# sudoreplay

## NAME



           **sudoreplay** — replay sudo session logs
    


## SYNOPSIS



           **sudoreplay**[**-FhnRS**] [**-d** _dir_] [**-f** _filter_] [**-m** _num_] [**-s** _num_]
           ID[_@offset_]
    
           **sudoreplay**[**-h**] [**-d** _dir_] **-l**[search expression]
    


## DESCRIPTION



           **sudoreplay** plays back or lists the output logs created by **sudo**.
           When replaying, **sudoreplay** can play the session back in real-time,
           or the playback speed may be adjusted (faster or slower) based on
           the command line options.
    
           The _ID_ should either be a six character sequence of digits and
           upper case letters, e.g., “0100A5” or a path name.  The _ID_ may
           include an optional _@offset_ suffix which may be used to start
           replaying at a specific time offset.  The _@offset_ is specified as
           a number in seconds since the start of the session with an
           optional decimal fraction.
    
           Path names may be relative to the I/O log directory
           _/var/log/sudo-io_ (unless overridden by the **-d** option) or fully
           qualified, beginning with a ‘/’ character.  When a command is run
           via **sudo** with _log_output_ enabled in the _sudoers_ file, a “TSID=ID”
           string is logged via _syslog_(3) or to the **sudo** log file.  The _ID_
           may also be determined using **sudoreplay** 's list mode.
    
           In list mode, **sudoreplay** can be used to find the ID of a session
           based on a number of criteria such as the user, tty, or command
           run.
    
           In replay mode, if the standard input and output are connected to
           a terminal and the **-n** option is not specified, **sudoreplay** will
           operate interactively.  In interactive mode, **sudoreplay** will
           attempt to adjust the terminal size to match that of the session
           and write directly to the terminal (not all terminals support
           this).  Additionally, it will poll the keyboard and act on the
           following keys:
    
           ‘**\n** ’ or ‘**\r** ’  Skip to the next replay event; useful for long
                         pauses.
    
           ‘ ’ (space)   Pause output; press any key to resume.
    
           ‘<’           Reduce the playback speed by one half.
    
           ‘>’           Double the playback speed.
    
           The session can be interrupted via control-C.  When the session
           has finished, the terminal is restored to its original size if it
           was changed during playback.
    
           The options are as follows:
    
           **-d** _dir_ , **--directory** =_dir_
                   Store session logs in _dir_ instead of the default,
                   _/var/log/sudo-io_.
    
           **-f** _filter_ , **--filter** =_filter_
                   Select which I/O type(s) to display.  By default,
                   **sudoreplay** will display the command's standard output,
                   standard error, and tty output.  The _filter_ argument is a
                   comma-separated list, consisting of one or more of
                   following: _stdin_ , _stdout_ , _stderr_ , _ttyin_ , and _ttyout_.
    
           **-F** , **--follow**
                   Enable “follow mode”.  When replaying a session,
                   **sudoreplay** will ignore end-of-file and keep replaying
                   until the log is complete.  This can be used to replay a
                   session that is still in progress, similar to “tail -f”.
                   An I/O log file is considered to be complete when the
                   write bits have been cleared on the session's timing file.
                   Versions of **sudo** prior to 1.9.1 do not clear the write
                   bits upon completion.
    
           **-h** , **--help**
                   Display a short help message to the standard output and
                   exit.
    
           **-l** , **--list**[_search expression_]
                   Enable “list mode”.  In this mode, **sudoreplay** will list
                   available sessions in a format similar to the **sudo** log
                   file format, sorted by file name (or sequence number).
                   Any control characters present in the log data are
                   formatted in octal with a leading ‘#’ character.  For
                   example, a horizontal tab is displayed as ‘#011’ and an
                   embedded carriage return is displayed as ‘#015’.  Space
                   characters in the command name and arguments are also
                   formatted in octal.
    
                   If a _search expression_ is specified, it will be used to
                   restrict the IDs that are displayed.  An expression is
                   composed of the following predicates:
    
                   command _pattern_
                           Evaluates to true if the command run matches the
                           POSIX extended regular expression _pattern_.
    
                   cwd _directory_
                           Evaluates to true if the command was run with the
                           specified current working directory.
    
                   fromdate _date_
                           Evaluates to true if the command was run on or
                           after _date_.  See “Date and time format” for a
                           description of supported date and time formats.
    
                   group _runas_group_
                           Evaluates to true if the command was run with the
                           specified _runas_group_.  Unless a _runas_group_ was
                           explicitly specified when **sudo** was run this field
                           will be empty in the log.
    
                   host _hostname_
                           Evaluates to true if the command was run on the
                           specified _hostname_.
    
                   runas _runas_user_
                           Evaluates to true if the command was run as the
                           specified _runas_user_.  By default, **sudo** runs
                           commands as the **root** user.
    
                   todate _date_
                           Evaluates to true if the command was run on or
                           prior to _date_.  See “Date and time format” for a
                           description of supported date and time formats.
    
                   tty _tty name_
                           Evaluates to true if the command was run on the
                           specified terminal device.  The _tty name_ should be
                           specified without the _/dev/_ prefix, e.g., _tty01_
                           instead of _/dev/tty01_.
    
                   user _user name_
                           Evaluates to true if the ID matches a command run
                           by _user name_.
    
                   Predicates may be abbreviated to the shortest unique
                   string.
    
                   Predicates may be combined using _and_ , _or_ , and _!_ operators
                   as well as ‘(’ and ‘)’ grouping (parentheses must
                   generally be escaped from the shell).  The _and_ operator is
                   optional, adjacent predicates have an implied _and_ unless
                   separated by an _or_.
    
           **-m** , **--max-wait** _max_wait_
                   Specify an upper bound on how long to wait between key
                   presses or output data.  By default, **sudoreplay** will
                   accurately reproduce the delays between key presses or
                   program output.  However, this can be tedious when the
                   session includes long pauses.  When the **-m** option is
                   specified, **sudoreplay** will limit these pauses to at most
                   _max_wait_ seconds.  The value may be specified as a
                   floating point number, e.g., _2.5_.  A _max_wait_ of zero or
                   less will eliminate the pauses entirely.
    
           **-n** , **--non-interactive**
                   Do not prompt for user input or attempt to re-size the
                   terminal.  The session is written to the standard output,
                   not directly to the user's terminal.
    
           **-R** , **--no-resize**
                   Do not attempt to re-size the terminal to match the
                   terminal size of the session.
    
           **-S** , **--suspend-wait**
                   Wait while the command was suspended.  By default,
                   **sudoreplay** will ignore the time interval between when the
                   command was suspended and when it was resumed.  If the **-S**
                   option is specified, **sudoreplay** will wait instead.
    
           **-s** , **--speed** _speed_factor_
                   This option causes **sudoreplay** to adjust the number of
                   seconds it will wait between key presses or program
                   output.  This can be used to slow down or speed up the
                   display.  For example, a _speed_factor_ of _2_ would make the
                   output twice as fast whereas a _speed_factor_ of _.5_ would
                   make the output twice as slow.
    
           **-V** , **--version**
                   Print the **sudoreplay** versions version number and exit.
    
       **Date and time format**
           The time and date may be specified multiple ways, common formats
           include:
    
           HH:MM:SS am MM/DD/CCYY timezone
                   24 hour time may be used in place of am/pm.
    
           HH:MM:SS am Month, Day Year timezone
                   24 hour time may be used in place of am/pm, and month and
                   day names may be abbreviated.  Month and day of the week
                   names must be specified in English.
    
           CCYY-MM-DD HH:MM:SS
                   ISO time format
    
           DD Month CCYY HH:MM:SS
                   The month name may be abbreviated.
    
           Either time or date may be omitted, the am/pm and timezone are
           optional.  If no date is specified, the current day is assumed; if
           no time is specified, the first second of the specified date is
           used.  The less significant parts of both time and date may also
           be omitted, in which case zero is assumed.
    
           The following are all valid time and date specifications:
    
           now     The current time and date.
    
           tomorrow
                   Exactly one day from now.
    
           yesterday
                   24 hours ago.
    
           2 hours ago
                   2 hours ago.
    
           next Friday
                   The first second of the Friday in the next (upcoming)
                   week.  Not to be confused with “this Friday” which would
                   match the Friday of the current week.
    
           last week
                   The current time but 7 days ago.  This is equivalent to “a
                   week ago”.
    
           a fortnight ago
                   The current time but 14 days ago.
    
           10:01 am 9/17/2009
                   10:01 am, September 17, 2009.
    
           10:01 am
                   10:01 am on the current day.
    
           10      10:00 am on the current day.
    
           9/17/2009
                   00:00 am, September 17, 2009.
    
           10:01 am Sep 17, 2009
                   10:01 am, September 17, 2009.
    
           Relative time specifications do not always work as expected.  For
           example, the “next” qualifier is intended to be used in
           conjunction with a day such as “next Monday”.  When used with
           units of weeks, months, years, etc the result will be one more
           than expected.  For example, “next week” will result in a time
           exactly two weeks from now, which is probably not what was
           intended.  This will be addressed in a future version of
           **sudoreplay**.
    
       **Debugging sudoreplay**
           **sudoreplay** versions 1.8.4 and higher support a flexible debugging
           framework that is configured via _Debug_ lines in the _sudo.conf_(5)
           file.
    
           For more information on configuring _sudo.conf_(5), refer to its
           manual.
    


## FILES



           _/etc/sudo.conf_            Debugging framework configuration
    
           _/var/log/sudo-io_          The default I/O log directory.
    
           _/var/log/sudo-io/00/00/01/log_
                                     Example session log info.
    
           _/var/log/sudo-io/00/00/01/log.json_
                                     Example session log info (JSON format).
    
           _/var/log/sudo-io/00/00/01/stdin_
                                     Example session standard input log.
    
           _/var/log/sudo-io/00/00/01/stdout_
                                     Example session standard output log.
    
           _/var/log/sudo-io/00/00/01/stderr_
                                     Example session standard error log.
    
           _/var/log/sudo-io/00/00/01/ttyin_
                                     Example session tty input file.
    
           _/var/log/sudo-io/00/00/01/ttyout_
                                     Example session tty output file.
    
           _/var/log/sudo-io/00/00/01/timing_
                                     Example session timing file.
    
           The _stdin_ , _stdout_ and _stderr_ files will be empty unless **sudo** was
           used as part of a pipeline for a particular command.
    


## EXAMPLES



           List sessions run by user _millert_ :
    
               # sudoreplay -l user millert
    
           List sessions run by user _bob_ with a command containing the string
           vi:
    
               # sudoreplay -l user bob command vi
    
           List sessions run by user _jeff_ that match a regular expression:
    
               # sudoreplay -l user jeff command '/bin/[a-z]*sh'
    
           List sessions run by jeff or bob on the console:
    
               # sudoreplay -l ( user jeff or user bob ) tty console
    


## BUGS



           If you believe you have found a bug in **sudoreplay** , you can either
           file a bug report in the sudo bug database,
           https://bugzilla.sudo.ws/, or open an issue at
           https://github.com/sudo-project/sudo/issues.  If you would prefer
           to use email, messages may be sent to the sudo-workers mailing
           list, https://www.sudo.ws/mailman/listinfo/sudo-workers (public)
           or <sudo@sudo.ws> (private).
    
           Please do not report security vulnerabilities through public
           GitHub issues, Bugzilla or mailing lists.  Instead, report them
           via email to <Todd.Miller@sudo.ws>.  You may encrypt your message
           with PGP if you would like, using the key found at
           https://www.sudo.ws/dist/PGPKEYS.
    


## SUPPORT



           Limited free support is available via the sudo-users mailing list,
           see https://www.sudo.ws/mailman/listinfo/sudo-users to subscribe
           or search the archives.
    


## DISCLAIMER



           **sudoreplay** is provided “AS IS” and any express or implied
           warranties, including, but not limited to, the implied warranties
           of merchantability and fitness for a particular purpose are
           disclaimed.  See the LICENSE.md file distributed with **sudo** or
           https://www.sudo.ws/about/license/ for complete details.
    


* * *