Return to sudoreplay.cat CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc

sudo v 1.8.10p3

    1: SUDOREPLAY(1m)               System Manager's Manual              SUDOREPLAY(1m)
    2: 
    3: NNAAMMEE
    4:      ssuuddoorreeppllaayy - replay sudo session logs
    5: 
    6: SSYYNNOOPPSSIISS
    7:      ssuuddoorreeppllaayy [--hh] [--dd _d_i_r] [--ff _f_i_l_t_e_r] [--mm _n_u_m] [--ss _n_u_m] ID
    8: 
    9:      ssuuddoorreeppllaayy [--hh] [--dd _d_i_r] --ll [search expression]
   10: 
   11: DDEESSCCRRIIPPTTIIOONN
   12:      ssuuddoorreeppllaayy plays back or lists the output logs created by ssuuddoo.  When
   13:      replaying, ssuuddoorreeppllaayy can play the session back in real-time, or the
   14:      playback speed may be adjusted (faster or slower) based on the command
   15:      line options.
   16: 
   17:      The _I_D should either be a six character sequence of digits and upper case
   18:      letters, e.g. 0100A5, or a pattern matching the _i_o_l_o_g___f_i_l_e option in the
   19:      _s_u_d_o_e_r_s file.  When a command is run via ssuuddoo with _l_o_g___o_u_t_p_u_t enabled in
   20:      the _s_u_d_o_e_r_s file, a TSID=ID string is logged via syslog or to the ssuuddoo
   21:      log file.  The _I_D may also be determined using ssuuddoorreeppllaayy's list mode.
   22: 
   23:      In list mode, ssuuddoorreeppllaayy can be used to find the ID of a session based on
   24:      a number of criteria such as the user, tty or command run.
   25: 
   26:      In replay mode, if the standard output has not been redirected,
   27:      ssuuddoorreeppllaayy will act on the following keys:
   28: 
   29:      `\n' or `\r'  Skip to the next replay event; useful for long pauses.
   30: 
   31:      ` ' (space)   Pause output; press any key to resume.
   32: 
   33:      `<'           Reduce the playback speed by one half.
   34: 
   35:      `>'           Double the playback speed.
   36: 
   37:      The options are as follows:
   38: 
   39:      --dd _d_i_r, ----ddiirreeccttoorryy=_d_i_r
   40:                  Store session logs in _d_i_r instead of the default,
   41:                  _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o.
   42: 
   43:      --ff _f_i_l_t_e_r, ----ffiilltteerr=_f_i_l_t_e_r
   44:                  Select which I/O type(s) to display.  By default, ssuuddoorreeppllaayy
   45:                  will display the command's standard output, standard error
   46:                  and tty output.  The _f_i_l_t_e_r argument is a comma-separated
   47:                  list, consisting of one or more of following: _s_t_d_o_u_t, _s_t_d_e_r_r,
   48:                  and _t_t_y_o_u_t.
   49: 
   50:      --hh, ----hheellpp  Display a short help message to the standard output and exit.
   51: 
   52:      --ll, ----lliisstt [_s_e_a_r_c_h _e_x_p_r_e_s_s_i_o_n]
   53:                  Enable ``list mode''.  In this mode, ssuuddoorreeppllaayy will list
   54:                  available sessions in a format similar to the ssuuddoo log file
   55:                  format, sorted by file name (or sequence number).  If a
   56:                  _s_e_a_r_c_h _e_x_p_r_e_s_s_i_o_n is specified, it will be used to restrict
   57:                  the IDs that are displayed.  An expression is composed of the
   58:                  following predicates:
   59: 
   60:                  command _p_a_t_t_e_r_n
   61:                          Evaluates to true if the command run matches _p_a_t_t_e_r_n.
   62:                          On systems with POSIX regular expression support, the
   63:                          pattern may be an extended regular expression.  On
   64:                          systems without POSIX regular expression support, a
   65:                          simple sub-string match is performed instead.
   66: 
   67:                  cwd _d_i_r_e_c_t_o_r_y
   68:                          Evaluates to true if the command was run with the
   69:                          specified current working directory.
   70: 
   71:                  fromdate _d_a_t_e
   72:                          Evaluates to true if the command was run on or after
   73:                          _d_a_t_e.  See _D_a_t_e _a_n_d _t_i_m_e _f_o_r_m_a_t for a description of
   74:                          supported date and time formats.
   75: 
   76:                  group _r_u_n_a_s___g_r_o_u_p
   77:                          Evaluates to true if the command was run with the
   78:                          specified _r_u_n_a_s___g_r_o_u_p.  Note that unless a
   79:                          _r_u_n_a_s___g_r_o_u_p was explicitly specified when ssuuddoo was
   80:                          run this field will be empty in the log.
   81: 
   82:                  runas _r_u_n_a_s___u_s_e_r
   83:                          Evaluates to true if the command was run as the
   84:                          specified _r_u_n_a_s___u_s_e_r.  Note that ssuuddoo runs commands
   85:                          as user _r_o_o_t by default.
   86: 
   87:                  todate _d_a_t_e
   88:                          Evaluates to true if the command was run on or prior
   89:                          to _d_a_t_e.  See _D_a_t_e _a_n_d _t_i_m_e _f_o_r_m_a_t for a description
   90:                          of supported date and time formats.
   91: 
   92:                  tty _t_t_y _n_a_m_e
   93:                          Evaluates to true if the command was run on the
   94:                          specified terminal device.  The _t_t_y _n_a_m_e should be
   95:                          specified without the _/_d_e_v_/ prefix, e.g. _t_t_y_0_1
   96:                          instead of _/_d_e_v_/_t_t_y_0_1.
   97: 
   98:                  user _u_s_e_r _n_a_m_e
   99:                          Evaluates to true if the ID matches a command run by
  100:                          _u_s_e_r _n_a_m_e.
  101: 
  102:                  Predicates may be abbreviated to the shortest unique string
  103:                  (currently all predicates may be shortened to a single
  104:                  character).
  105: 
  106:                  Predicates may be combined using _a_n_d, _o_r and _! operators as
  107:                  well as `(' and `)' grouping (note that parentheses must
  108:                  generally be escaped from the shell).  The _a_n_d operator is
  109:                  optional, adjacent predicates have an implied _a_n_d unless
  110:                  separated by an _o_r.
  111: 
  112:      --mm, ----mmaaxx--wwaaiitt _m_a_x___w_a_i_t
  113:                  Specify an upper bound on how long to wait between key
  114:                  presses or output data.  By default, ssuuddoorreeppllaayy will
  115:                  accurately reproduce the delays between key presses or
  116:                  program output.  However, this can be tedious when the
  117:                  session includes long pauses.  When the --mm option is
  118:                  specified, ssuuddoorreeppllaayy will limit these pauses to at most
  119:                  _m_a_x___w_a_i_t seconds.  The value may be specified as a floating
  120:                  point number, e.g. _2_._5.
  121: 
  122:      --ss, ----ssppeeeedd _s_p_e_e_d___f_a_c_t_o_r
  123:                  This option causes ssuuddoorreeppllaayy to adjust the number of seconds
  124:                  it will wait between key presses or program output.  This can
  125:                  be used to slow down or speed up the display.  For example, a
  126:                  _s_p_e_e_d___f_a_c_t_o_r of _2 would make the output twice as fast whereas
  127:                  a _s_p_e_e_d___f_a_c_t_o_r of _._5 would make the output twice as slow.
  128: 
  129:      --VV, ----vveerrssiioonn
  130:                  Print the ssuuddoorreeppllaayy versions version number and exit.
  131: 
  132:    DDaattee aanndd ttiimmee ffoorrmmaatt
  133:      The time and date may be specified multiple ways, common formats include:
  134: 
  135:      HH:MM:SS am MM/DD/CCYY timezone
  136:              24 hour time may be used in place of am/pm.
  137: 
  138:      HH:MM:SS am Month, Day Year timezone
  139:              24 hour time may be used in place of am/pm, and month and day
  140:              names may be abbreviated.  Note that month and day of the week
  141:              names must be specified in English.
  142: 
  143:      CCYY-MM-DD HH:MM:SS
  144:              ISO time format
  145: 
  146:      DD Month CCYY HH:MM:SS
  147:              The month name may be abbreviated.
  148: 
  149:      Either time or date may be omitted, the am/pm and timezone are optional.
  150:      If no date is specified, the current day is assumed; if no time is
  151:      specified, the first second of the specified date is used.  The less
  152:      significant parts of both time and date may also be omitted, in which
  153:      case zero is assumed.
  154: 
  155:      The following are all valid time and date specifications:
  156: 
  157:      now     The current time and date.
  158: 
  159:      tomorrow
  160:              Exactly one day from now.
  161: 
  162:      yesterday
  163:              24 hours ago.
  164: 
  165:      2 hours ago
  166:              2 hours ago.
  167: 
  168:      next Friday
  169:              The first second of the Friday in the next (upcoming) week.  Not
  170:              to be confused with ``this friday'' which would match the friday
  171:              of the current week.
  172: 
  173:      last week
  174:              The current time but 7 days ago.  This is equivalent to ``a week
  175:              ago''.
  176: 
  177:      a fortnight ago
  178:              The current time but 14 days ago.
  179: 
  180:      10:01 am 9/17/2009
  181:              10:01 am, September 17, 2009.
  182: 
  183:      10:01 am
  184:              10:01 am on the current day.
  185: 
  186:      10      10:00 am on the current day.
  187: 
  188:      9/17/2009
  189:              00:00 am, September 17, 2009.
  190: 
  191:      10:01 am Sep 17, 2009
  192:              10:01 am, September 17, 2009.
  193: 
  194:      Note that relative time specifications do not always work as expected.
  195:      For example, the ``next'' qualifier is intended to be used in conjunction
  196:      with a day such as ``next Monday''.  When used with units of weeks,
  197:      months, years, etc the result will be one more than expected.  For
  198:      example, ``next week'' will result in a time exactly two weeks from now,
  199:      which is probably not what was intended.  This will be addressed in a
  200:      future version of ssuuddoorreeppllaayy.
  201: 
  202: FFIILLEESS
  203:      _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o          The default I/O log directory.
  204: 
  205:      _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_l_o_g
  206:                                Example session log info.
  207: 
  208:      _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_i_n
  209:                                Example session standard input log.
  210: 
  211:      _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_o_u_t
  212:                                Example session standard output log.
  213: 
  214:      _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_e_r_r
  215:                                Example session standard error log.
  216: 
  217:      _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_t_y_i_n
  218:                                Example session tty input file.
  219: 
  220:      _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_t_y_o_u_t
  221:                                Example session tty output file.
  222: 
  223:      _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_i_m_i_n_g
  224:                                Example session timing file.
  225: 
  226:      Note that the _s_t_d_i_n, _s_t_d_o_u_t and _s_t_d_e_r_r files will be empty unless ssuuddoo
  227:      was used as part of a pipeline for a particular command.
  228: 
  229: EEXXAAMMPPLLEESS
  230:      List sessions run by user _m_i_l_l_e_r_t:
  231: 
  232:            # sudoreplay -l user millert
  233: 
  234:      List sessions run by user _b_o_b with a command containing the string vi:
  235: 
  236:            # sudoreplay -l user bob command vi
  237: 
  238:      List sessions run by user _j_e_f_f that match a regular expression:
  239: 
  240:            # sudoreplay -l user jeff command '/bin/[a-z]*sh'
  241: 
  242:      List sessions run by jeff or bob on the console:
  243: 
  244:            # sudoreplay -l ( user jeff or user bob ) tty console
  245: 
  246: SSEEEE AALLSSOO
  247:      sudo(1m), script(1)
  248: 
  249: AAUUTTHHOORRSS
  250:      Todd C. Miller
  251: 
  252: BBUUGGSS
  253:      If you feel you have found a bug in ssuuddoorreeppllaayy, please submit a bug
  254:      report at http://www.sudo.ws/sudo/bugs/
  255: 
  256: SSUUPPPPOORRTT
  257:      Limited free support is available via the sudo-users mailing list, see
  258:      http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search the
  259:      archives.
  260: 
  261: DDIISSCCLLAAIIMMEERR
  262:      ssuuddoorreeppllaayy is provided ``AS IS'' and any express or implied warranties,
  263:      including, but not limited to, the implied warranties of merchantability
  264:      and fitness for a particular purpose are disclaimed.  See the LICENSE
  265:      file distributed with ssuuddoo or http://www.sudo.ws/sudo/license.html for
  266:      complete details.
  267: 
  268: Sudo 1.8.10                    February 15, 2014                   Sudo 1.8.10