1 Copyright (c) 2009-2010 Todd C. Miller <Todd.Miller@courtesan.com>
3 Permission to use, copy, modify, and distribute this software for any
4 purpose with or without fee is hereby granted, provided that the above
5 copyright notice and this permission notice appear in all copies.
7 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
10 ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
12 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
13 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
14 ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
20 sudoreplay - replay sudo session logs
24 B<sudoreplay> [B<-d> I<directory>] [B<-f> I<filter>] [B<-m> I<max_wait>] [B<-s> I<speed_factor>] ID
26 B<sudoreplay> [B<-d> I<directory>] -l [search expression]
30 B<sudoreplay> plays back or lists the session logs created by
31 B<sudo>. When replaying, B<sudoreplay> can play the session back
32 in real-time, or the playback speed may be adjusted (faster or
33 slower) based on the command line options. The I<ID> should be
34 a six character sequence of digits and upper case letters, e.g.
35 0100A5, which is logged by B<sudo> when a command is run with
36 session logging enabled.
38 In list mode, B<sudoreplay> can be used to find the ID of a session
39 based on a number of criteria such as the user, tty or command run.
41 In replay mode, if the standard output has not been redirected,
42 B<sudoreplay> will act on the following keys:
48 Pause output; press any key to resume.
52 Reduce the playback speed by one half.
56 Double the playback speed.
62 B<sudoreplay> accepts the following command line options:
68 Use I<directory> to for the session logs instead of the default,
73 By default, B<sudoreplay> will play back the command's standard
74 output, standard error and tty output. The I<-f> option can be
75 used to select which of these to output. The I<filter> argument
76 is a comma-separated list, consisting of one or more of following:
77 I<stdout>, I<stderr>, and I<ttyout>.
81 Enable "list mode". In this mode, B<sudoreplay> will list available
82 session IDs. If a I<search expression> is specified, it will be
83 used to restrict the IDs that are displayed. An expression is
84 composed of the following predicates:
88 =item command I<command pattern>
90 Evaluates to true if the command run matches I<command pattern>.
91 On systems with POSIX regular expression support, the pattern may
92 be an extended regular expression. On systems without POSIX regular
93 expression support, a simple substring match is performed instead.
95 =item cwd I<directory>
97 Evaluates to true if the command was run with the specified current
100 =item fromdate I<date>
102 Evaluates to true if the command was run on or after I<date>.
103 See L<"Date and time format"> for a description of supported
104 date and time formats.
106 =item group I<runas_group>
108 Evaluates to true if the command was run with the specified
109 I<runas_group>. Note that unless a I<runas_group> was explicitly
110 specified when B<sudo> was run this field will be empty in the log.
112 =item runas I<runas_user>
114 Evaluates to true if the command was run as the specified I<runas_user>.
115 Note that B<sudo> runs commands as user I<root> by default.
119 Evaluates to true if the command was run on or prior to I<date>.
120 See L<"Date and time format"> for a description of supported
121 date and time formats.
125 Evaluates to true if the command was run on the specified terminal
126 device. The I<tty> should be specified without the F</dev/> prefix,
127 e.g. F<tty01> instead of F</dev/tty01>.
129 =item user I<user name>
131 Evaluates to true if the ID matches a command run by I<user name>.
135 Predicates may be abbreviated to the shortest unique string (currently
136 all predicates may be shortened to a single character).
138 Predicates may be combined using I<and>, I<or> and I<!> operators
139 as well as C<'('> and C<')'> for grouping (note that parentheses
140 must generally be escaped from the shell). The I<and> operator is
141 optional, adjacent predicates have an implied I<and> unless separated
146 Specify an upper bound on how long to wait between key presses or
147 output data. By default, B<sudo_replay> will accurately reproduce
148 the delays between key presses or program output. However, this
149 can be tedious when the session includes long pauses. When the
150 I<-m> option is specified, B<sudoreplay> will limit these pauses
151 to at most I<max_wait> seconds. The value may be specified as a
152 floating point number, .e.g. I<2.5>.
154 =item -s I<speed_factor>
156 This option causes B<sudoreplay> to adjust the number of seconds
157 it will wait between key presses or program output. This can be
158 used to slow down or speed up the display. For example, a
159 I<speed_factor> of I<2> would make the output twice as fast whereas
160 a I<speed_factor> of <.5> would make the output twice as slow.
164 The B<-V> (version) option causes B<sudoreplay> to print its version number
169 =head2 Date and time format
171 The time and date may be specified multiple ways, common formats include:
175 =item HH:MM:SS am MM/DD/CCYY timezone
177 24 hour time may be used in place of am/pm.
179 =item HH:MM:SS am Month, Day Year timezone
181 24 hour time may be used in place of am/pm, and month and day names
182 may be abbreviated. Note that month and day of the week names must
183 be specified in English.
185 =item CCYY-MM-DD HH:MM:SS
189 =item DD Month CCYY HH:MM:SS
191 The month name may be abbreviated.
195 Either time or date may be omitted, the am/pm and timezone are
196 optional. If no date is specified, the current day is assumed; if
197 no time is specified, the first second of the specified date is
198 used. The less significant parts of both time and date may also
199 be omitted, in which case zero is assumed. For example, the following
202 The following are all valid time and date specifications:
208 The current time and date.
212 Exactly one day from now.
224 The first second of the next Friday.
228 The current time but the first day of the coming week.
230 =item a fortnight ago
232 The current time but 14 days ago.
234 =item 10:01 am 9/17/2009
236 10:01 am, September 17, 2009.
240 10:01 am on the current day.
244 10:00 am on the current day.
248 00:00 am, September 17, 2009.
250 =item 10:01 am Sep 17, 2009
252 10:01 am, September 17, 2009.
260 =item F</var/log/sudo-io>
262 The default I/O log directory.
264 =item F</var/log/sudo-io/00/00/01/log>
266 Example session log info.
268 =item F</var/log/sudo-io/00/00/01/stdin>
270 Example session standard input log.
272 =item F</var/log/sudo-io/00/00/01/stdout>
274 Example session standard output log.
276 =item F</var/log/sudo-io/00/00/01/stderr>
278 Example session standard error log.
280 =item F</var/log/sudo-io/00/00/01/ttyin>
282 Example session tty input file.
284 =item F</var/log/sudo-io/00/00/01/ttyout>
286 Example session tty output file.
288 =item F</var/log/sudo-io/00/00/01/timing>
290 Example session timing file.
294 Note that the I<stdin>, I<stdout> and I<stderr> files will be empty
295 unless B<sudo> was used as part of a pipeline for a particular
300 List sessions run by user I<millert>:
302 sudoreplay -l user millert
304 List sessions run by user I<bob> with a command containing the string vi:
306 sudoreplay -l user bob command vi
308 List sessions run by user I<jeff> that match a regular expression:
310 sudoreplay -l user jeff command '/bin/[a-z]*sh'
312 List sessions run by jeff or bob on the console:
314 sudoreplay -l ( user jeff or user bob ) tty console
318 L<sudo(8)>, L<script(1)>
326 If you feel you have found a bug in B<sudoreplay>, please submit a bug report
327 at http://www.sudo.ws/sudo/bugs/
331 Limited free support is available via the sudo-users mailing list,
332 see http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or
337 B<sudoreplay> is provided ``AS IS'' and any express or implied warranties,
338 including, but not limited to, the implied warranties of merchantability
339 and fitness for a particular purpose are disclaimed. See the LICENSE
340 file distributed with B<sudo> or http://www.sudo.ws/sudo/license.html
341 for complete details.