1
SUDOREPLAY(1m) MAINTENANCE COMMANDS SUDOREPLAY(1m)
1
SUDOREPLAY(1m) System Manager's Manual SUDOREPLAY(1m)
6
sudoreplay - replay sudo session logs
4
ssuuddoorreeppllaayy - replay sudo session logs
9
ssuuddoorreeppllaayy [--hh] [--dd _d_i_r_e_c_t_o_r_y] [--ff _f_i_l_t_e_r] [--mm _m_a_x___w_a_i_t] [--ss
10
_s_p_e_e_d___f_a_c_t_o_r] ID
7
ssuuddoorreeppllaayy [--hh] [--dd _d_i_r_e_c_t_o_r_y] [--ff _f_i_l_t_e_r] [--mm _m_a_x___w_a_i_t]
8
[--ss _s_p_e_e_d___f_a_c_t_o_r] ID
12
ssuuddoorreeppllaayy [--hh] [--dd _d_i_r_e_c_t_o_r_y] -l [search expression]
10
ssuuddoorreeppllaayy [--hh] [--dd _d_i_r_e_c_t_o_r_y] --ll [search expression]
14
12
DDEESSCCRRIIPPTTIIOONN
15
ssuuddoorreeppllaayy plays back or lists the output logs created by ssuuddoo. When
16
replaying, ssuuddoorreeppllaayy can play the session back in real-time, or the
17
playback speed may be adjusted (faster or slower) based on the command
20
The _I_D should either be a six character sequence of digits and upper
21
case letters, e.g. 0100A5, or a pattern matching the _i_o_l_o_g___f_i_l_e option
22
in the _s_u_d_o_e_r_s file. When a command is run via ssuuddoo with _l_o_g___o_u_t_p_u_t
23
enabled in the _s_u_d_o_e_r_s file, a TSID=ID string is logged via syslog or
24
to the ssuuddoo log file. The _I_D may also be determined using ssuuddoorreeppllaayy's
27
In list mode, ssuuddoorreeppllaayy can be used to find the ID of a session based
28
on a number of criteria such as the user, tty or command run.
30
In replay mode, if the standard output has not been redirected,
31
ssuuddoorreeppllaayy will act on the following keys:
34
Pause output; press any key to resume.
36
'<' Reduce the playback speed by one half.
38
'>' Double the playback speed.
41
ssuuddoorreeppllaayy accepts the following command line options:
44
Use _d_i_r_e_c_t_o_r_y to for the session logs instead of the
13
ssuuddoorreeppllaayy plays back or lists the output logs created by ssuuddoo. When
14
replaying, ssuuddoorreeppllaayy can play the session back in real-time, or the
15
playback speed may be adjusted (faster or slower) based on the command
18
The _I_D should either be a six character sequence of digits and upper case
19
letters, e.g. 0100A5, or a pattern matching the _i_o_l_o_g___f_i_l_e option in the
20
_s_u_d_o_e_r_s file. When a command is run via ssuuddoo with _l_o_g___o_u_t_p_u_t enabled in
21
the _s_u_d_o_e_r_s file, a TSID=ID string is logged via syslog or to the ssuuddoo
22
log file. The _I_D may also be determined using ssuuddoorreeppllaayy's list mode.
24
In list mode, ssuuddoorreeppllaayy can be used to find the ID of a session based on
25
a number of criteria such as the user, tty or command run.
27
In replay mode, if the standard output has not been redirected,
28
ssuuddoorreeppllaayy will act on the following keys:
30
` ' (space) Pause output; press any key to resume.
32
`<' Reduce the playback speed by one half.
34
`>' Double the playback speed.
36
The options are as follows:
38
--dd _d_i_r_e_c_t_o_r_y Use _d_i_r_e_c_t_o_r_y to for the session logs instead of the
45
39
default, _/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o.
47
-f _f_i_l_t_e_r By default, ssuuddoorreeppllaayy will play back the command's
48
standard output, standard error and tty output. The _-_f
41
--ff _f_i_l_t_e_r By default, ssuuddoorreeppllaayy will play back the command's
42
standard output, standard error and tty output. The --ff
49
43
option can be used to select which of these to output. The
50
44
_f_i_l_t_e_r argument is a comma-separated list, consisting of
51
45
one or more of following: _s_t_d_o_u_t, _s_t_d_e_r_r, and _t_t_y_o_u_t.
53
-h The --hh (_h_e_l_p) option causes ssuuddoorreeppllaayy to print a short
47
--hh The --hh (_h_e_l_p) option causes ssuuddoorreeppllaayy to print a short
54
48
help message to the standard output and exit.
56
-l [_s_e_a_r_c_h _e_x_p_r_e_s_s_i_o_n]
57
Enable "list mode". In this mode, ssuuddoorreeppllaayy will list
50
--ll [_s_e_a_r_c_h _e_x_p_r_e_s_s_i_o_n]
51
Enable ``list mode''. In this mode, ssuuddoorreeppllaayy will list
58
52
available sessions in a format similar to the ssuuddoo log file
59
53
format, sorted by file name (or sequence number). If a
60
54
_s_e_a_r_c_h _e_x_p_r_e_s_s_i_o_n is specified, it will be used to restrict
61
55
the IDs that are displayed. An expression is composed of
62
56
the following predicates:
64
command _c_o_m_m_a_n_d _p_a_t_t_e_r_n
58
command _p_a_t_t_e_r_n
65
59
Evaluates to true if the command run matches
66
_c_o_m_m_a_n_d _p_a_t_t_e_r_n. On systems with POSIX regular
67
expression support, the pattern may be an extended
68
regular expression. On systems without POSIX
69
regular expression support, a simple substring
70
match is performed instead.
60
_p_a_t_t_e_r_n. On systems with POSIX regular expression
61
support, the pattern may be an extended regular
62
expression. On systems without POSIX regular
63
expression support, a simple substring match is
72
66
cwd _d_i_r_e_c_t_o_r_y
73
67
Evaluates to true if the command was run with the
110
105
Predicates may be combined using _a_n_d, _o_r and _! operators as
111
well as '(' and ')' for grouping (note that parentheses
112
must generally be escaped from the shell). The _a_n_d
113
operator is optional, adjacent predicates have an implied
114
_a_n_d unless separated by an _o_r.
106
well as `(' and `)' grouping (note that parentheses must
107
generally be escaped from the shell). The _a_n_d operator is
108
optional, adjacent predicates have an implied _a_n_d unless
109
separated by an _o_r.
116
-m _m_a_x___w_a_i_t Specify an upper bound on how long to wait between key
117
presses or output data. By default, ssuuddoo__rreeppllaayy will
111
--mm _m_a_x___w_a_i_t Specify an upper bound on how long to wait between key
112
presses or output data. By default, ssuuddoorreeppllaayy will
118
113
accurately reproduce the delays between key presses or
119
114
program output. However, this can be tedious when the
120
session includes long pauses. When the _-_m option is
115
session includes long pauses. When the --mm option is
121
116
specified, ssuuddoorreeppllaayy will limit these pauses to at most
122
117
_m_a_x___w_a_i_t seconds. The value may be specified as a floating
123
point number, .e.g. _2_._5.
118
point number, e.g. _2_._5.
125
-s _s_p_e_e_d___f_a_c_t_o_r
120
--ss _s_p_e_e_d___f_a_c_t_o_r
126
121
This option causes ssuuddoorreeppllaayy to adjust the number of
127
122
seconds it will wait between key presses or program output.
128
123
This can be used to slow down or speed up the display. For
129
124
example, a _s_p_e_e_d___f_a_c_t_o_r of _2 would make the output twice as
130
fast whereas a _s_p_e_e_d___f_a_c_t_o_r of <.5> would make the output
125
fast whereas a _s_p_e_e_d___f_a_c_t_o_r of _._5 would make the output
133
-V The --VV (version) option causes ssuuddoorreeppllaayy to print its
128
--VV The --VV (_v_e_r_s_i_o_n) option causes ssuuddoorreeppllaayy to print its
134
129
version number and exit.
136
131
DDaattee aanndd ttiimmee ffoorrmmaatt
137
The time and date may be specified multiple ways, common formats
140
HH:MM:SS am MM/DD/CCYY timezone
141
24 hour time may be used in place of am/pm.
143
HH:MM:SS am Month, Day Year timezone
144
24 hour time may be used in place of am/pm, and month and day
145
names may be abbreviated. Note that month and day of the week
146
names must be specified in English.
151
DD Month CCYY HH:MM:SS
152
The month name may be abbreviated.
154
Either time or date may be omitted, the am/pm and timezone are
155
optional. If no date is specified, the current day is assumed; if no
156
time is specified, the first second of the specified date is used. The
157
less significant parts of both time and date may also be omitted, in
158
which case zero is assumed. For example, the following are all valid:
160
The following are all valid time and date specifications:
162
now The current time and date.
165
Exactly one day from now.
174
The first second of the next Friday.
177
The current time but the first day of the coming week.
180
The current time but 14 days ago.
183
10:01 am, September 17, 2009.
186
10:01 am on the current day.
188
10 10:00 am on the current day.
191
00:00 am, September 17, 2009.
193
10:01 am Sep 17, 2009
194
10:01 am, September 17, 2009.
132
The time and date may be specified multiple ways, common formats include:
134
HH:MM:SS am MM/DD/CCYY timezone
135
24 hour time may be used in place of am/pm.
137
HH:MM:SS am Month, Day Year timezone
138
24 hour time may be used in place of am/pm, and month and day
139
names may be abbreviated. Note that month and day of the week
140
names must be specified in English.
145
DD Month CCYY HH:MM:SS
146
The month name may be abbreviated.
148
Either time or date may be omitted, the am/pm and timezone are optional.
149
If no date is specified, the current day is assumed; if no time is
150
specified, the first second of the specified date is used. The less
151
significant parts of both time and date may also be omitted, in which
152
case zero is assumed.
154
The following are all valid time and date specifications:
156
now The current time and date.
159
Exactly one day from now.
168
The first second of the next Friday.
171
The current time but the first day of the coming week.
174
The current time but 14 days ago.
177
10:01 am, September 17, 2009.
180
10:01 am on the current day.
182
10 10:00 am on the current day.
185
00:00 am, September 17, 2009.
187
10:01 am Sep 17, 2009
188
10:01 am, September 17, 2009.
197
_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o The default I/O log directory.
191
_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o The default I/O log directory.
199
_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_l_o_g
193
_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_l_o_g
200
194
Example session log info.
202
_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_i_n
196
_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_i_n
203
197
Example session standard input log.
205
_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_o_u_t
199
_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_o_u_t
206
200
Example session standard output log.
208
_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_e_r_r
202
_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_s_t_d_e_r_r
209
203
Example session standard error log.
211
_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_t_y_i_n
205
_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_t_y_i_n
212
206
Example session tty input file.
214
_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_t_y_o_u_t
208
_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_t_y_o_u_t
215
209
Example session tty output file.
217
_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_i_m_i_n_g
211
_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o_/_0_0_/_0_0_/_0_1_/_t_i_m_i_n_g
218
212
Example session timing file.
220
Note that the _s_t_d_i_n, _s_t_d_o_u_t and _s_t_d_e_r_r files will be empty unless ssuuddoo
221
was used as part of a pipeline for a particular command.
214
Note that the _s_t_d_i_n, _s_t_d_o_u_t and _s_t_d_e_r_r files will be empty unless ssuuddoo
215
was used as part of a pipeline for a particular command.
224
List sessions run by user _m_i_l_l_e_r_t:
226
sudoreplay -l user millert
228
List sessions run by user _b_o_b with a command containing the string vi:
230
sudoreplay -l user bob command vi
232
List sessions run by user _j_e_f_f that match a regular expression:
234
sudoreplay -l user jeff command '/bin/[a-z]*sh'
236
List sessions run by jeff or bob on the console:
238
sudoreplay -l ( user jeff or user bob ) tty console
218
List sessions run by user _m_i_l_l_e_r_t:
220
# sudoreplay -l user millert
222
List sessions run by user _b_o_b with a command containing the string vi:
224
# sudoreplay -l user bob command vi
226
List sessions run by user _j_e_f_f that match a regular expression:
228
# sudoreplay -l user jeff command '/bin/[a-z]*sh'
230
List sessions run by jeff or bob on the console:
232
# sudoreplay -l ( user jeff or user bob ) tty console
241
_s_u_d_o(1m), _s_c_r_i_p_t(1)
247
If you feel you have found a bug in ssuuddoorreeppllaayy, please submit a bug
248
report at http://www.sudo.ws/sudo/bugs/
241
If you feel you have found a bug in ssuuddoorreeppllaayy, please submit a bug
242
report at http://www.sudo.ws/sudo/bugs/
251
Limited free support is available via the sudo-users mailing list, see
252
http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search
245
Limited free support is available via the sudo-users mailing list, see
246
http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search the
255
249
DDIISSCCLLAAIIMMEERR
256
ssuuddoorreeppllaayy is provided ``AS IS'' and any express or implied warranties,
257
including, but not limited to, the implied warranties of
258
merchantability and fitness for a particular purpose are disclaimed.
259
See the LICENSE file distributed with ssuuddoo or
260
http://www.sudo.ws/sudo/license.html for complete details.
264
1.8.5 April 16, 2012 SUDOREPLAY(1m)
250
ssuuddoorreeppllaayy is provided ``AS IS'' and any express or implied warranties,
251
including, but not limited to, the implied warranties of merchantability
252
and fitness for a particular purpose are disclaimed. See the LICENSE
253
file distributed with ssuuddoo or http://www.sudo.ws/sudo/license.html for
256
Sudo 1.8.6 July 12, 2012 Sudo 1.8.6
added
removed
doc/sudoreplay.cat
