Annotation of embedaddon/sudo/doc/sudoreplay.man.in, revision 1.1
1.1 ! misho 1: .\" Copyright (c) 2009-2011 Todd C. Miller <Todd.Miller@courtesan.com>
! 2: .\"
! 3: .\" Permission to use, copy, modify, and distribute this software for any
! 4: .\" purpose with or without fee is hereby granted, provided that the above
! 5: .\" copyright notice and this permission notice appear in all copies.
! 6: .\"
! 7: .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
! 8: .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
! 9: .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
! 10: .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
! 11: .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
! 12: .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
! 13: .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
! 14: .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
! 15: .\"
! 16: .\" Automatically generated by Pod::Man 2.23 (Pod::Simple 3.14)
! 17: .\"
! 18: .\" Standard preamble:
! 19: .\" ========================================================================
! 20: .de Sp \" Vertical space (when we can't use .PP)
! 21: .if t .sp .5v
! 22: .if n .sp
! 23: ..
! 24: .de Vb \" Begin verbatim text
! 25: .ft CW
! 26: .nf
! 27: .ne \\$1
! 28: ..
! 29: .de Ve \" End verbatim text
! 30: .ft R
! 31: .fi
! 32: ..
! 33: .\" Set up some character translations and predefined strings. \*(-- will
! 34: .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
! 35: .\" double quote, and \*(R" will give a right double quote. \*(C+ will
! 36: .\" give a nicer C++. Capital omega is used to do unbreakable dashes and
! 37: .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
! 38: .\" nothing in troff, for use with C<>.
! 39: .tr \(*W-
! 40: .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
! 41: .ie n \{\
! 42: . ds -- \(*W-
! 43: . ds PI pi
! 44: . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
! 45: . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
! 46: . ds L" ""
! 47: . ds R" ""
! 48: . ds C`
! 49: . ds C'
! 50: 'br\}
! 51: .el\{\
! 52: . ds -- \|\(em\|
! 53: . ds PI \(*p
! 54: . ds L" ``
! 55: . ds R" ''
! 56: 'br\}
! 57: .\"
! 58: .\" Escape single quotes in literal strings from groff's Unicode transform.
! 59: .ie \n(.g .ds Aq \(aq
! 60: .el .ds Aq '
! 61: .\"
! 62: .\" If the F register is turned on, we'll generate index entries on stderr for
! 63: .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
! 64: .\" entries marked with X<> in POD. Of course, you'll have to process the
! 65: .\" output yourself in some meaningful fashion.
! 66: .ie \nF \{\
! 67: . de IX
! 68: . tm Index:\\$1\t\\n%\t"\\$2"
! 69: ..
! 70: . nr % 0
! 71: . rr F
! 72: .\}
! 73: .el \{\
! 74: . de IX
! 75: ..
! 76: .\}
! 77: .\"
! 78: .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
! 79: .\" Fear. Run. Save yourself. No user-serviceable parts.
! 80: . \" fudge factors for nroff and troff
! 81: .if n \{\
! 82: . ds #H 0
! 83: . ds #V .8m
! 84: . ds #F .3m
! 85: . ds #[ \f1
! 86: . ds #] \fP
! 87: .\}
! 88: .if t \{\
! 89: . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
! 90: . ds #V .6m
! 91: . ds #F 0
! 92: . ds #[ \&
! 93: . ds #] \&
! 94: .\}
! 95: . \" simple accents for nroff and troff
! 96: .if n \{\
! 97: . ds ' \&
! 98: . ds ` \&
! 99: . ds ^ \&
! 100: . ds , \&
! 101: . ds ~ ~
! 102: . ds /
! 103: .\}
! 104: .if t \{\
! 105: . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
! 106: . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
! 107: . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
! 108: . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
! 109: . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
! 110: . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
! 111: .\}
! 112: . \" troff and (daisy-wheel) nroff accents
! 113: .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
! 114: .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
! 115: .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
! 116: .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
! 117: .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
! 118: .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
! 119: .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
! 120: .ds ae a\h'-(\w'a'u*4/10)'e
! 121: .ds Ae A\h'-(\w'A'u*4/10)'E
! 122: . \" corrections for vroff
! 123: .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
! 124: .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
! 125: . \" for low resolution devices (crt and lpr)
! 126: .if \n(.H>23 .if \n(.V>19 \
! 127: \{\
! 128: . ds : e
! 129: . ds 8 ss
! 130: . ds o a
! 131: . ds d- d\h'-1'\(ga
! 132: . ds D- D\h'-1'\(hy
! 133: . ds th \o'bp'
! 134: . ds Th \o'LP'
! 135: . ds ae ae
! 136: . ds Ae AE
! 137: .\}
! 138: .rm #[ #] #H #V #F C
! 139: .\" ========================================================================
! 140: .\"
! 141: .IX Title "SUDOREPLAY @mansectsu@"
! 142: .TH SUDOREPLAY @mansectsu@ "September 16, 2011" "1.8.3" "MAINTENANCE COMMANDS"
! 143: .\" For nroff, turn off justification. Always turn off hyphenation; it makes
! 144: .\" way too many mistakes in technical documents.
! 145: .if n .ad l
! 146: .nh
! 147: .SH "NAME"
! 148: sudoreplay \- replay sudo session logs
! 149: .SH "SYNOPSIS"
! 150: .IX Header "SYNOPSIS"
! 151: \&\fBsudoreplay\fR [\fB\-h\fR] [\fB\-d\fR \fIdirectory\fR] [\fB\-f\fR \fIfilter\fR] [\fB\-m\fR \fImax_wait\fR] [\fB\-s\fR \fIspeed_factor\fR] \s-1ID\s0
! 152: .PP
! 153: \&\fBsudoreplay\fR [\fB\-h\fR] [\fB\-d\fR \fIdirectory\fR] \-l [search expression]
! 154: .SH "DESCRIPTION"
! 155: .IX Header "DESCRIPTION"
! 156: \&\fBsudoreplay\fR plays back or lists the output logs created by \fBsudo\fR.
! 157: When replaying, \fBsudoreplay\fR can play the session back in real-time,
! 158: or the playback speed may be adjusted (faster or slower) based on
! 159: the command line options.
! 160: .PP
! 161: The \fI\s-1ID\s0\fR should either be a six character sequence of digits and
! 162: upper case letters, e.g. \f(CW\*(C`0100A5\*(C'\fR, or a pattern matching the
! 163: \&\fIiolog_file\fR option in the \fIsudoers\fR file. When a command is run
! 164: via \fBsudo\fR with \fIlog_output\fR enabled in the \fIsudoers\fR file, a
! 165: \&\f(CW\*(C`TSID=ID\*(C'\fR string is logged via syslog or to the \fBsudo\fR log file.
! 166: The \fI\s-1ID\s0\fR may also be determined using \fBsudoreplay\fR's list mode.
! 167: .PP
! 168: In list mode, \fBsudoreplay\fR can be used to find the \s-1ID\s0 of a session
! 169: based on a number of criteria such as the user, tty or command run.
! 170: .PP
! 171: In replay mode, if the standard output has not been redirected,
! 172: \&\fBsudoreplay\fR will act on the following keys:
! 173: .IP "' ' (space)" 8
! 174: .IX Item "' ' (space)"
! 175: Pause output; press any key to resume.
! 176: .IP "'<'" 8
! 177: Reduce the playback speed by one half.
! 178: .IP "'>'" 8
! 179: Double the playback speed.
! 180: .SH "OPTIONS"
! 181: .IX Header "OPTIONS"
! 182: \&\fBsudoreplay\fR accepts the following command line options:
! 183: .IP "\-d \fIdirectory\fR" 12
! 184: .IX Item "-d directory"
! 185: Use \fIdirectory\fR to for the session logs instead of the default,
! 186: \&\fI/var/log/sudo\-io\fR.
! 187: .IP "\-f \fIfilter\fR" 12
! 188: .IX Item "-f filter"
! 189: By default, \fBsudoreplay\fR will play back the command's standard
! 190: output, standard error and tty output. The \fI\-f\fR option can be
! 191: used to select which of these to output. The \fIfilter\fR argument
! 192: is a comma-separated list, consisting of one or more of following:
! 193: \&\fIstdout\fR, \fIstderr\fR, and \fIttyout\fR.
! 194: .IP "\-h" 12
! 195: .IX Item "-h"
! 196: The \fB\-h\fR (\fIhelp\fR) option causes \fBsudoreplay\fR to print a short
! 197: help message to the standard output and exit.
! 198: .IP "\-l [\fIsearch expression\fR]" 12
! 199: .IX Item "-l [search expression]"
! 200: Enable \*(L"list mode\*(R". In this mode, \fBsudoreplay\fR will list available
! 201: session IDs. If a \fIsearch expression\fR is specified, it will be
! 202: used to restrict the IDs that are displayed. An expression is
! 203: composed of the following predicates:
! 204: .RS 12
! 205: .IP "command \fIcommand pattern\fR" 8
! 206: .IX Item "command command pattern"
! 207: Evaluates to true if the command run matches \fIcommand pattern\fR.
! 208: On systems with \s-1POSIX\s0 regular expression support, the pattern may
! 209: be an extended regular expression. On systems without \s-1POSIX\s0 regular
! 210: expression support, a simple substring match is performed instead.
! 211: .IP "cwd \fIdirectory\fR" 8
! 212: .IX Item "cwd directory"
! 213: Evaluates to true if the command was run with the specified current
! 214: working directory.
! 215: .IP "fromdate \fIdate\fR" 8
! 216: .IX Item "fromdate date"
! 217: Evaluates to true if the command was run on or after \fIdate\fR.
! 218: See \*(L"Date and time format\*(R" for a description of supported
! 219: date and time formats.
! 220: .IP "group \fIrunas_group\fR" 8
! 221: .IX Item "group runas_group"
! 222: Evaluates to true if the command was run with the specified
! 223: \&\fIrunas_group\fR. Note that unless a \fIrunas_group\fR was explicitly
! 224: specified when \fBsudo\fR was run this field will be empty in the log.
! 225: .IP "runas \fIrunas_user\fR" 8
! 226: .IX Item "runas runas_user"
! 227: Evaluates to true if the command was run as the specified \fIrunas_user\fR.
! 228: Note that \fBsudo\fR runs commands as user \fIroot\fR by default.
! 229: .IP "todate \fIdate\fR" 8
! 230: .IX Item "todate date"
! 231: Evaluates to true if the command was run on or prior to \fIdate\fR.
! 232: See \*(L"Date and time format\*(R" for a description of supported
! 233: date and time formats.
! 234: .IP "tty \fItty\fR" 8
! 235: .IX Item "tty tty"
! 236: Evaluates to true if the command was run on the specified terminal
! 237: device. The \fItty\fR should be specified without the \fI/dev/\fR prefix,
! 238: e.g. \fItty01\fR instead of \fI/dev/tty01\fR.
! 239: .IP "user \fIuser name\fR" 8
! 240: .IX Item "user user name"
! 241: Evaluates to true if the \s-1ID\s0 matches a command run by \fIuser name\fR.
! 242: .RE
! 243: .RS 12
! 244: .Sp
! 245: Predicates may be abbreviated to the shortest unique string (currently
! 246: all predicates may be shortened to a single character).
! 247: .Sp
! 248: Predicates may be combined using \fIand\fR, \fIor\fR and \fI!\fR operators
! 249: as well as \f(CW\*(Aq(\*(Aq\fR and \f(CW\*(Aq)\*(Aq\fR for grouping (note that parentheses
! 250: must generally be escaped from the shell). The \fIand\fR operator is
! 251: optional, adjacent predicates have an implied \fIand\fR unless separated
! 252: by an \fIor\fR.
! 253: .RE
! 254: .IP "\-m \fImax_wait\fR" 12
! 255: .IX Item "-m max_wait"
! 256: Specify an upper bound on how long to wait between key presses or
! 257: output data. By default, \fBsudo_replay\fR will accurately reproduce
! 258: the delays between key presses or program output. However, this
! 259: can be tedious when the session includes long pauses. When the
! 260: \&\fI\-m\fR option is specified, \fBsudoreplay\fR will limit these pauses
! 261: to at most \fImax_wait\fR seconds. The value may be specified as a
! 262: floating point number, .e.g. \fI2.5\fR.
! 263: .IP "\-s \fIspeed_factor\fR" 12
! 264: .IX Item "-s speed_factor"
! 265: This option causes \fBsudoreplay\fR to adjust the number of seconds
! 266: it will wait between key presses or program output. This can be
! 267: used to slow down or speed up the display. For example, a
! 268: \&\fIspeed_factor\fR of \fI2\fR would make the output twice as fast whereas
! 269: a \fIspeed_factor\fR of <.5> would make the output twice as slow.
! 270: .IP "\-V" 12
! 271: .IX Item "-V"
! 272: The \fB\-V\fR (version) option causes \fBsudoreplay\fR to print its version number
! 273: and exit.
! 274: .SS "Date and time format"
! 275: .IX Subsection "Date and time format"
! 276: The time and date may be specified multiple ways, common formats include:
! 277: .IP "\s-1HH:MM:SS\s0 am \s-1MM/DD/CCYY\s0 timezone" 8
! 278: .IX Item "HH:MM:SS am MM/DD/CCYY timezone"
! 279: 24 hour time may be used in place of am/pm.
! 280: .IP "\s-1HH:MM:SS\s0 am Month, Day Year timezone" 8
! 281: .IX Item "HH:MM:SS am Month, Day Year timezone"
! 282: 24 hour time may be used in place of am/pm, and month and day names
! 283: may be abbreviated. Note that month and day of the week names must
! 284: be specified in English.
! 285: .IP "CCYY-MM-DD \s-1HH:MM:SS\s0" 8
! 286: .IX Item "CCYY-MM-DD HH:MM:SS"
! 287: \&\s-1ISO\s0 time format
! 288: .IP "\s-1DD\s0 Month \s-1CCYY\s0 \s-1HH:MM:SS\s0" 8
! 289: .IX Item "DD Month CCYY HH:MM:SS"
! 290: The month name may be abbreviated.
! 291: .PP
! 292: Either time or date may be omitted, the am/pm and timezone are
! 293: optional. If no date is specified, the current day is assumed; if
! 294: no time is specified, the first second of the specified date is
! 295: used. The less significant parts of both time and date may also
! 296: be omitted, in which case zero is assumed. For example, the following
! 297: are all valid:
! 298: .PP
! 299: The following are all valid time and date specifications:
! 300: .IP "now" 8
! 301: .IX Item "now"
! 302: The current time and date.
! 303: .IP "tomorrow" 8
! 304: .IX Item "tomorrow"
! 305: Exactly one day from now.
! 306: .IP "yesterday" 8
! 307: .IX Item "yesterday"
! 308: 24 hours ago.
! 309: .IP "2 hours ago" 8
! 310: .IX Item "2 hours ago"
! 311: 2 hours ago.
! 312: .IP "next Friday" 8
! 313: .IX Item "next Friday"
! 314: The first second of the next Friday.
! 315: .IP "this week" 8
! 316: .IX Item "this week"
! 317: The current time but the first day of the coming week.
! 318: .IP "a fortnight ago" 8
! 319: .IX Item "a fortnight ago"
! 320: The current time but 14 days ago.
! 321: .IP "10:01 am 9/17/2009" 8
! 322: .IX Item "10:01 am 9/17/2009"
! 323: 10:01 am, September 17, 2009.
! 324: .IP "10:01 am" 8
! 325: .IX Item "10:01 am"
! 326: 10:01 am on the current day.
! 327: .IP "10" 8
! 328: .IX Item "10"
! 329: 10:00 am on the current day.
! 330: .IP "9/17/2009" 8
! 331: .IX Item "9/17/2009"
! 332: 00:00 am, September 17, 2009.
! 333: .IP "10:01 am Sep 17, 2009" 8
! 334: .IX Item "10:01 am Sep 17, 2009"
! 335: 10:01 am, September 17, 2009.
! 336: .SH "FILES"
! 337: .IX Header "FILES"
! 338: .IP "\fI/var/log/sudo\-io\fR" 24
! 339: .IX Item "/var/log/sudo-io"
! 340: The default I/O log directory.
! 341: .IP "\fI/var/log/sudo\-io/00/00/01/log\fR" 24
! 342: .IX Item "/var/log/sudo-io/00/00/01/log"
! 343: Example session log info.
! 344: .IP "\fI/var/log/sudo\-io/00/00/01/stdin\fR" 24
! 345: .IX Item "/var/log/sudo-io/00/00/01/stdin"
! 346: Example session standard input log.
! 347: .IP "\fI/var/log/sudo\-io/00/00/01/stdout\fR" 24
! 348: .IX Item "/var/log/sudo-io/00/00/01/stdout"
! 349: Example session standard output log.
! 350: .IP "\fI/var/log/sudo\-io/00/00/01/stderr\fR" 24
! 351: .IX Item "/var/log/sudo-io/00/00/01/stderr"
! 352: Example session standard error log.
! 353: .IP "\fI/var/log/sudo\-io/00/00/01/ttyin\fR" 24
! 354: .IX Item "/var/log/sudo-io/00/00/01/ttyin"
! 355: Example session tty input file.
! 356: .IP "\fI/var/log/sudo\-io/00/00/01/ttyout\fR" 24
! 357: .IX Item "/var/log/sudo-io/00/00/01/ttyout"
! 358: Example session tty output file.
! 359: .IP "\fI/var/log/sudo\-io/00/00/01/timing\fR" 24
! 360: .IX Item "/var/log/sudo-io/00/00/01/timing"
! 361: Example session timing file.
! 362: .PP
! 363: Note that the \fIstdin\fR, \fIstdout\fR and \fIstderr\fR files will be empty
! 364: unless \fBsudo\fR was used as part of a pipeline for a particular
! 365: command.
! 366: .SH "EXAMPLES"
! 367: .IX Header "EXAMPLES"
! 368: List sessions run by user \fImillert\fR:
! 369: .PP
! 370: .Vb 1
! 371: \& sudoreplay \-l user millert
! 372: .Ve
! 373: .PP
! 374: List sessions run by user \fIbob\fR with a command containing the string vi:
! 375: .PP
! 376: .Vb 1
! 377: \& sudoreplay \-l user bob command vi
! 378: .Ve
! 379: .PP
! 380: List sessions run by user \fIjeff\fR that match a regular expression:
! 381: .PP
! 382: .Vb 1
! 383: \& sudoreplay \-l user jeff command \*(Aq/bin/[a\-z]*sh\*(Aq
! 384: .Ve
! 385: .PP
! 386: List sessions run by jeff or bob on the console:
! 387: .PP
! 388: .Vb 1
! 389: \& sudoreplay \-l ( user jeff or user bob ) tty console
! 390: .Ve
! 391: .SH "SEE ALSO"
! 392: .IX Header "SEE ALSO"
! 393: \&\fIsudo\fR\|(@mansectsu@), \fIscript\fR\|(1)
! 394: .SH "AUTHOR"
! 395: .IX Header "AUTHOR"
! 396: Todd C. Miller
! 397: .SH "BUGS"
! 398: .IX Header "BUGS"
! 399: If you feel you have found a bug in \fBsudoreplay\fR, please submit a bug report
! 400: at http://www.sudo.ws/sudo/bugs/
! 401: .SH "SUPPORT"
! 402: .IX Header "SUPPORT"
! 403: Limited free support is available via the sudo-users mailing list,
! 404: see http://www.sudo.ws/mailman/listinfo/sudo\-users to subscribe or
! 405: search the archives.
! 406: .SH "DISCLAIMER"
! 407: .IX Header "DISCLAIMER"
! 408: \&\fBsudoreplay\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
! 409: including, but not limited to, the implied warranties of merchantability
! 410: and fitness for a particular purpose are disclaimed. See the \s-1LICENSE\s0
! 411: file distributed with \fBsudo\fR or http://www.sudo.ws/sudo/license.html
! 412: for complete details.
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sudoreplay.man.in CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc