SUDOREPLAY(8) (System Manager's Manual) (NAME) sudoreplay - sudo (SYNOPSIS) sudoreplay [-FhnRS] [-d dir] [-f filter] [-m num] [-s num] ID[@offset] sudoreplay [-h] [-d dir] -l [search expression] (DESCRIPTION) sudoreplay sudo . sudoreplay (real-time) ( ). ID ( "0100A5") (path name). ID @offset . @offset . / /var/log/sudo-io ( -d ) `/' . sudo log_output sudoers "TSID=ID" syslog(3) sudo . ID (list mode) sudoreplay . sudoreplay tty . -n sudoreplay . sudoreplay ( ). : `\n' `\r' . ` ' ( / space) . `<' . `>' . control-C . . : (OPTIONS) -d dir, --directory=dir dir /var/log/sudo-io. -f filter, --filter=filter () / . sudoreplay tty . filter : stdin, stdout, stderr, ttyin, ttyout. -F, --follow " " ("follow mode"). sudoreplay (EOF) . "tail -f". / (write bits) (timing) . sudo 1.9.1 . -h, --help . -l, --list [search expression] " " ("list mode"). sudoreplay sudo ( ) . (octal) `#' . `#011' (carriage return) `#015' . . search expression ( ) . (predicates) : command pattern (POSIX extended regular expression) pattern (true) . cwd directory . fromdate date date . (Date and time format) . group runas_group runas_group . runas_group sudo . host hostname hostname . runas runas_user runas_user . sudo root . todate date date . (Date and time format) . tty tty name . tty name /dev/ tty01 /dev/tty01. user user name user name . . and, or, ! `(' `)' ( ). and and or . -m, --max-wait max_wait . sudoreplay . . -m sudoreplay max_wait . ( 2.5) . max_wait . -n, --non-interactive . . -R, --no-resize . -S, --suspend-wait (suspend) . sudoreplay . -S sudoreplay . -s, --speed speed_factor sudoreplay . . speed_factor 2 speed_factor .5 . -V, --version sudoreplay . (Date and time format) : HH:MM:SS am MM/DD/CCYY timezone am/pm . HH:MM:SS am Month, Day Year timezone am/pm . . CCYY-MM-DD HH:MM:SS ISO. DD Month CCYY HH:MM:SS . am/pm (timezone) . . . : now . tomorrow . yesterday . 2 hours ago . next Friday (). "this Friday" . last week . "a week ago" . a fortnight ago ( ). 10:01 am 9/17/2009 : . 10:01 am : . 10 : . 9/17/2009 : . 10:01 am Sep 17, 2009 : . . "next" "next Monday" . . "next week" . sudoreplay . sudoreplay (Debugging sudoreplay) sudoreplay 1.8.4 Debug sudo.conf(5) . sudo.conf(5) . (FILES) /etc/sudo.conf /var/log/sudo-io /. /var/log/sudo-io/00/00/01/log . /var/log/sudo-io/00/00/01/log.json ( JSON). /var/log/sudo-io/00/00/01/stdin . /var/log/sudo-io/00/00/01/stdout . /var/log/sudo-io/00/00/01/stderr . /var/log/sudo-io/00/00/01/ttyin tty . /var/log/sudo-io/00/00/01/ttyout tty . /var/log/sudo-io/00/00/01/timing . stdin, stdout stderr sudo (pipeline) . (EXAMPLES) millert: # sudoreplay -l user millert bob vi : # sudoreplay -l user bob command vi jeff : # sudoreplay -l user jeff command '/bin/[a-z]*sh' jeff bob : # sudoreplay -l ( user jeff or user bob ) tty console (SEE ALSO) script(1), sudo.conf(5), sudo(8) (AUTHORS) sudo : Todd C. Miller sudo CONTRIBUTORS.md sudo (https://www.sudo.ws/about/contributors) . (BUGS) sudoreplay sudo https://bugzilla.sudo.ws issue https://github.com/sudo-project/sudo/issues . sudo- workers : https://www.sudo.ws/mailman/listinfo/sudo-workers () (). issue . . https://www.sudo.ws/dist/PGPKEYS PGP . (SUPPORT) sudo-users https://www.sudo.ws/mailman/listinfo/sudo-users . (DISCLAIMER) sudoreplay " " ("AS IS") . LICENSE.md sudo https://www.sudo.ws/about/license . Sudo 1.9.17p2 January 16, 2023 SUDOREPLAY(8)