Bug 884

Summary: Defaults log_input output(ttyin) output is overlapping
Product: Sudo Reporter: Umair <mohdumaircadent>
Component: SudoreplayAssignee: Todd C. Miller <Todd.Miller>
Status: RESOLVED INVALID    
Severity: high    
Priority: low    
Version: 1.8.1   
Hardware: Other   
OS: All   
Attachments: overlapping logs

Description Umair 2019-06-17 22:27:24 MDT
Created attachment 527 [details]
overlapping logs

All the logs captured for Defaults log_input are overlapping. 

We have the following on a test server
Defaults log_input
Defaults iolog_file=%Y%m%d%H%M%S_%{user}_%{group}_as_%{runas_user}_%{runas_group}_XXXXXX

When we are trying to view all the input logs through ttyin, the logs are getting overlap and we are not able to get a clear output

server # ls -l
total 12
-rw-------   1 root     admin         73 Jun 17 13:35 log
-rw-------   1 root     admin         20 Jun 17 13:41 stdin
-rw-------   1 root     admin       1235 Jun 17 13:41 timing
-rw-------   1 root     admin       1223 Jun 17 13:41 ttyin
Comment 1 Todd C. Miller 2019-07-11 12:59:50 MDT
The ttyin file consists of the user input, exactly as it was typed and without any post-processing.  One consequence of this is that the end of line character is usually a carriage return (ascii 13 or 0x0d) and not a linefeed character (ascii 10 or 0x0a).

You may wish to use the tr command to replace carriage returns with line feeds.  For example:

gunzip -c ttyin| tr "\\r" "\\n"

I'm going to expand the section in the manual that describes the I/O log files to be more detailed.