example session tty output file.
  220: 
  221:      _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_i_m_i_n_g
  222:                                Example session timing file.
  223: 
  224:      Note that the _s_t_d_i_n, _s_t_d_o_u_t and _s_t_d_e_r_r files will be empty unless ssuuddoo
  225:      was used as part of a pipeline for a particular command.
  226: 
  227: EEXXAAMMPPLLEESS
  228:      List sessions run by user _m_i_l_l_e_r_t:
  229: 
  230:            # sudoreplay -l user millert
  231: 
  232:      List sessions run by user _b_o_b with a command containing the string vi:
  233: 
  234:            # sudoreplay -l user bob command vi
  235: 
  236:      List sessions run by user _j_e_f_f that match a regular expression:
  237: 
  238:            # sudoreplay -l user jeff command '/bin/[a-z]*sh'
  239: 
  240:      List sessions run by jeff or bob on the console:
  241: 
  242:            # sudoreplay -l ( user jeff or user bob ) tty console
  243: 
  244: SSEEEE AALLSSOO
  245:      sudo(1m), script(1)
  246: 
  247: AAUUTTHHOORRSS
  248:      Todd C. Miller
  249: 
  250: BBUUGGSS
  251:      If you feel you have found a bug in ssuuddoorreeppllaayy, please submit a bug
  252:      report at http://www.sudo.ws/sudo/bugs/
  253: 
  254: SSUUPPPPOORRTT
  255:      Limited free support is available via the sudo-users mailing list, see
  256:      http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search the
  257:      archives.
  258: 
  259: DDIISSCCLLAAIIMMEERR
  260:      ssuuddoorreeppllaayy is provided ``AS IS'' and any express or implied warranties,
  261:      including, but not limited to, the implied warranties of merchantability
  262:      and fitness for a particular purpose are disclaimed.  See the LICENSE
  263:      file distributed with ssuuddoo or http://www.sudo.ws/sudo/license.html for
  264:      complete details.
  265: 
  266: Sudo 1.8.8                    September 11, 2013                    Sudo 1.8.8