1: .\" Copyright (c) 2009-2011 Todd C. Miller <Todd.Miller@courtesan.com>
2: .\"
3: .\" Permission to use, copy, modify, and distribute this software for any
4: .\" purpose with or without fee is hereby granted, provided that the above
5: .\" copyright notice and this permission notice appear in all copies.
6: .\"
7: .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8: .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9: .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
10: .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11: .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
12: .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
13: .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
14: .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
15: .\"
16: .\" Automatically generated by Pod::Man 2.23 (Pod::Simple 3.14)
17: .\"
18: .\" Standard preamble:
19: .\" ========================================================================
20: .de Sp \" Vertical space (when we can't use .PP)
21: .if t .sp .5v
22: .if n .sp
23: ..
24: .de Vb \" Begin verbatim text
25: .ft CW
26: .nf
27: .ne \\$1
28: ..
29: .de Ve \" End verbatim text
30: .ft R
31: .fi
32: ..
33: .\" Set up some character translations and predefined strings. \*(-- will
34: .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
35: .\" double quote, and \*(R" will give a right double quote. \*(C+ will
36: .\" give a nicer C++. Capital omega is used to do unbreakable dashes and
37: .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
38: .\" nothing in troff, for use with C<>.
39: .tr \(*W-
40: .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
41: .ie n \{\
42: . ds -- \(*W-
43: . ds PI pi
44: . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
45: . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
46: . ds L" ""
47: . ds R" ""
48: . ds C`
49: . ds C'
50: 'br\}
51: .el\{\
52: . ds -- \|\(em\|
53: . ds PI \(*p
54: . ds L" ``
55: . ds R" ''
56: 'br\}
57: .\"
58: .\" Escape single quotes in literal strings from groff's Unicode transform.
59: .ie \n(.g .ds Aq \(aq
60: .el .ds Aq '
61: .\"
62: .\" If the F register is turned on, we'll generate index entries on stderr for
63: .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
64: .\" entries marked with X<> in POD. Of course, you'll have to process the
65: .\" output yourself in some meaningful fashion.
66: .ie \nF \{\
67: . de IX
68: . tm Index:\\$1\t\\n%\t"\\$2"
69: ..
70: . nr % 0
71: . rr F
72: .\}
73: .el \{\
74: . de IX
75: ..
76: .\}
77: .\"
78: .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
79: .\" Fear. Run. Save yourself. No user-serviceable parts.
80: . \" fudge factors for nroff and troff
81: .if n \{\
82: . ds #H 0
83: . ds #V .8m
84: . ds #F .3m
85: . ds #[ \f1
86: . ds #] \fP
87: .\}
88: .if t \{\
89: . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
90: . ds #V .6m
91: . ds #F 0
92: . ds #[ \&
93: . ds #] \&
94: .\}
95: . \" simple accents for nroff and troff
96: .if n \{\
97: . ds ' \&
98: . ds ` \&
99: . ds ^ \&
100: . ds , \&
101: . ds ~ ~
102: . ds /
103: .\}
104: .if t \{\
105: . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
106: . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
107: . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
108: . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
109: . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
110: . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
111: .\}
112: . \" troff and (daisy-wheel) nroff accents
113: .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
114: .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
115: .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
116: .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
117: .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
118: .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
119: .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
120: .ds ae a\h'-(\w'a'u*4/10)'e
121: .ds Ae A\h'-(\w'A'u*4/10)'E
122: . \" corrections for vroff
123: .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
124: .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
125: . \" for low resolution devices (crt and lpr)
126: .if \n(.H>23 .if \n(.V>19 \
127: \{\
128: . ds : e
129: . ds 8 ss
130: . ds o a
131: . ds d- d\h'-1'\(ga
132: . ds D- D\h'-1'\(hy
133: . ds th \o'bp'
134: . ds Th \o'LP'
135: . ds ae ae
136: . ds Ae AE
137: .\}
138: .rm #[ #] #H #V #F C
139: .\" ========================================================================
140: .\"
141: .IX Title "SUDOREPLAY @mansectsu@"
142: .TH SUDOREPLAY @mansectsu@ "September 16, 2011" "1.8.3" "MAINTENANCE COMMANDS"
143: .\" For nroff, turn off justification. Always turn off hyphenation; it makes
144: .\" way too many mistakes in technical documents.
145: .if n .ad l
146: .nh
147: .SH "NAME"
148: sudoreplay \- replay sudo session logs
149: .SH "SYNOPSIS"
150: .IX Header "SYNOPSIS"
151: \&\fBsudoreplay\fR [\fB\-h\fR] [\fB\-d\fR \fIdirectory\fR] [\fB\-f\fR \fIfilter\fR] [\fB\-m\fR \fImax_wait\fR] [\fB\-s\fR \fIspeed_factor\fR] \s-1ID\s0
152: .PP
153: \&\fBsudoreplay\fR [\fB\-h\fR] [\fB\-d\fR \fIdirectory\fR] \-l [search expression]
154: .SH "DESCRIPTION"
155: .IX Header "DESCRIPTION"
156: \&\fBsudoreplay\fR plays back or lists the output logs created by \fBsudo\fR.
157: When replaying, \fBsudoreplay\fR can play the session back in real-time,
158: or the playback speed may be adjusted (faster or slower) based on
159: the command line options.
160: .PP
161: The \fI\s-1ID\s0\fR should either be a six character sequence of digits and
162: upper case letters, e.g. \f(CW\*(C`0100A5\*(C'\fR, or a pattern matching the
163: \&\fIiolog_file\fR option in the \fIsudoers\fR file. When a command is run
164: via \fBsudo\fR with \fIlog_output\fR enabled in the \fIsudoers\fR file, a
165: \&\f(CW\*(C`TSID=ID\*(C'\fR string is logged via syslog or to the \fBsudo\fR log file.
166: The \fI\s-1ID\s0\fR may also be determined using \fBsudoreplay\fR's list mode.
167: .PP
168: In list mode, \fBsudoreplay\fR can be used to find the \s-1ID\s0 of a session
169: based on a number of criteria such as the user, tty or command run.
170: .PP
171: In replay mode, if the standard output has not been redirected,
172: \&\fBsudoreplay\fR will act on the following keys:
173: .IP "' ' (space)" 8
174: .IX Item "' ' (space)"
175: Pause output; press any key to resume.
176: .IP "'<'" 8
177: Reduce the playback speed by one half.
178: .IP "'>'" 8
179: Double the playback speed.
180: .SH "OPTIONS"
181: .IX Header "OPTIONS"
182: \&\fBsudoreplay\fR accepts the following command line options:
183: .IP "\-d \fIdirectory\fR" 12
184: .IX Item "-d directory"
185: Use \fIdirectory\fR to for the session logs instead of the default,
186: \&\fI/var/log/sudo\-io\fR.
187: .IP "\-f \fIfilter\fR" 12
188: .IX Item "-f filter"
189: By default, \fBsudoreplay\fR will play back the command's standard
190: output, standard error and tty output. The \fI\-f\fR option can be
191: used to select which of these to output. The \fIfilter\fR argument
192: is a comma-separated list, consisting of one or more of following:
193: \&\fIstdout\fR, \fIstderr\fR, and \fIttyout\fR.
194: .IP "\-h" 12
195: .IX Item "-h"
196: The \fB\-h\fR (\fIhelp\fR) option causes \fBsudoreplay\fR to print a short
197: help message to the standard output and exit.
198: .IP "\-l [\fIsearch expression\fR]" 12
199: .IX Item "-l [search expression]"
200: Enable \*(L"list mode\*(R". In this mode, \fBsudoreplay\fR will list available
201: session IDs. If a \fIsearch expression\fR is specified, it will be
202: used to restrict the IDs that are displayed. An expression is
203: composed of the following predicates:
204: .RS 12
205: .IP "command \fIcommand pattern\fR" 8
206: .IX Item "command command pattern"
207: Evaluates to true if the command run matches \fIcommand pattern\fR.
208: On systems with \s-1POSIX\s0 regular expression support, the pattern may
209: be an extended regular expression. On systems without \s-1POSIX\s0 regular
210: expression support, a simple substring match is performed instead.
211: .IP "cwd \fIdirectory\fR" 8
212: .IX Item "cwd directory"
213: Evaluates to true if the command was run with the specified current
214: working directory.
215: .IP "fromdate \fIdate\fR" 8
216: .IX Item "fromdate date"
217: Evaluates to true if the command was run on or after \fIdate\fR.
218: See \*(L"Date and time format\*(R" for a description of supported
219: date and time formats.
220: .IP "group \fIrunas_group\fR" 8
221: .IX Item "group runas_group"
222: Evaluates to true if the command was run with the specified
223: \&\fIrunas_group\fR. Note that unless a \fIrunas_group\fR was explicitly
224: specified when \fBsudo\fR was run this field will be empty in the log.
225: .IP "runas \fIrunas_user\fR" 8
226: .IX Item "runas runas_user"
227: Evaluates to true if the command was run as the specified \fIrunas_user\fR.
228: Note that \fBsudo\fR runs commands as user \fIroot\fR by default.
229: .IP "todate \fIdate\fR" 8
230: .IX Item "todate date"
231: Evaluates to true if the command was run on or prior to \fIdate\fR.
232: See \*(L"Date and time format\*(R" for a description of supported
233: date and time formats.
234: .IP "tty \fItty\fR" 8
235: .IX Item "tty tty"
236: Evaluates to true if the command was run on the specified terminal
237: device. The \fItty\fR should be specified without the \fI/dev/\fR prefix,
238: e.g. \fItty01\fR instead of \fI/dev/tty01\fR.
239: .IP "user \fIuser name\fR" 8
240: .IX Item "user user name"
241: Evaluates to true if the \s-1ID\s0 matches a command run by \fIuser name\fR.
242: .RE
243: .RS 12
244: .Sp
245: Predicates may be abbreviated to the shortest unique string (currently
246: all predicates may be shortened to a single character).
247: .Sp
248: Predicates may be combined using \fIand\fR, \fIor\fR and \fI!\fR operators
249: as well as \f(CW\*(Aq(\*(Aq\fR and \f(CW\*(Aq)\*(Aq\fR for grouping (note that parentheses
250: must generally be escaped from the shell). The \fIand\fR operator is
251: optional, adjacent predicates have an implied \fIand\fR unless separated
252: by an \fIor\fR.
253: .RE
254: .IP "\-m \fImax_wait\fR" 12
255: .IX Item "-m max_wait"
256: Specify an upper bound on how long to wait between key presses or
257: output data. By default, \fBsudo_replay\fR will accurately reproduce
258: the delays between key presses or program output. However, this
259: can be tedious when the session includes long pauses. When the
260: \&\fI\-m\fR option is specified, \fBsudoreplay\fR will limit these pauses
261: to at most \fImax_wait\fR seconds. The value may be specified as a
262: floating point number, .e.g. \fI2.5\fR.
263: .IP "\-s \fIspeed_factor\fR" 12
264: .IX Item "-s speed_factor"
265: This option causes \fBsudoreplay\fR to adjust the number of seconds
266: it will wait between key presses or program output. This can be
267: used to slow down or speed up the display. For example, a
268: \&\fIspeed_factor\fR of \fI2\fR would make the output twice as fast whereas
269: a \fIspeed_factor\fR of <.5> would make the output twice as slow.
270: .IP "\-V" 12
271: .IX Item "-V"
272: The \fB\-V\fR (version) option causes \fBsudoreplay\fR to print its version number
273: and exit.
274: .SS "Date and time format"
275: .IX Subsection "Date and time format"
276: The time and date may be specified multiple ways, common formats include:
277: .IP "\s-1HH:MM:SS\s0 am \s-1MM/DD/CCYY\s0 timezone" 8
278: .IX Item "HH:MM:SS am MM/DD/CCYY timezone"
279: 24 hour time may be used in place of am/pm.
280: .IP "\s-1HH:MM:SS\s0 am Month, Day Year timezone" 8
281: .IX Item "HH:MM:SS am Month, Day Year timezone"
282: 24 hour time may be used in place of am/pm, and month and day names
283: may be abbreviated. Note that month and day of the week names must
284: be specified in English.
285: .IP "CCYY-MM-DD \s-1HH:MM:SS\s0" 8
286: .IX Item "CCYY-MM-DD HH:MM:SS"
287: \&\s-1ISO\s0 time format
288: .IP "\s-1DD\s0 Month \s-1CCYY\s0 \s-1HH:MM:SS\s0" 8
289: .IX Item "DD Month CCYY HH:MM:SS"
290: The month name may be abbreviated.
291: .PP
292: Either time or date may be omitted, the am/pm and timezone are
293: optional. If no date is specified, the current day is assumed; if
294: no time is specified, the first second of the specified date is
295: used. The less significant parts of both time and date may also
296: be omitted, in which case zero is assumed. For example, the following
297: are all valid:
298: .PP
299: The following are all valid time and date specifications:
300: .IP "now" 8
301: .IX Item "now"
302: The current time and date.
303: .IP "tomorrow" 8
304: .IX Item "tomorrow"
305: Exactly one day from now.
306: .IP "yesterday" 8
307: .IX Item "yesterday"
308: 24 hours ago.
309: .IP "2 hours ago" 8
310: .IX Item "2 hours ago"
311: 2 hours ago.
312: .IP "next Friday" 8
313: .IX Item "next Friday"
314: The first second of the next Friday.
315: .IP "this week" 8
316: .IX Item "this week"
317: The current time but the first day of the coming week.
318: .IP "a fortnight ago" 8
319: .IX Item "a fortnight ago"
320: The current time but 14 days ago.
321: .IP "10:01 am 9/17/2009" 8
322: .IX Item "10:01 am 9/17/2009"
323: 10:01 am, September 17, 2009.
324: .IP "10:01 am" 8
325: .IX Item "10:01 am"
326: 10:01 am on the current day.
327: .IP "10" 8
328: .IX Item "10"
329: 10:00 am on the current day.
330: .IP "9/17/2009" 8
331: .IX Item "9/17/2009"
332: 00:00 am, September 17, 2009.
333: .IP "10:01 am Sep 17, 2009" 8
334: .IX Item "10:01 am Sep 17, 2009"
335: 10:01 am, September 17, 2009.
336: .SH "FILES"
337: .IX Header "FILES"
338: .IP "\fI/var/log/sudo\-io\fR" 24
339: .IX Item "/var/log/sudo-io"
340: The default I/O log directory.
341: .IP "\fI/var/log/sudo\-io/00/00/01/log\fR" 24
342: .IX Item "/var/log/sudo-io/00/00/01/log"
343: Example session log info.
344: .IP "\fI/var/log/sudo\-io/00/00/01/stdin\fR" 24
345: .IX Item "/var/log/sudo-io/00/00/01/stdin"
346: Example session standard input log.
347: .IP "\fI/var/log/sudo\-io/00/00/01/stdout\fR" 24
348: .IX Item "/var/log/sudo-io/00/00/01/stdout"
349: Example session standard output log.
350: .IP "\fI/var/log/sudo\-io/00/00/01/stderr\fR" 24
351: .IX Item "/var/log/sudo-io/00/00/01/stderr"
352: Example session standard error log.
353: .IP "\fI/var/log/sudo\-io/00/00/01/ttyin\fR" 24
354: .IX Item "/var/log/sudo-io/00/00/01/ttyin"
355: Example session tty input file.
356: .IP "\fI/var/log/sudo\-io/00/00/01/ttyout\fR" 24
357: .IX Item "/var/log/sudo-io/00/00/01/ttyout"
358: Example session tty output file.
359: .IP "\fI/var/log/sudo\-io/00/00/01/timing\fR" 24
360: .IX Item "/var/log/sudo-io/00/00/01/timing"
361: Example session timing file.
362: .PP
363: Note that the \fIstdin\fR, \fIstdout\fR and \fIstderr\fR files will be empty
364: unless \fBsudo\fR was used as part of a pipeline for a particular
365: command.
366: .SH "EXAMPLES"
367: .IX Header "EXAMPLES"
368: List sessions run by user \fImillert\fR:
369: .PP
370: .Vb 1
371: \& sudoreplay \-l user millert
372: .Ve
373: .PP
374: List sessions run by user \fIbob\fR with a command containing the string vi:
375: .PP
376: .Vb 1
377: \& sudoreplay \-l user bob command vi
378: .Ve
379: .PP
380: List sessions run by user \fIjeff\fR that match a regular expression:
381: .PP
382: .Vb 1
383: \& sudoreplay \-l user jeff command \*(Aq/bin/[a\-z]*sh\*(Aq
384: .Ve
385: .PP
386: List sessions run by jeff or bob on the console:
387: .PP
388: .Vb 1
389: \& sudoreplay \-l ( user jeff or user bob ) tty console
390: .Ve
391: .SH "SEE ALSO"
392: .IX Header "SEE ALSO"
393: \&\fIsudo\fR\|(@mansectsu@), \fIscript\fR\|(1)
394: .SH "AUTHOR"
395: .IX Header "AUTHOR"
396: Todd C. Miller
397: .SH "BUGS"
398: .IX Header "BUGS"
399: If you feel you have found a bug in \fBsudoreplay\fR, please submit a bug report
400: at http://www.sudo.ws/sudo/bugs/
401: .SH "SUPPORT"
402: .IX Header "SUPPORT"
403: Limited free support is available via the sudo-users mailing list,
404: see http://www.sudo.ws/mailman/listinfo/sudo\-users to subscribe or
405: search the archives.
406: .SH "DISCLAIMER"
407: .IX Header "DISCLAIMER"
408: \&\fBsudoreplay\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
409: including, but not limited to, the implied warranties of merchantability
410: and fitness for a particular purpose are disclaimed. See the \s-1LICENSE\s0
411: file distributed with \fBsudo\fR or http://www.sudo.ws/sudo/license.html
412: for complete details.
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sudoreplay.man.in CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc