SUDOREPLAY(8)

💖 sudoreplay 💖 (manual section 8: replay sudo session logs)

✨ NAME ✨

sudoreplay 🎀 replay sudo session logs

🦋 SYNOPSIS 🦋

sudoreplay [-FhnRS] [-d dir] [-f filter] [-m num] [-s num] ID[@offset]
sudoreplay [-h] [-d dir] -l [search expression]

🌸 DESCRIPTION 🌸

okay so sudoreplay is the app that lets you replay or list the output logs sudo makes. when you're replaying, it can play the session back in real-time, or you can speed it up or slow it down with your command line options. so iconic 🔥

the ID should be either a six character combo of digits and upper case letters, like “0100A5”, or a path name. the ID can also have an optional @offset suffix if you want to start replaying from a specific spot. the offset is a number of seconds since the session started, and it can have a decimal fraction. bestie, that's giving precision 🧚

path names can be relative to the I/O log directory /var/log/sudo-io (unless you override it with the -d option), or fully qualified, which means they start with a / character. when a command runs through sudo with log_output turned on in the sudoers file, a TSID=ID string gets logged via syslog(3) or into the sudo log file. you can also figure out the ID using sudoreplay's list mode 💅

in list mode, sudoreplay can hunt down the ID of a session based on stuff like the user, the tty, or the command that was run. main character energy 👑

in replay mode, if standard input and output are connected to a terminal and you didn't pass -n, sudoreplay goes interactive 🫶 in interactive mode it tries to resize your terminal to match the session and writes straight to the terminal (heads up, not every terminal supports this 💀). it also keeps an eye on the keyboard and reacts to these keys:

• \n or \r — skip to the next replay event. super useful when there are long pauses 😭
• ' ' (space) — pause the output. press any key to resume ✨
• < — cut the playback speed in half 🙈
• > — double the playback speed 🔥

you can interrupt the session with control-C. when it's finished, the terminal goes back to its original size if it got changed during playback. ngl that's very considerate of it 🌈

🎀 OPTIONS 🎀

• -d dir, --directory=dir — store session logs in dir instead of the default, /var/log/sudo-io 🍓
• -f filter, --filter=filter — pick which I/O type(s) to show. by default you get the command's standard output, standard error, and tty output. the filter is a comma-separated list made of one or more of these: stdin, stdout, stderr, ttyin, and ttyout 💜
• -F, --follow — turns on “follow mode” 🦋 when you're replaying, sudoreplay ignores end-of-file and keeps going until the log is complete, kind of like tail -f. this is how you watch a session that's still happening live. an I/O log file counts as complete once the write bits get cleared on the session's timing file. heads up: sudo versions before 1.9.1 don't clear the write bits when they finish, so follow mode won't know when to stop with those 🙈
• -h, --help — shows a short help message on standard output and exits 🧚
• -l, --list [search expression] — turns on “list mode” 📋 in this mode, sudoreplay lists the available sessions in a format similar to the sudo log file format, sorted by file name (or sequence number). any control characters in the log data get formatted in octal with a leading # character. so a horizontal tab shows up as #011 and an embedded carriage return shows up as #015. space characters in the command name and arguments get octal formatting too, so it's all very encoded 💀

if you add a search expression, it restricts which IDs get displayed. an expression is built from these predicates:

• command pattern — true if the command run matches the POSIX extended regular expression pattern 💅
• cwd directory — true if the command was run with the specified current working directory 🌸
• fromdate date — true if the command was run on or after date. see “Date and time format” for the supported date and time formats ⏰
• group runas_group — true if the command was run with the specified runas_group. unless a runas_group was explicitly given when sudo ran, this field is empty in the log 🫠
• host hostname — true if the command was run on the specified hostname 🌈
• runas runas_user — true if the command was run as the specified runas_user. by default sudo runs commands as the root user 👑
• todate date — true if the command was run on or prior to date. see “Date and time format” for the supported formats 🍓
• tty tty name — true if the command was run on the specified terminal device. write the tty name without the /dev/ prefix, so tty01 instead of /dev/tty01 🎀
• user user name — true if the ID matches a command run by user name 💖

predicates can be abbreviated to the shortest unique string ✨

you can combine predicates with the and, or, and ! operators, and group them with ( and ). parentheses usually need escaping from the shell. the and operator is optional, since adjacent predicates have an implied and unless you separate them with an or 🧠

• -m max_wait, --max-wait max_wait — sets an upper bound on how long to wait between key presses or output data 🦋 by default, sudoreplay copies the delays between key presses or program output exactly. that can be super tedious when the session has long pauses, so with -m it caps those pauses at max_wait seconds. the value can be a floating point number, like 2.5. a max_wait of zero or less removes the pauses entirely 🫶
• -n, --non-interactive — no asking for user input and no attempts to resize the terminal 🙅 the session gets written to standard output instead of straight to the user's terminal
• -R, --no-resize — don't try to resize the terminal to match the session's terminal size 💅
• -S, --suspend-wait — wait while the command was suspended ⏳ by default, sudoreplay skips the time between when the command got suspended and when it resumed. if you pass -S, it waits through that gap instead 🌙
• -s speed_factor, --speed speed_factor — changes how many seconds sudoreplay waits between key presses or program output. use it to slow things down or speed them up 🚀 for example, a speed_factor of 2 makes the output twice as fast, while a speed_factor of .5 makes it twice as slow 🐢
• -V, --version — prints sudoreplay's version number and exits 🔢

📁 FILES 📁

okay bestie, these are the files sudoreplay cares about 🗂️✨

• /etc/sudo.conf — the config for sudo's debugging framework 🔧
• /var/log/sudo-io — the default I/O log directory 📂💖
• /var/log/sudo-io/00/00/01/log — example session log info 📝
• /var/log/sudo-io/00/00/01/log.json — example session log info, but in JSON format 🧾
• /var/log/sudo-io/00/00/01/stdin — an example session standard input log ⌨️
• /var/log/sudo-io/00/00/01/stdout — an example session standard output log 🖨️
• /var/log/sudo-io/00/00/01/stderr — an example session standard error log 🚨
• /var/log/sudo-io/00/00/01/ttyin — an example session tty input file 🎹
• /var/log/sudo-io/00/00/01/ttyout — an example session tty output file 📺
• /var/log/sudo-io/00/00/01/timing — an example session timing file ⏱️

heads up 🙈 the stdin, stdout and stderr files will be empty unless sudo was used as part of a pipeline for a particular command. so if you're wondering why they look sad and blank, that's why 💀

---

🎀 EXAMPLES 🎀

okay, the examples are where it all clicks 💅 let's go!

List sessions run by user millert:

# sudoreplay -l user millert

List sessions run by user bob with a command containing the string vi:

# sudoreplay -l user bob command vi

List sessions run by user jeff that match a regular expression:

# sudoreplay -l user jeff command '/bin/[a-z]*sh'

List sessions run by jeff or bob on the console:

# sudoreplay -l ( user jeff or user bob ) tty console

---

🦋 SEE ALSO 🦋

if you want more lore, go check out these bestie 📚🫶

script(1), sudo.conf(5), sudo(8)

---

👑 AUTHORS 👑

so a lot of people have worked on sudo over the years 🌈 but this version is mostly the work of:

Todd C. Miller 💖

for an exhaustive list of everyone who has contributed, check out the CONTRIBUTORS.md file in the sudo distribution, or https://www.sudo.ws/about/contributors/ ✨

---

🙈 BUGS 🙈

if you think you've found a bug in sudoreplay, you have two options: file a bug report in the sudo bug database at https://bugzilla.sudo.ws/, or open an issue at https://github.com/sudo-project/sudo/issues. 🐛

prefer email? you can send messages to the sudo-workers mailing list at https://www.sudo.ws/mailman/listinfo/sudo-workers (public), or to <sudo@sudo.ws> (private) 💌

bestie, pls pls pls 🥺 do not report security vulnerabilities through public GitHub issues, Bugzilla or mailing lists. instead, email them to <Todd.Miller@sudo.ws>. you can encrypt your message with PGP if you want, using the key found at https://www.sudo.ws/dist/PGPKEYS. security stuff stays safe that way 🔐💀

---

🫧 SUPPORT 🫧

limited free support is available through the sudo-users mailing list. check https://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or to search the archives 📬✨

---

⚖️ DISCLAIMER ⚖️

sudoreplay is provided “AS IS” 🫠 and any express or implied warranties, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose are disclaimed. for complete details, see the LICENSE.md file distributed with sudo, or https://www.sudo.ws/about/license/ 📜

---

bestie that's the whole page!! 🎀 we did it, you're officially a sudoreplay girlie now 💅🌸 the release info at the bottom is sudo 1.9.17p2 from January 16, 2023, and the man page itself is SUDOREPLAY(8) 🧚💜