Annotation of embedaddon/sudo/doc/sudoreplay.man.in, revision 1.1.1.5
1.1.1.3 misho 1: .\" DO NOT EDIT THIS FILE, IT IS NOT THE MASTER!
2: .\" IT IS GENERATED AUTOMATICALLY FROM sudoreplay.mdoc.in
3: .\"
1.1.1.5 ! misho 4: .\" Copyright (c) 2009-2013 Todd C. Miller <Todd.Miller@courtesan.com>
1.1.1.3 misho 5: .\"
1.1 misho 6: .\" Permission to use, copy, modify, and distribute this software for any
7: .\" purpose with or without fee is hereby granted, provided that the above
8: .\" copyright notice and this permission notice appear in all copies.
1.1.1.3 misho 9: .\"
1.1 misho 10: .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11: .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12: .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13: .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14: .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15: .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16: .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17: .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
18: .\"
1.1.1.5 ! misho 19: .TH "SUDOREPLAY" "@mansectsu@" "September 11, 2013" "Sudo @PACKAGE_VERSION@" "System Manager's Manual"
1.1 misho 20: .nh
1.1.1.3 misho 21: .if n .ad l
1.1 misho 22: .SH "NAME"
1.1.1.3 misho 23: \fBsudoreplay\fR
24: \- replay sudo session logs
1.1 misho 25: .SH "SYNOPSIS"
1.1.1.3 misho 26: .HP 11n
27: \fBsudoreplay\fR
28: [\fB\-h\fR]
1.1.1.5 ! misho 29: [\fB\-d\fR\ \fIdir\fR]
1.1.1.3 misho 30: [\fB\-f\fR\ \fIfilter\fR]
1.1.1.5 ! misho 31: [\fB\-m\fR\ \fInum\fR]
! 32: [\fB\-s\fR\ \fInum\fR]
1.1.1.3 misho 33: ID
34: .HP 11n
35: \fBsudoreplay\fR
36: [\fB\-h\fR]
1.1.1.5 ! misho 37: [\fB\-d\fR\ \fIdir\fR]
1.1.1.3 misho 38: \fB\-l\fR
39: [search expression]
1.1 misho 40: .SH "DESCRIPTION"
1.1.1.3 misho 41: \fBsudoreplay\fR
42: plays back or lists the output logs created by
43: \fBsudo\fR.
44: When replaying,
45: \fBsudoreplay\fR
46: can play the session back in real-time, or the playback speed may be
47: adjusted (faster or slower) based on the command line options.
48: .PP
49: The
50: \fIID\fR
51: should either be a six character sequence of digits and
52: upper case letters, e.g.\&
53: \fR0100A5\fR,
54: or a pattern matching the
55: \fIiolog_file\fR
56: option in the
57: \fIsudoers\fR
58: file.
59: When a command is run via
60: \fBsudo\fR
61: with
62: \fIlog_output\fR
63: enabled in the
64: \fIsudoers\fR
65: file, a
66: \fRTSID=ID\fR
67: string is logged via syslog or to the
68: \fBsudo\fR
69: log file.
70: The
71: \fIID\fR
72: may also be determined using
73: \fBsudoreplay\fR's
74: list mode.
75: .PP
76: In list mode,
77: \fBsudoreplay\fR
78: can be used to find the ID of a session based on a number of criteria
79: such as the user, tty or command run.
1.1 misho 80: .PP
81: In replay mode, if the standard output has not been redirected,
1.1.1.3 misho 82: \fBsudoreplay\fR
83: will act on the following keys:
84: .TP 14n
85: `\fR\ \fR' (space)
1.1 misho 86: Pause output; press any key to resume.
1.1.1.3 misho 87: .TP 14n
88: `<'
1.1 misho 89: Reduce the playback speed by one half.
1.1.1.3 misho 90: .TP 14n
91: `>'
1.1 misho 92: Double the playback speed.
1.1.1.3 misho 93: .PP
94: The options are as follows:
1.1.1.5 ! misho 95: .TP 12n
! 96: \fB\-d\fR \fIdir\fR, \fB\--directory\fR=\fIdir\fR
! 97: Store session logs in
! 98: \fIdir\fR
! 99: instead of the default,
1.1.1.3 misho 100: \fI@iolog_dir@\fR.
1.1.1.5 ! misho 101: .TP 12n
! 102: \fB\-f\fR \fIfilter\fR, \fB\--filter\fR=\fIfilter\fR
! 103: Select which I/O type(s) to display.
1.1.1.3 misho 104: By default,
105: \fBsudoreplay\fR
1.1.1.5 ! misho 106: will display the command's standard output, standard error and tty output.
1.1.1.3 misho 107: The
108: \fIfilter\fR
109: argument is a comma-separated list, consisting of one or more of following:
110: \fIstdout\fR,
111: \fIstderr\fR,
112: and
113: \fIttyout\fR.
1.1.1.5 ! misho 114: .TP 12n
! 115: \fB\-h\fR, \fB\--help\fR
! 116: Display a short help message to the standard output and exit.
! 117: .TP 12n
! 118: \fB\-l\fR, \fB\--list\fR [\fIsearch expression\fR]
1.1.1.3 misho 119: Enable
120: ``list mode''.
121: In this mode,
122: \fBsudoreplay\fR
123: will list available sessions in a format similar to the
124: \fBsudo\fR
125: log file format, sorted by file name (or sequence number).
126: If a
127: \fIsearch expression\fR
128: is specified, it will be used to restrict the IDs that are displayed.
1.1.1.2 misho 129: An expression is composed of the following predicates:
1.1.1.3 misho 130: .RS
131: .TP 8n
132: command \fIpattern\fR
133: Evaluates to true if the command run matches
134: \fIpattern\fR.
135: On systems with POSIX regular expression support, the pattern may
136: be an extended regular expression.
1.1.1.4 misho 137: On systems without POSIX regular expression support, a simple sub-string
1.1.1.3 misho 138: match is performed instead.
139: .TP 8n
140: cwd \fIdirectory\fR
1.1 misho 141: Evaluates to true if the command was run with the specified current
142: working directory.
1.1.1.3 misho 143: .TP 8n
144: fromdate \fIdate\fR
145: Evaluates to true if the command was run on or after
146: \fIdate\fR.
147: See
148: \fIDate and time format\fR
149: for a description of supported date and time formats.
150: .TP 8n
151: group \fIrunas_group\fR
1.1 misho 152: Evaluates to true if the command was run with the specified
1.1.1.3 misho 153: \fIrunas_group\fR.
154: Note that unless a
155: \fIrunas_group\fR
156: was explicitly specified when
157: \fBsudo\fR
158: was run this field will be empty in the log.
159: .TP 8n
160: runas \fIrunas_user\fR
161: Evaluates to true if the command was run as the specified
162: \fIrunas_user\fR.
163: Note that
164: \fBsudo\fR
165: runs commands as user
166: \fIroot\fR
167: by default.
168: .TP 8n
169: todate \fIdate\fR
170: Evaluates to true if the command was run on or prior to
171: \fIdate\fR.
172: See
173: \fIDate and time format\fR
174: for a description of supported date and time formats.
175: .TP 8n
176: tty \fItty name\fR
177: Evaluates to true if the command was run on the specified terminal device.
178: The
179: \fItty name\fR
180: should be specified without the
181: \fI/dev/\fR
182: prefix, e.g.\&
183: \fItty01\fR
184: instead of
185: \fI/dev/tty01\fR.
186: .TP 8n
187: user \fIuser name\fR
188: Evaluates to true if the ID matches a command run by
189: \fIuser name\fR.
190: .PP
1.1 misho 191: Predicates may be abbreviated to the shortest unique string (currently
192: all predicates may be shortened to a single character).
1.1.1.3 misho 193: .sp
194: Predicates may be combined using
195: \fIand\fR,
196: \fIor\fR
197: and
198: \fI\&!\fR
199: operators as well as
200: `\&('
201: and
202: `\&)'
203: grouping (note that parentheses must generally be escaped from the shell).
204: The
205: \fIand\fR
206: operator is optional, adjacent predicates have an implied
207: \fIand\fR
208: unless separated by an
209: \fIor\fR.
210: .PP
1.1 misho 211: .RE
1.1.1.3 misho 212: .PD 0
1.1.1.5 ! misho 213: .TP 12n
! 214: \fB\-m\fR, \fB\--max-wait\fR \fImax_wait\fR
1.1.1.3 misho 215: Specify an upper bound on how long to wait between key presses or output data.
216: By default,
217: \fBsudoreplay\fR
218: will accurately reproduce the delays between key presses or program output.
219: However, this can be tedious when the session includes long pauses.
220: When the
221: \fB\-m\fR
222: option is specified,
223: \fBsudoreplay\fR
224: will limit these pauses to at most
225: \fImax_wait\fR
226: seconds.
227: The value may be specified as a floating point number, e.g.\&
228: \fI2.5\fR.
229: .PD
1.1.1.5 ! misho 230: .TP 12n
! 231: \fB\-s\fR, \fB\--speed\fR \fIspeed_factor\fR
1.1.1.3 misho 232: This option causes
233: \fBsudoreplay\fR
234: to adjust the number of seconds it will wait between key presses or
235: program output.
236: This can be used to slow down or speed up the display.
237: For example, a
238: \fIspeed_factor\fR
239: of
240: \fI2\fR
241: would make the output twice as fast whereas a
242: \fIspeed_factor\fR
243: of
244: \fI.5\fR
245: would make the output twice as slow.
1.1.1.5 ! misho 246: .TP 12n
! 247: \fB\-V\fR, \fB\--version\fR
! 248: Print the
1.1.1.3 misho 249: \fBsudoreplay\fR
1.1.1.5 ! misho 250: versions version number and exit.
1.1 misho 251: .SS "Date and time format"
252: The time and date may be specified multiple ways, common formats include:
1.1.1.3 misho 253: .TP 8n
254: HH:MM:SS am MM/DD/CCYY timezone
1.1 misho 255: 24 hour time may be used in place of am/pm.
1.1.1.3 misho 256: .TP 8n
257: HH:MM:SS am Month, Day Year timezone
1.1 misho 258: 24 hour time may be used in place of am/pm, and month and day names
1.1.1.3 misho 259: may be abbreviated.
260: Note that month and day of the week names must be specified in English.
261: .TP 8n
262: CCYY-MM-DD HH:MM:SS
263: ISO time format
264: .TP 8n
265: DD Month CCYY HH:MM:SS
1.1 misho 266: The month name may be abbreviated.
267: .PP
1.1.1.3 misho 268: Either time or date may be omitted, the am/pm and timezone are optional.
269: If no date is specified, the current day is assumed; if no time is
270: specified, the first second of the specified date is used.
271: The less significant parts of both time and date may also be omitted,
272: in which case zero is assumed.
1.1 misho 273: .PP
274: The following are all valid time and date specifications:
1.1.1.3 misho 275: .TP 8n
276: now
1.1 misho 277: The current time and date.
1.1.1.3 misho 278: .TP 8n
279: tomorrow
1.1 misho 280: Exactly one day from now.
1.1.1.3 misho 281: .TP 8n
282: yesterday
1.1 misho 283: 24 hours ago.
1.1.1.3 misho 284: .TP 8n
285: 2 hours ago
1.1 misho 286: 2 hours ago.
1.1.1.3 misho 287: .TP 8n
288: next Friday
1.1.1.5 ! misho 289: The first second of the Friday in the next (upcoming) week.
! 290: Not to be confused with
! 291: ``this friday''
! 292: which would match the friday of the current week.
! 293: .TP 8n
! 294: last week
! 295: The current time but 7 days ago.
! 296: This is equivalent to
! 297: ``a week ago''.
1.1.1.3 misho 298: .TP 8n
299: a fortnight ago
1.1 misho 300: The current time but 14 days ago.
1.1.1.3 misho 301: .TP 8n
302: 10:01 am 9/17/2009
1.1 misho 303: 10:01 am, September 17, 2009.
1.1.1.3 misho 304: .TP 8n
305: 10:01 am
1.1 misho 306: 10:01 am on the current day.
1.1.1.3 misho 307: .TP 8n
308: 10
1.1 misho 309: 10:00 am on the current day.
1.1.1.3 misho 310: .TP 8n
311: 9/17/2009
1.1 misho 312: 00:00 am, September 17, 2009.
1.1.1.3 misho 313: .TP 8n
314: 10:01 am Sep 17, 2009
1.1 misho 315: 10:01 am, September 17, 2009.
1.1.1.5 ! misho 316: .PP
! 317: Note that relative time specifications do not always work as expected.
! 318: For example, the
! 319: ``next''
! 320: qualifier is intended to be used in conjunction with a day such as
! 321: ``next Monday''.
! 322: When used with units of weeks, months, years, etc
! 323: the result will be one more than expected.
! 324: For example,
! 325: ``next week''
! 326: will result in a time exactly two weeks from now, which is probably
! 327: not what was intended.
! 328: This will be addressed in a future version of
! 329: \fBsudoreplay\fR.
1.1 misho 330: .SH "FILES"
1.1.1.3 misho 331: .TP 26n
332: \fI@iolog_dir@\fR
1.1 misho 333: The default I/O log directory.
1.1.1.3 misho 334: .TP 26n
335: \fI@iolog_dir@/00/00/01/log\fR
1.1 misho 336: Example session log info.
1.1.1.3 misho 337: .TP 26n
338: \fI@iolog_dir@/00/00/01/stdin\fR
1.1 misho 339: Example session standard input log.
1.1.1.3 misho 340: .TP 26n
341: \fI@iolog_dir@/00/00/01/stdout\fR
1.1 misho 342: Example session standard output log.
1.1.1.3 misho 343: .TP 26n
344: \fI@iolog_dir@/00/00/01/stderr\fR
1.1 misho 345: Example session standard error log.
1.1.1.3 misho 346: .TP 26n
347: \fI@iolog_dir@/00/00/01/ttyin\fR
1.1 misho 348: Example session tty input file.
1.1.1.3 misho 349: .TP 26n
350: \fI@iolog_dir@/00/00/01/ttyout\fR
1.1 misho 351: Example session tty output file.
1.1.1.3 misho 352: .TP 26n
353: \fI@iolog_dir@/00/00/01/timing\fR
1.1 misho 354: Example session timing file.
355: .PP
1.1.1.3 misho 356: Note that the
357: \fIstdin\fR,
358: \fIstdout\fR
359: and
360: \fIstderr\fR
361: files will be empty unless
362: \fBsudo\fR
363: was used as part of a pipeline for a particular command.
1.1 misho 364: .SH "EXAMPLES"
1.1.1.3 misho 365: List sessions run by user
366: \fImillert\fR:
367: .nf
368: .sp
369: .RS 6n
370: # sudoreplay -l user millert
371: .RE
372: .fi
1.1 misho 373: .PP
1.1.1.3 misho 374: List sessions run by user
375: \fIbob\fR
376: with a command containing the string vi:
377: .nf
378: .sp
379: .RS 6n
380: # sudoreplay -l user bob command vi
381: .RE
382: .fi
1.1 misho 383: .PP
1.1.1.3 misho 384: List sessions run by user
385: \fIjeff\fR
386: that match a regular expression:
387: .nf
388: .sp
389: .RS 6n
390: # sudoreplay -l user jeff command '/bin/[a-z]*sh'
391: .RE
392: .fi
1.1 misho 393: .PP
394: List sessions run by jeff or bob on the console:
1.1.1.3 misho 395: .nf
396: .sp
397: .RS 6n
398: # sudoreplay -l ( user jeff or user bob ) tty console
399: .RE
400: .fi
1.1 misho 401: .SH "SEE ALSO"
1.1.1.3 misho 402: sudo(@mansectsu@),
403: script(1)
404: .SH "AUTHORS"
1.1 misho 405: Todd C. Miller
406: .SH "BUGS"
1.1.1.3 misho 407: If you feel you have found a bug in
408: \fBsudoreplay\fR,
409: please submit a bug report at http://www.sudo.ws/sudo/bugs/
1.1 misho 410: .SH "SUPPORT"
411: Limited free support is available via the sudo-users mailing list,
1.1.1.3 misho 412: see http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or
1.1 misho 413: search the archives.
414: .SH "DISCLAIMER"
1.1.1.3 misho 415: \fBsudoreplay\fR
416: is provided
417: ``AS IS''
418: and any express or implied warranties, including, but not limited
419: to, the implied warranties of merchantability and fitness for a
420: particular purpose are disclaimed.
421: See the LICENSE file distributed with
422: \fBsudo\fR
423: or http://www.sudo.ws/sudo/license.html for complete details.
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sudoreplay.man.in CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc