Bugzilla – Bug 475
sudoreplay cannot list file for customized iolog filename
Last modified: 2011-04-11 08:05:35 MDT
Hi, I have used the iolog_file option to rename the filename. Sudo is able to successfully create the directory with the customized filename. However, on sudoreplay -d /var/log/sudo-io/<filename> -l, it cannot display the ID for playback. I am logging this from home and so do not have access to office to do a screendump. I will try tomorrow. Thanks and have a nice day.
The -d option to sudoreplay corresponds to the iolog_dir option, not iolog_file. Sudoreplay should probably parse sudoers and read those values itself so you don't need to pass an option.
Hi, Thanks for the quick response. No, seeems not the case. This is how iolog_file is set: ... # Defaults env_keep += "XDG_SESSION_COOKIE" # Defaults env_keep += "XMODIFIERS GTK_IM_MODULE QT_IM_MODULE QT_IM_SWITCHER" Defaults log_output Defaults log_input Defaults iolog_file=%{hostname}.%y%m%d-%H%M%S.%{user}.%{command} # Defaults!/usr/bin/sudoreplay !log_output # Defaults!/usr/local/bin/sudoreplay !log_output ... [root@sins113045 sudo-io]# pwd /var/log/sudo-io [root@sins113045 sudo-io]# ls -l total 8 drwx------ 2 root secgrp 4096 Mar 3 16:14 sins113045.110303-161413.secjyip.bash drwx------ 2 root secgrp 4096 Mar 4 09:15 sins113045.110304-091544.secjyip.ksh [root@sins113045 sudo-io]# [root@sins113045 sudo-io]# sudoreplay -V sudoreplay version 1.8.0 [root@sins113045 sudo-io]# sudoreplay -l [root@sins113045 sudo-io]# sudoreplay -d /var/log/sudo-io usage: sudoreplay [-h] [-d directory] [-m max_wait] [-s speed_factor] ID usage: sudoreplay [-h] [-d directory] -l [search expression] [root@sins113045 sudo-io]# sudoreplay -d /var/log/sudo-io -l [root@sins113045 sudo-io]# ls -l sins113045.110304-091544.secjyip.ksh total 28 -rw------- 1 root secgrp 59 Mar 4 09:15 log -rw------- 1 root secgrp 20 Mar 4 09:15 stderr -rw------- 1 root secgrp 20 Mar 4 09:15 stdin -rw------- 1 root secgrp 20 Mar 4 09:15 stdout -rw------- 1 root secgrp 283 Mar 4 09:15 timing -rw------- 1 root secgrp 48 Mar 4 09:15 ttyin -rw------- 1 root secgrp 408 Mar 4 09:15 ttyout [root@sins113045 sudo-io]# Hope the above helps. There seems to be no ID. Cheers John (In reply to comment #1) > The -d option to sudoreplay corresponds to the iolog_dir option, not > iolog_file. Sudoreplay should probably parse sudoers and read those > values itself so you don't need to pass an option.
Currently, sudoreplay does not know about the iolog_file or iolog_dir settings in sudoers, it expects a 6 digit base-36 number. I'll look into making it more flexible in this regard.
Created attachment 306 [details] Patch to allow sudoreplay to work with arbitrary iolog_file settings With the attached patch you should be able to see the sessions with "sudoreplay -l" and be able to replay them with, e.g. "sudoreplay sins113045.110304-091544.secjyip.ksh"
This is fixed in 1.8.1 which is currently in beta test, see http://www.sudo.ws/sudo/devel.html
Fixed in sudo 1.8.1