Annotation of embedaddon/sudo/doc/sudoreplay.man.in, revision 1.1.1.2
1.1 misho 1: .\" Copyright (c) 2009-2011 Todd C. Miller <Todd.Miller@courtesan.com>
2: .\"
3: .\" Permission to use, copy, modify, and distribute this software for any
4: .\" purpose with or without fee is hereby granted, provided that the above
5: .\" copyright notice and this permission notice appear in all copies.
6: .\"
7: .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8: .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9: .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
10: .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11: .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
12: .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
13: .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
14: .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
15: .\"
16: .\" Automatically generated by Pod::Man 2.23 (Pod::Simple 3.14)
17: .\"
18: .\" Standard preamble:
19: .\" ========================================================================
20: .de Sp \" Vertical space (when we can't use .PP)
21: .if t .sp .5v
22: .if n .sp
23: ..
24: .de Vb \" Begin verbatim text
25: .ft CW
26: .nf
27: .ne \\$1
28: ..
29: .de Ve \" End verbatim text
30: .ft R
31: .fi
32: ..
33: .\" Set up some character translations and predefined strings. \*(-- will
34: .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
35: .\" double quote, and \*(R" will give a right double quote. \*(C+ will
36: .\" give a nicer C++. Capital omega is used to do unbreakable dashes and
37: .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
38: .\" nothing in troff, for use with C<>.
39: .tr \(*W-
40: .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
41: .ie n \{\
42: . ds -- \(*W-
43: . ds PI pi
44: . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
45: . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
46: . ds L" ""
47: . ds R" ""
48: . ds C`
49: . ds C'
50: 'br\}
51: .el\{\
52: . ds -- \|\(em\|
53: . ds PI \(*p
54: . ds L" ``
55: . ds R" ''
56: 'br\}
57: .\"
58: .\" Escape single quotes in literal strings from groff's Unicode transform.
59: .ie \n(.g .ds Aq \(aq
60: .el .ds Aq '
61: .\"
62: .\" If the F register is turned on, we'll generate index entries on stderr for
63: .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
64: .\" entries marked with X<> in POD. Of course, you'll have to process the
65: .\" output yourself in some meaningful fashion.
66: .ie \nF \{\
67: . de IX
68: . tm Index:\\$1\t\\n%\t"\\$2"
69: ..
70: . nr % 0
71: . rr F
72: .\}
73: .el \{\
74: . de IX
75: ..
76: .\}
77: .\"
78: .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
79: .\" Fear. Run. Save yourself. No user-serviceable parts.
80: . \" fudge factors for nroff and troff
81: .if n \{\
82: . ds #H 0
83: . ds #V .8m
84: . ds #F .3m
85: . ds #[ \f1
86: . ds #] \fP
87: .\}
88: .if t \{\
89: . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
90: . ds #V .6m
91: . ds #F 0
92: . ds #[ \&
93: . ds #] \&
94: .\}
95: . \" simple accents for nroff and troff
96: .if n \{\
97: . ds ' \&
98: . ds ` \&
99: . ds ^ \&
100: . ds , \&
101: . ds ~ ~
102: . ds /
103: .\}
104: .if t \{\
105: . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
106: . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
107: . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
108: . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
109: . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
110: . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
111: .\}
112: . \" troff and (daisy-wheel) nroff accents
113: .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
114: .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
115: .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
116: .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
117: .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
118: .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
119: .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
120: .ds ae a\h'-(\w'a'u*4/10)'e
121: .ds Ae A\h'-(\w'A'u*4/10)'E
122: . \" corrections for vroff
123: .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
124: .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
125: . \" for low resolution devices (crt and lpr)
126: .if \n(.H>23 .if \n(.V>19 \
127: \{\
128: . ds : e
129: . ds 8 ss
130: . ds o a
131: . ds d- d\h'-1'\(ga
132: . ds D- D\h'-1'\(hy
133: . ds th \o'bp'
134: . ds Th \o'LP'
135: . ds ae ae
136: . ds Ae AE
137: .\}
138: .rm #[ #] #H #V #F C
139: .\" ========================================================================
140: .\"
141: .IX Title "SUDOREPLAY @mansectsu@"
1.1.1.2 ! misho 142: .TH SUDOREPLAY @mansectsu@ "April 16, 2012" "1.8.5" "MAINTENANCE COMMANDS"
1.1 misho 143: .\" For nroff, turn off justification. Always turn off hyphenation; it makes
144: .\" way too many mistakes in technical documents.
145: .if n .ad l
146: .nh
147: .SH "NAME"
148: sudoreplay \- replay sudo session logs
149: .SH "SYNOPSIS"
150: .IX Header "SYNOPSIS"
151: \&\fBsudoreplay\fR [\fB\-h\fR] [\fB\-d\fR \fIdirectory\fR] [\fB\-f\fR \fIfilter\fR] [\fB\-m\fR \fImax_wait\fR] [\fB\-s\fR \fIspeed_factor\fR] \s-1ID\s0
152: .PP
153: \&\fBsudoreplay\fR [\fB\-h\fR] [\fB\-d\fR \fIdirectory\fR] \-l [search expression]
154: .SH "DESCRIPTION"
155: .IX Header "DESCRIPTION"
156: \&\fBsudoreplay\fR plays back or lists the output logs created by \fBsudo\fR.
157: When replaying, \fBsudoreplay\fR can play the session back in real-time,
158: or the playback speed may be adjusted (faster or slower) based on
159: the command line options.
160: .PP
161: The \fI\s-1ID\s0\fR should either be a six character sequence of digits and
162: upper case letters, e.g. \f(CW\*(C`0100A5\*(C'\fR, or a pattern matching the
163: \&\fIiolog_file\fR option in the \fIsudoers\fR file. When a command is run
164: via \fBsudo\fR with \fIlog_output\fR enabled in the \fIsudoers\fR file, a
165: \&\f(CW\*(C`TSID=ID\*(C'\fR string is logged via syslog or to the \fBsudo\fR log file.
166: The \fI\s-1ID\s0\fR may also be determined using \fBsudoreplay\fR's list mode.
167: .PP
168: In list mode, \fBsudoreplay\fR can be used to find the \s-1ID\s0 of a session
169: based on a number of criteria such as the user, tty or command run.
170: .PP
171: In replay mode, if the standard output has not been redirected,
172: \&\fBsudoreplay\fR will act on the following keys:
173: .IP "' ' (space)" 8
174: .IX Item "' ' (space)"
175: Pause output; press any key to resume.
176: .IP "'<'" 8
177: Reduce the playback speed by one half.
178: .IP "'>'" 8
179: Double the playback speed.
180: .SH "OPTIONS"
181: .IX Header "OPTIONS"
182: \&\fBsudoreplay\fR accepts the following command line options:
183: .IP "\-d \fIdirectory\fR" 12
184: .IX Item "-d directory"
185: Use \fIdirectory\fR to for the session logs instead of the default,
186: \&\fI/var/log/sudo\-io\fR.
187: .IP "\-f \fIfilter\fR" 12
188: .IX Item "-f filter"
189: By default, \fBsudoreplay\fR will play back the command's standard
190: output, standard error and tty output. The \fI\-f\fR option can be
191: used to select which of these to output. The \fIfilter\fR argument
192: is a comma-separated list, consisting of one or more of following:
193: \&\fIstdout\fR, \fIstderr\fR, and \fIttyout\fR.
194: .IP "\-h" 12
195: .IX Item "-h"
196: The \fB\-h\fR (\fIhelp\fR) option causes \fBsudoreplay\fR to print a short
197: help message to the standard output and exit.
198: .IP "\-l [\fIsearch expression\fR]" 12
199: .IX Item "-l [search expression]"
200: Enable \*(L"list mode\*(R". In this mode, \fBsudoreplay\fR will list available
1.1.1.2 ! misho 201: sessions in a format similar to the \fBsudo\fR log file format, sorted
! 202: by file name (or sequence number). If a \fIsearch expression\fR is
! 203: specified, it will be used to restrict the IDs that are displayed.
! 204: An expression is composed of the following predicates:
1.1 misho 205: .RS 12
206: .IP "command \fIcommand pattern\fR" 8
207: .IX Item "command command pattern"
208: Evaluates to true if the command run matches \fIcommand pattern\fR.
209: On systems with \s-1POSIX\s0 regular expression support, the pattern may
210: be an extended regular expression. On systems without \s-1POSIX\s0 regular
211: expression support, a simple substring match is performed instead.
212: .IP "cwd \fIdirectory\fR" 8
213: .IX Item "cwd directory"
214: Evaluates to true if the command was run with the specified current
215: working directory.
216: .IP "fromdate \fIdate\fR" 8
217: .IX Item "fromdate date"
218: Evaluates to true if the command was run on or after \fIdate\fR.
219: See \*(L"Date and time format\*(R" for a description of supported
220: date and time formats.
221: .IP "group \fIrunas_group\fR" 8
222: .IX Item "group runas_group"
223: Evaluates to true if the command was run with the specified
224: \&\fIrunas_group\fR. Note that unless a \fIrunas_group\fR was explicitly
225: specified when \fBsudo\fR was run this field will be empty in the log.
226: .IP "runas \fIrunas_user\fR" 8
227: .IX Item "runas runas_user"
228: Evaluates to true if the command was run as the specified \fIrunas_user\fR.
229: Note that \fBsudo\fR runs commands as user \fIroot\fR by default.
230: .IP "todate \fIdate\fR" 8
231: .IX Item "todate date"
232: Evaluates to true if the command was run on or prior to \fIdate\fR.
233: See \*(L"Date and time format\*(R" for a description of supported
234: date and time formats.
235: .IP "tty \fItty\fR" 8
236: .IX Item "tty tty"
237: Evaluates to true if the command was run on the specified terminal
238: device. The \fItty\fR should be specified without the \fI/dev/\fR prefix,
239: e.g. \fItty01\fR instead of \fI/dev/tty01\fR.
240: .IP "user \fIuser name\fR" 8
241: .IX Item "user user name"
242: Evaluates to true if the \s-1ID\s0 matches a command run by \fIuser name\fR.
243: .RE
244: .RS 12
245: .Sp
246: Predicates may be abbreviated to the shortest unique string (currently
247: all predicates may be shortened to a single character).
248: .Sp
249: Predicates may be combined using \fIand\fR, \fIor\fR and \fI!\fR operators
250: as well as \f(CW\*(Aq(\*(Aq\fR and \f(CW\*(Aq)\*(Aq\fR for grouping (note that parentheses
251: must generally be escaped from the shell). The \fIand\fR operator is
252: optional, adjacent predicates have an implied \fIand\fR unless separated
253: by an \fIor\fR.
254: .RE
255: .IP "\-m \fImax_wait\fR" 12
256: .IX Item "-m max_wait"
257: Specify an upper bound on how long to wait between key presses or
258: output data. By default, \fBsudo_replay\fR will accurately reproduce
259: the delays between key presses or program output. However, this
260: can be tedious when the session includes long pauses. When the
261: \&\fI\-m\fR option is specified, \fBsudoreplay\fR will limit these pauses
262: to at most \fImax_wait\fR seconds. The value may be specified as a
263: floating point number, .e.g. \fI2.5\fR.
264: .IP "\-s \fIspeed_factor\fR" 12
265: .IX Item "-s speed_factor"
266: This option causes \fBsudoreplay\fR to adjust the number of seconds
267: it will wait between key presses or program output. This can be
268: used to slow down or speed up the display. For example, a
269: \&\fIspeed_factor\fR of \fI2\fR would make the output twice as fast whereas
270: a \fIspeed_factor\fR of <.5> would make the output twice as slow.
271: .IP "\-V" 12
272: .IX Item "-V"
273: The \fB\-V\fR (version) option causes \fBsudoreplay\fR to print its version number
274: and exit.
275: .SS "Date and time format"
276: .IX Subsection "Date and time format"
277: The time and date may be specified multiple ways, common formats include:
278: .IP "\s-1HH:MM:SS\s0 am \s-1MM/DD/CCYY\s0 timezone" 8
279: .IX Item "HH:MM:SS am MM/DD/CCYY timezone"
280: 24 hour time may be used in place of am/pm.
281: .IP "\s-1HH:MM:SS\s0 am Month, Day Year timezone" 8
282: .IX Item "HH:MM:SS am Month, Day Year timezone"
283: 24 hour time may be used in place of am/pm, and month and day names
284: may be abbreviated. Note that month and day of the week names must
285: be specified in English.
286: .IP "CCYY-MM-DD \s-1HH:MM:SS\s0" 8
287: .IX Item "CCYY-MM-DD HH:MM:SS"
288: \&\s-1ISO\s0 time format
289: .IP "\s-1DD\s0 Month \s-1CCYY\s0 \s-1HH:MM:SS\s0" 8
290: .IX Item "DD Month CCYY HH:MM:SS"
291: The month name may be abbreviated.
292: .PP
293: Either time or date may be omitted, the am/pm and timezone are
294: optional. If no date is specified, the current day is assumed; if
295: no time is specified, the first second of the specified date is
296: used. The less significant parts of both time and date may also
297: be omitted, in which case zero is assumed. For example, the following
298: are all valid:
299: .PP
300: The following are all valid time and date specifications:
301: .IP "now" 8
302: .IX Item "now"
303: The current time and date.
304: .IP "tomorrow" 8
305: .IX Item "tomorrow"
306: Exactly one day from now.
307: .IP "yesterday" 8
308: .IX Item "yesterday"
309: 24 hours ago.
310: .IP "2 hours ago" 8
311: .IX Item "2 hours ago"
312: 2 hours ago.
313: .IP "next Friday" 8
314: .IX Item "next Friday"
315: The first second of the next Friday.
316: .IP "this week" 8
317: .IX Item "this week"
318: The current time but the first day of the coming week.
319: .IP "a fortnight ago" 8
320: .IX Item "a fortnight ago"
321: The current time but 14 days ago.
322: .IP "10:01 am 9/17/2009" 8
323: .IX Item "10:01 am 9/17/2009"
324: 10:01 am, September 17, 2009.
325: .IP "10:01 am" 8
326: .IX Item "10:01 am"
327: 10:01 am on the current day.
328: .IP "10" 8
329: .IX Item "10"
330: 10:00 am on the current day.
331: .IP "9/17/2009" 8
332: .IX Item "9/17/2009"
333: 00:00 am, September 17, 2009.
334: .IP "10:01 am Sep 17, 2009" 8
335: .IX Item "10:01 am Sep 17, 2009"
336: 10:01 am, September 17, 2009.
337: .SH "FILES"
338: .IX Header "FILES"
339: .IP "\fI/var/log/sudo\-io\fR" 24
340: .IX Item "/var/log/sudo-io"
341: The default I/O log directory.
342: .IP "\fI/var/log/sudo\-io/00/00/01/log\fR" 24
343: .IX Item "/var/log/sudo-io/00/00/01/log"
344: Example session log info.
345: .IP "\fI/var/log/sudo\-io/00/00/01/stdin\fR" 24
346: .IX Item "/var/log/sudo-io/00/00/01/stdin"
347: Example session standard input log.
348: .IP "\fI/var/log/sudo\-io/00/00/01/stdout\fR" 24
349: .IX Item "/var/log/sudo-io/00/00/01/stdout"
350: Example session standard output log.
351: .IP "\fI/var/log/sudo\-io/00/00/01/stderr\fR" 24
352: .IX Item "/var/log/sudo-io/00/00/01/stderr"
353: Example session standard error log.
354: .IP "\fI/var/log/sudo\-io/00/00/01/ttyin\fR" 24
355: .IX Item "/var/log/sudo-io/00/00/01/ttyin"
356: Example session tty input file.
357: .IP "\fI/var/log/sudo\-io/00/00/01/ttyout\fR" 24
358: .IX Item "/var/log/sudo-io/00/00/01/ttyout"
359: Example session tty output file.
360: .IP "\fI/var/log/sudo\-io/00/00/01/timing\fR" 24
361: .IX Item "/var/log/sudo-io/00/00/01/timing"
362: Example session timing file.
363: .PP
364: Note that the \fIstdin\fR, \fIstdout\fR and \fIstderr\fR files will be empty
365: unless \fBsudo\fR was used as part of a pipeline for a particular
366: command.
367: .SH "EXAMPLES"
368: .IX Header "EXAMPLES"
369: List sessions run by user \fImillert\fR:
370: .PP
371: .Vb 1
372: \& sudoreplay \-l user millert
373: .Ve
374: .PP
375: List sessions run by user \fIbob\fR with a command containing the string vi:
376: .PP
377: .Vb 1
378: \& sudoreplay \-l user bob command vi
379: .Ve
380: .PP
381: List sessions run by user \fIjeff\fR that match a regular expression:
382: .PP
383: .Vb 1
384: \& sudoreplay \-l user jeff command \*(Aq/bin/[a\-z]*sh\*(Aq
385: .Ve
386: .PP
387: List sessions run by jeff or bob on the console:
388: .PP
389: .Vb 1
390: \& sudoreplay \-l ( user jeff or user bob ) tty console
391: .Ve
392: .SH "SEE ALSO"
393: .IX Header "SEE ALSO"
394: \&\fIsudo\fR\|(@mansectsu@), \fIscript\fR\|(1)
395: .SH "AUTHOR"
396: .IX Header "AUTHOR"
397: Todd C. Miller
398: .SH "BUGS"
399: .IX Header "BUGS"
400: If you feel you have found a bug in \fBsudoreplay\fR, please submit a bug report
401: at http://www.sudo.ws/sudo/bugs/
402: .SH "SUPPORT"
403: .IX Header "SUPPORT"
404: Limited free support is available via the sudo-users mailing list,
405: see http://www.sudo.ws/mailman/listinfo/sudo\-users to subscribe or
406: search the archives.
407: .SH "DISCLAIMER"
408: .IX Header "DISCLAIMER"
409: \&\fBsudoreplay\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
410: including, but not limited to, the implied warranties of merchantability
411: and fitness for a particular purpose are disclaimed. See the \s-1LICENSE\s0
412: file distributed with \fBsudo\fR or http://www.sudo.ws/sudo/license.html
413: for complete details.
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sudoreplay.man.in CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc