1 .\" DO NOT EDIT THIS FILE, IT IS NOT THE MASTER!
2 .\" IT IS GENERATED AUTOMATICALLY FROM sudoreplay.mdoc.in
4 .\" Copyright (c) 2009-2012 Todd C. Miller <Todd.Miller@courtesan.com>
6 .\" Permission to use, copy, modify, and distribute this software for any
7 .\" purpose with or without fee is hereby granted, provided that the above
8 .\" copyright notice and this permission notice appear in all copies.
10 .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
19 .TH "SUDOREPLAY" "@mansectsu@" "February 5, 2013" "Sudo @PACKAGE_VERSION@" "System Manager's Manual"
24 \- replay sudo session logs
29 [\fB\-d\fR\ \fIdirectory\fR]
30 [\fB\-f\fR\ \fIfilter\fR]
31 [\fB\-m\fR\ \fImax_wait\fR]
32 [\fB\-s\fR\ \fIspeed_factor\fR]
37 [\fB\-d\fR\ \fIdirectory\fR]
42 plays back or lists the output logs created by
46 can play the session back in real-time, or the playback speed may be
47 adjusted (faster or slower) based on the command line options.
51 should either be a six character sequence of digits and
52 upper case letters, e.g.\&
54 or a pattern matching the
59 When a command is run via
67 string is logged via syslog or to the
72 may also be determined using
78 can be used to find the ID of a session based on a number of criteria
79 such as the user, tty or command run.
81 In replay mode, if the standard output has not been redirected,
83 will act on the following keys:
86 Pause output; press any key to resume.
89 Reduce the playback speed by one half.
92 Double the playback speed.
94 The options are as follows:
96 \fB\-d\fR \fIdirectory\fR
100 to for the session logs instead of the default,
103 \fB\-f\fR \fIfilter\fR
106 will play back the command's standard output, standard error and tty output.
109 option can be used to select which of these to output.
112 argument is a comma-separated list, consisting of one or more of following:
120 \fB\-h\fR (\fIhelp\fR)
123 to print a short help message to the standard output and exit.
125 \fB\-l\fR [\fIsearch expression\fR]
130 will list available sessions in a format similar to the
132 log file format, sorted by file name (or sequence number).
134 \fIsearch expression\fR
135 is specified, it will be used to restrict the IDs that are displayed.
136 An expression is composed of the following predicates:
139 command \fIpattern\fR
140 Evaluates to true if the command run matches
142 On systems with POSIX regular expression support, the pattern may
143 be an extended regular expression.
144 On systems without POSIX regular expression support, a simple sub-string
145 match is performed instead.
148 Evaluates to true if the command was run with the specified current
152 Evaluates to true if the command was run on or after
155 \fIDate and time format\fR
156 for a description of supported date and time formats.
158 group \fIrunas_group\fR
159 Evaluates to true if the command was run with the specified
163 was explicitly specified when
165 was run this field will be empty in the log.
167 runas \fIrunas_user\fR
168 Evaluates to true if the command was run as the specified
172 runs commands as user
177 Evaluates to true if the command was run on or prior to
180 \fIDate and time format\fR
181 for a description of supported date and time formats.
184 Evaluates to true if the command was run on the specified terminal device.
187 should be specified without the
195 Evaluates to true if the ID matches a command run by
198 Predicates may be abbreviated to the shortest unique string (currently
199 all predicates may be shortened to a single character).
201 Predicates may be combined using
210 grouping (note that parentheses must generally be escaped from the shell).
213 operator is optional, adjacent predicates have an implied
215 unless separated by an
221 \fB\-m\fR \fImax_wait\fR
222 Specify an upper bound on how long to wait between key presses or output data.
225 will accurately reproduce the delays between key presses or program output.
226 However, this can be tedious when the session includes long pauses.
231 will limit these pauses to at most
234 The value may be specified as a floating point number, e.g.\&
238 \fB\-s\fR \fIspeed_factor\fR
241 to adjust the number of seconds it will wait between key presses or
243 This can be used to slow down or speed up the display.
248 would make the output twice as fast whereas a
252 would make the output twice as slow.
256 \fB\-V\fR (\fIversion\fR)
259 to print its version number
261 .SS "Date and time format"
262 The time and date may be specified multiple ways, common formats include:
264 HH:MM:SS am MM/DD/CCYY timezone
265 24 hour time may be used in place of am/pm.
267 HH:MM:SS am Month, Day Year timezone
268 24 hour time may be used in place of am/pm, and month and day names
270 Note that month and day of the week names must be specified in English.
275 DD Month CCYY HH:MM:SS
276 The month name may be abbreviated.
278 Either time or date may be omitted, the am/pm and timezone are optional.
279 If no date is specified, the current day is assumed; if no time is
280 specified, the first second of the specified date is used.
281 The less significant parts of both time and date may also be omitted,
282 in which case zero is assumed.
284 The following are all valid time and date specifications:
287 The current time and date.
290 Exactly one day from now.
299 The first second of the next Friday.
302 The current time but the first day of the coming week.
305 The current time but 14 days ago.
308 10:01 am, September 17, 2009.
311 10:01 am on the current day.
314 10:00 am on the current day.
317 00:00 am, September 17, 2009.
319 10:01 am Sep 17, 2009
320 10:01 am, September 17, 2009.
324 The default I/O log directory.
326 \fI@iolog_dir@/00/00/01/log\fR
327 Example session log info.
329 \fI@iolog_dir@/00/00/01/stdin\fR
330 Example session standard input log.
332 \fI@iolog_dir@/00/00/01/stdout\fR
333 Example session standard output log.
335 \fI@iolog_dir@/00/00/01/stderr\fR
336 Example session standard error log.
338 \fI@iolog_dir@/00/00/01/ttyin\fR
339 Example session tty input file.
341 \fI@iolog_dir@/00/00/01/ttyout\fR
342 Example session tty output file.
344 \fI@iolog_dir@/00/00/01/timing\fR
345 Example session timing file.
352 files will be empty unless
354 was used as part of a pipeline for a particular command.
356 List sessions run by user
361 # sudoreplay -l user millert
365 List sessions run by user
367 with a command containing the string vi:
371 # sudoreplay -l user bob command vi
375 List sessions run by user
377 that match a regular expression:
381 # sudoreplay -l user jeff command '/bin/[a-z]*sh'
385 List sessions run by jeff or bob on the console:
389 # sudoreplay -l ( user jeff or user bob ) tty console
398 If you feel you have found a bug in
400 please submit a bug report at http://www.sudo.ws/sudo/bugs/
402 Limited free support is available via the sudo-users mailing list,
403 see http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or
409 and any express or implied warranties, including, but not limited
410 to, the implied warranties of merchantability and fitness for a
411 particular purpose are disclaimed.
412 See the LICENSE file distributed with
414 or http://www.sudo.ws/sudo/license.html for complete details.