2 .\" Copyright (c) 2009-2012 Todd C. Miller <Todd.Miller@courtesan.com>
4 .\" Permission to use, copy, modify, and distribute this software for any
5 .\" purpose with or without fee is hereby granted, provided that the above
6 .\" copyright notice and this permission notice appear in all copies.
8 .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15 .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
18 .Dt SUDOREPLAY @mansectsu@
19 .Os Sudo @PACKAGE_VERSION@
22 .Nd replay sudo session logs
36 .Op Fl s Ar speed_factor
49 plays back or lists the output logs created by
53 can play the session back in real-time, or the playback speed may be
54 adjusted (faster or slower) based on the command line options.
58 should either be a six character sequence of digits and
59 upper case letters, e.g.\&
61 or a pattern matching the
66 When a command is run via
74 string is logged via syslog or to the
79 may also be determined using
80 .Nm sudoreplay Ns No 's
85 can be used to find the ID of a session based on a number of criteria
86 such as the user, tty or command run.
88 In replay mode, if the standard output has not been redirected,
90 will act on the following keys:
92 .It So Li \ Sc No (space)
93 Pause output; press any key to resume.
95 Reduce the playback speed by one half.
97 Double the playback speed.
100 The options are as follows:
102 .It Fl d Ar directory
105 to for the session logs instead of the default,
110 will play back the command's standard output, standard error and tty output.
113 option can be used to select which of these to output.
116 argument is a comma-separated list, consisting of one or more of following:
123 .Fl h No ( Em help Ns No )
126 to print a short help message to the standard output and exit.
127 .It Fl l Op Ar search expression
132 will list available sessions in a format similar to the
134 log file format, sorted by file name (or sequence number).
136 .Ar search expression
137 is specified, it will be used to restrict the IDs that are displayed.
138 An expression is composed of the following predicates:
140 .It command Ar pattern
141 Evaluates to true if the command run matches
143 On systems with POSIX regular expression support, the pattern may
144 be an extended regular expression.
145 On systems without POSIX regular expression support, a simple substring
146 match is performed instead.
148 Evaluates to true if the command was run with the specified current
151 Evaluates to true if the command was run on or after
154 .Sx Date and time format
155 for a description of supported date and time formats.
156 .It group Ar runas_group
157 Evaluates to true if the command was run with the specified
161 was explicitly specified when
163 was run this field will be empty in the log.
164 .It runas Ar runas_user
165 Evaluates to true if the command was run as the specified
169 runs commands as user
173 Evaluates to true if the command was run on or prior to
176 .Sx Date and time format
177 for a description of supported date and time formats.
179 Evaluates to true if the command was run on the specified terminal device.
182 should be specified without the
188 .It user Ar user name
189 Evaluates to true if the ID matches a command run by
193 Predicates may be abbreviated to the shortest unique string (currently
194 all predicates may be shortened to a single character).
196 Predicates may be combined using
205 grouping (note that parentheses must generally be escaped from the shell).
208 operator is optional, adjacent predicates have an implied
210 unless separated by an
213 Specify an upper bound on how long to wait between key presses or output data.
216 will accurately reproduce the delays between key presses or program output.
217 However, this can be tedious when the session includes long pauses.
222 will limit these pauses to at most
225 The value may be specified as a floating point number, e.g.\&
227 .It Fl s Ar speed_factor
230 to adjust the number of seconds it will wait between key presses or
232 This can be used to slow down or speed up the display.
237 would make the output twice as fast whereas a
241 would make the output twice as slow.
244 .Fl V No ( Em version Ns No )
247 to print its version number
250 .Ss Date and time format
251 The time and date may be specified multiple ways, common formats include:
253 .It HH:MM:SS am MM/DD/CCYY timezone
254 24 hour time may be used in place of am/pm.
255 .It HH:MM:SS am Month, Day Year timezone
256 24 hour time may be used in place of am/pm, and month and day names
258 Note that month and day of the week names must be specified in English.
259 .It CCYY-MM-DD HH:MM:SS
261 .It DD Month CCYY HH:MM:SS
262 The month name may be abbreviated.
265 Either time or date may be omitted, the am/pm and timezone are optional.
266 If no date is specified, the current day is assumed; if no time is
267 specified, the first second of the specified date is used.
268 The less significant parts of both time and date may also be omitted,
269 in which case zero is assumed.
271 The following are all valid time and date specifications:
274 The current time and date.
276 Exactly one day from now.
282 The first second of the next Friday.
284 The current time but the first day of the coming week.
286 The current time but 14 days ago.
287 .It 10:01 am 9/17/2009
288 10:01 am, September 17, 2009.
290 10:01 am on the current day.
292 10:00 am on the current day.
294 00:00 am, September 17, 2009.
295 .It 10:01 am Sep 17, 2009
296 10:01 am, September 17, 2009.
301 The default I/O log directory.
302 .It Pa @iolog_dir@/00/00/01/log
303 Example session log info.
304 .It Pa @iolog_dir@/00/00/01/stdin
305 Example session standard input log.
306 .It Pa @iolog_dir@/00/00/01/stdout
307 Example session standard output log.
308 .It Pa @iolog_dir@/00/00/01/stderr
309 Example session standard error log.
310 .It Pa @iolog_dir@/00/00/01/ttyin
311 Example session tty input file.
312 .It Pa @iolog_dir@/00/00/01/ttyout
313 Example session tty output file.
314 .It Pa @iolog_dir@/00/00/01/timing
315 Example session timing file.
323 files will be empty unless
325 was used as part of a pipeline for a particular command.
327 List sessions run by user
329 .Bd -literal -offset indent
330 # sudoreplay -l user millert
333 List sessions run by user
335 with a command containing the string vi:
336 .Bd -literal -offset indent
337 # sudoreplay -l user bob command vi
340 List sessions run by user
342 that match a regular expression:
343 .Bd -literal -offset indent
344 # sudoreplay -l user jeff command '/bin/[a-z]*sh'
347 List sessions run by jeff or bob on the console:
348 .Bd -literal -offset indent
349 # sudoreplay -l ( user jeff or user bob ) tty console
352 .Xr sudo @mansectsu@ ,
357 If you feel you have found a bug in
359 please submit a bug report at http://www.sudo.ws/sudo/bugs/
361 Limited free support is available via the sudo-users mailing list,
362 see http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or
368 and any express or implied warranties, including, but not limited
369 to, the implied warranties of merchantability and fitness for a
370 particular purpose are disclaimed.
371 See the LICENSE file distributed with
373 or http://www.sudo.ws/sudo/license.html for complete details.