Home / ubuntu / Questions / 446079
Accepted
Aditya
Asked: 2014-04-11 09:17:16 +0800 CST

How to make sudoreplay work?

  • 772

I recently discovered sudoreplay whose manpage says that it replays sudo session logs. But I am not sure how do I make it work. For whatever little commands I ran it kept on saying that /var/log/sudo-io doesn't exist.

$ sudoreplay -l user aditya command apt-get
sudoreplay: unable to open /var/log/sudo-io: No such file or directory

$ sudoreplay -l fromdate yesterday
sudoreplay: unable to open /var/log/sudo-io: No such file or directory

The man page says:

/var/log/sudo-io          The default I/O log directory.

It looks like I need to enable logging and it isn't enabled by default. What changes do I need to make to use sudoreplay?

command-line

2 Answers

  1. Best Answer

    To add support for sudoreplay, we need to edit the /etc/sudoers file. For this, execute the following command:

    $ sudo visudo

    This would open the sudoers file for us. Then insert the following lines at the end of the file and save it:

    Defaults log_output
Defaults!/usr/bin/sudoreplay !log_output
Defaults!/sbin/reboot !log_output

    It will automatically create the directory /var/log/sudo-io when the visudo command successfully exits AND you run sudo su -.

    If it fails then that probably means that your version of sudoers package is out of date. Upgrade the package and try again.

    To run a sudoreplay session - who do you need to be? root ofcourse, so

    $ sudo sudoreplay -l
Nov 28 11:48:35 2014 : chrthomp : TTY=/dev/pts/1 ; CWD=/home/chrthomp/DJS/2014/Nov ; USER=root ; TSID=000001 ; COMMAND=/bin/su -

$ sudo sudoreplay 000001

    will replay the session at normal speed.

    If you ever have problems with sudoreplay check that the /var/log/sudo-io folder exists. If it doesn't, you NEED to go and create the directory as root.

    $ sudo mkdir -m 750 /var/log/sudo-io
    • 7

  2. You need to go and create the directory as root.

    $ mkdir -m 750 /var/log/sudo-io

    then you need to enable logging in the sudoers file: Add the following 3 lines........

    Defaults log_output
Defaults!/usr/bin/sudoreplay !log_output
Defaults!/sbin/reboot !log_output
    • 2