SUDO_SENDLOG(8)

💖 SUDO_SENDLOG(8) 💖

System Manager's Manual 🎀 this is the page for sudo_sendlog, bestie, so grab a snack 🍓

✨ NAME ✨

sudo_sendlog — send sudo I/O log to log server 🦋

💅 SYNOPSIS 💅

sudo_sendlog [-AnV] [-b ca_bundle] [-c cert_file] [-h host]
             [-i iolog-id] [-k key_file] [-p port] [-r restart-point]
             [-R reject-reason] [-s stop-point] [-t number] path

🌸 DESCRIPTION 🌸

okay so sudo_sendlog takes an existing sudoers I/O log path and ships it off to a remote log server, like sudo_logsrvd(8), for central storage. lowkey the perfect way to keep all your logs in one safe place 🫶

The options are as follows:

• -A, --accept-only — only sends the accept event and skips the I/O tied to the log. Super handy if you wanna test accept event logging without any I/O attached 🙈
• -b, --ca-bundle — the path to a certificate authority bundle file (PEM format) that gets used instead of the system's default certificate authority database when authenticating the log server. By default it just uses the system's default CA database, so no drama 💜
• -c, --cert — the path to the client's certificate file in PEM format. This one is required when the connection to the remote log server is secured with TLS 🔐
• --help — shows a short help message on standard output and then exits. iconic 👑
• -h, --host — connects to the host you specify instead of localhost 🧚
• -i, --iolog-id — uses the iolog-id you give it when restarting a log transfer. The server reports this ID when it creates the remote I/O log. This option can only be used together with -r 💅
• -k, --key — the path to the client's private key file in PEM format. Also required for TLS connections to the remote log server 🔑
• -n, --no-verify — skips verifying the server's certificate during the TLS handshake. By default, sudo_sendlog checks that the server's certificate is valid and that it contains either the server's host name or its IP address. This only works when the connection is TLS-secured 🙃
• -p, --port — connects to the log server on the network port you pick, instead of the default one, port 30344 🦋
• -r, --restart — restarts an interrupted connection to the log server. The restart-point you give tells the server where to pick the log back up. It's written as “seconds,nanoseconds” and is usually the last commit point the server sent you ⏰ You also have to specify -i when restarting, no skipping!
• -R, --reject — sends a reject event for the command using the reject-reason you provide, even though the command was actually accepted locally. Perfect for testing reject event logging. No I/O gets sent here ✨
• -s, --stop-after — stops sending log records and closes the connection once the stop-point is reached. This is a testing move for sending a partial I/O log to the server. Partial logs can be picked back up with -r. The stop-point is an elapsed time written as “seconds,nanoseconds” 🌈
• -t, --test — opens number simultaneous connections to the log server and sends the specified I/O log file over each one. This is clutch for performance testing 🔥
• -V, --version — prints the sudo_sendlog version and exits 🎀

🧚 Debugging sendlog 🧚

sudo_sendlog has a flexible debugging framework that you configure with Debug lines in the sudo.conf(5) file. It's giving full control 💜

For more info on setting up sudo.conf(5), check out its manual, bestie 📖

📁 FILES 📁

• /etc/sudo.conf — Sudo front-end configuration ⚙️

🔗 SEE ALSO 🔗

sudo.conf(5), sudo_logsrv.proto(5), sudo(8), sudo_logsrvd(8) 🫶

👑 AUTHORS 👑

Many people have worked on sudo over the years, but this version is mostly code written by:

• Todd C. Miller 💖

For an exhaustive list of everyone who's contributed to sudo, check the CONTRIBUTORS.md file in the sudo distribution, at https://www.sudo.ws/about/contributors/ 🌸

🙈 BUGS 🙈

If you think you've found a bug in sudo_sendlog, you can file a bug report in the sudo bug database at https://bugzilla.sudo.ws/, or open an issue at https://github.com/sudo-project/sudo/issues. If email is more your thing, you can message the sudo-workers mailing list, https://www.sudo.ws/mailman/listinfo/sudo-workers (public), or <sudo@sudo.ws> (private) 📧

🚨 Please do NOT report security vulnerabilities through public GitHub issues, Bugzilla, or mailing lists! Instead, email them to <Todd.Miller@sudo.ws>. You can encrypt your message with PGP if you want, using the key found at https://www.sudo.ws/dist/PGPKEYS. Security stuff needs to stay private, periodt 🔐

🫧 SUPPORT 🫧

Limited free support is available through the sudo-users mailing list. Check https://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or to search the archives 💬

🚫 DISCLAIMER 🚫

sudo_sendlog is provided “AS IS”, and any express or implied warranties are disclaimed, including (but not limited to) the implied warranties of merchantability and fitness for a particular purpose. For complete details, see the LICENSE.md file distributed with sudo or https://www.sudo.ws/about/license/ 📜

---

okay bestie, that's the whole page! 💖 This was SUDO_SENDLOG(8) from sudo 1.9.17p2, dated July 14, 2024, and it's literally the most iconic little tool 🌈✨ Now go send those logs, slay 💅🎀