sudoreplay(8) — Linux manual page


SUDOREPLAY(8)            System Manager's Manual           SUDOREPLAY(8)

NAME         top

       sudoreplay — replay sudo session logs

SYNOPSIS         top

       sudoreplay [-FhnRS] [-d dir] [-f filter] [-m num] [-s num]

       [-h] [-d dir] -l [search expression]

DESCRIPTION         top

       plays back or lists the output logs created by sudo.  When
       replaying, can play the session back in real-time, or the
       playback speed may be adjusted (faster or slower) based on the
       command line options.

       The ID should either be a six character sequence of digits and
       upper case letters, e.g., “0100A5” or a path name.  The ID may
       include an optional @offset suffix which may be used to start
       replaying at a specific time offset.  The @offset is specified as
       a number in seconds since the start of the session with an
       optional decimal fraction.

       Path names may be relative to the I/O log directory
       /var/log/sudo-io (unless overridden by the -d option) or fully
       qualified, beginning with a ‘/’ character.  When a command is run
       via sudo with log_output enabled in the sudoers file, a “TSID=ID”
       string is logged via syslog(3) or to the sudo log file.  The ID
       may also be determined using sudoreplay's list mode.

       In list mode, can be used to find the ID of a session based on a
       number of criteria such as the user, tty, or command run.

       In replay mode, if the standard input and output are connected to
       a terminal and the -n option is not specified, will operate
       interactively.  In interactive mode, will attempt to adjust the
       terminal size to match that of the session and write directly to
       the terminal (not all terminals support this).  Additionally, it
       will poll the keyboard and act on the following keys:

       ‘\n’ or ‘\r’  Skip to the next replay event; useful for long

       ‘ ’ (space)   Pause output; press any key to resume.

       ‘<’           Reduce the playback speed by one half.

       ‘>’           Double the playback speed.

       The session can be interrupted via control-C.  When the session
       has finished, the terminal is restored to its original size if it
       was changed during playback.

       The options are as follows:

       -d dir, --directory=dir
               Store session logs in dir instead of the default,

       -f filter, --filter=filter
               Select which I/O type(s) to display.  By default, will
               display the command's standard output, standard error,
               and tty output.  The filter argument is a comma-separated
               list, consisting of one or more of following: stdin,
               stdout, stderr, ttyin, and ttyout.

       -F, --follow
               Enable “follow mode”.  When replaying a session, will
               ignore end-of-file and keep replaying until the log is
               complete.  This can be used to replay a session that is
               still in progress, similar to “tail -f”.  An I/O log file
               is considered to be complete when the write bits have
               been cleared on the session's timing file.  Versions of
               sudo prior to 1.9.1 do not clear the write bits upon

       -h, --help
               Display a short help message to the standard output and

       -l, --list [search expression]
               Enable “list mode”.  In this mode, will list available
               sessions in a format similar to the sudo log file format,
               sorted by file name (or sequence number).  Any control
               characters present in the log data are formatted in octal
               with a leading ‘#’ character.  For example, a horizontal
               tab is displayed as ‘#011’ and an embedded carriage
               return is displayed as ‘#015’.  Space characters in the
               command name and arguments are also formatted in octal.

               If a search expression is specified, it will be used to
               restrict the IDs that are displayed.  An expression is
               composed of the following predicates:

               command pattern
                       Evaluates to true if the command run matches the
                       POSIX extended regular expression pattern.

               cwd directory
                       Evaluates to true if the command was run with the
                       specified current working directory.

               fromdate date
                       Evaluates to true if the command was run on or
                       after date.  See “Date and time format” for a
                       description of supported date and time formats.

               group runas_group
                       Evaluates to true if the command was run with the
                       specified runas_group.  Unless a runas_group was
                       explicitly specified when sudo was run this field
                       will be empty in the log.

               host hostname
                       Evaluates to true if the command was run on the
                       specified hostname.

               runas runas_user
                       Evaluates to true if the command was run as the
                       specified runas_user.  By default, sudo runs
                       commands as the root user.

               todate date
                       Evaluates to true if the command was run on or
                       prior to date.  See “Date and time format” for a
                       description of supported date and time formats.

               tty tty name
                       Evaluates to true if the command was run on the
                       specified terminal device.  The tty name should
                       be specified without the /dev/ prefix, e.g.,
                       tty01 instead of /dev/tty01.

               user user name
                       Evaluates to true if the ID matches a command run
                       by user name.

               Predicates may be abbreviated to the shortest unique

               Predicates may be combined using and, or, and ! operators
               as well as ‘(’ and ‘)’ grouping (parentheses must
               generally be escaped from the shell).  The and operator
               is optional, adjacent predicates have an implied and
               unless separated by an or.

       -m, --max-wait max_wait
               Specify an upper bound on how long to wait between key
               presses or output data.  By default, will accurately
               reproduce the delays between key presses or program
               output.  However, this can be tedious when the session
               includes long pauses.  When the -m option is specified,
               will limit these pauses to at most max_wait seconds.  The
               value may be specified as a floating point number, e.g.,
               2.5.  A max_wait of zero or less will eliminate the
               pauses entirely.

       -n, --non-interactive
               Do not prompt for user input or attempt to re-size the
               terminal.  The session is written to the standard output,
               not directly to the user's terminal.

       -R, --no-resize
               Do not attempt to re-size the terminal to match the
               terminal size of the session.

       -S, --suspend-wait
               Wait while the command was suspended.  By default, will
               ignore the time interval between when the command was
               suspended and when it was resumed.  If the -S option is
               specified, will wait instead.

       -s, --speed speed_factor
               This option causes to adjust the number of seconds it
               will wait between key presses or program output.  This
               can be used to slow down or speed up the display.  For
               example, a speed_factor of 2 would make the output twice
               as fast whereas a speed_factor of .5 would make the
               output twice as slow.

       -V, --version
               Print the versions version number and exit.

   Date and time format
       The time and date may be specified multiple ways, common formats

       HH:MM:SS am MM/DD/CCYY timezone
               24 hour time may be used in place of am/pm.

       HH:MM:SS am Month, Day Year timezone
               24 hour time may be used in place of am/pm, and month and
               day names may be abbreviated.  Month and day of the week
               names must be specified in English.

               ISO time format

       DD Month CCYY HH:MM:SS
               The month name may be abbreviated.

       Either time or date may be omitted, the am/pm and timezone are
       optional.  If no date is specified, the current day is assumed;
       if no time is specified, the first second of the specified date
       is used.  The less significant parts of both time and date may
       also be omitted, in which case zero is assumed.

       The following are all valid time and date specifications:

       now     The current time and date.

               Exactly one day from now.

               24 hours ago.

       2 hours ago
               2 hours ago.

       next Friday
               The first second of the Friday in the next (upcoming)
               week.  Not to be confused with “this Friday” which would
               match the Friday of the current week.

       last week
               The current time but 7 days ago.  This is equivalent to
               “a week ago”.

       a fortnight ago
               The current time but 14 days ago.

       10:01 am 9/17/2009
               10:01 am, September 17, 2009.

       10:01 am
               10:01 am on the current day.

       10      10:00 am on the current day.

               00:00 am, September 17, 2009.

       10:01 am Sep 17, 2009
               10:01 am, September 17, 2009.

       Relative time specifications do not always work as expected.  For
       example, the “next” qualifier is intended to be used in
       conjunction with a day such as “next Monday”.  When used with
       units of weeks, months, years, etc the result will be one more
       than expected.  For example, “next week” will result in a time
       exactly two weeks from now, which is probably not what was
       intended.  This will be addressed in a future version of .

   Debugging sudoreplay
       versions 1.8.4 and higher support a flexible debugging framework
       that is configured via Debug lines in the sudo.conf(5) file.

       For more information on configuring sudo.conf(5), refer to its

FILES         top

       /etc/sudo.conf            Debugging framework configuration

       /var/log/sudo-io          The default I/O log directory.

                                 Example session log info.

                                 Example session log info (JSON format).

                                 Example session standard input log.

                                 Example session standard output log.

                                 Example session standard error log.

                                 Example session tty input file.

                                 Example session tty output file.

                                 Example session timing file.

       The stdin, stdout and stderr files will be empty unless sudo was
       used as part of a pipeline for a particular command.

EXAMPLES         top

       List sessions run by user millert:

           # sudoreplay -l user millert

       List sessions run by user bob with a command containing the
       string vi:

           # sudoreplay -l user bob command vi

       List sessions run by user jeff that match a regular expression:

           # sudoreplay -l user jeff command '/bin/[a-z]*sh'

       List sessions run by jeff or bob on the console:

           # sudoreplay -l ( user jeff or user bob ) tty console

SEE ALSO         top

       script(1), sudo.conf(5), sudo(8)

AUTHORS         top

       Many people have worked on sudo over the years; this version
       consists of code written primarily by:

             Todd C. Miller

       See the file in the sudo distribution
       ( for an exhaustive list
       of people who have contributed to sudo.

BUGS         top

       If you believe you have found a bug in , you can submit a bug
       report at

SUPPORT         top

       Limited free support is available via the sudo-users mailing
       list, see to
       subscribe or search the archives.

DISCLAIMER         top

       is provided “AS IS” and any express or implied warranties,
       including, but not limited to, the implied warranties of
       merchantability and fitness for a particular purpose are
       disclaimed.  See the file distributed with sudo or for complete details.

COLOPHON         top

       This page is part of the sudo (execute a command as another user)
       project.  Information about the project can be found at  If you have a bug report for this manual
       page, see ⟨⟩.  This page was obtained
       from the project's upstream Git repository
       ⟨⟩ on 2023-12-22.  (At that
       time, the date of the most recent commit that was found in the
       repository was 2023-12-21.)  If you discover any rendering
       problems in this HTML version of the page, or you believe there
       is a better or more up-to-date source for the page, or you have
       corrections or improvements to the information in this COLOPHON
       (which is not part of the original manual page), send a mail to

Sudo 1.9.15p4               January 16, 2023               SUDOREPLAY(8)