The following variables are used to control the logging of program input and output through Privilege Manager for Unix.

Table 19: Logging variables

Variable	Explanation
iolog	If set to a filename, the iolog variable logs all of the information from the logstdin, logstdout, and logstderr variables to the specified filename.
logstderr	If set to true, the logstderr variable logs any error responses.
logstdin	If set to true, the logstdin variable logs all information coming in from standard input.
logstdout	If set to true, the logstdout variable logs all information being displayed to standard output.

For details about these logging variables, refer to Global output variables.

To log the input, output and error I/O streams from a request, set logstdin, logstdout, and logstderr to true. Set iolog to the name of the log file. After Privilege Manager for Unix completes the request, you can use the pmreplay command to replay the session that was logged.

You can limit the amount of data logged for each stream. This avoids filling up the I/O logs with large amounts of output from benign commands, such as when using cat or tail to display a large file. You can limit the I/O logging to the first n bytes of the output. For example, to log only the first 500 bytes of stdout, enter:

iolog_opmax=500;

The following example ensures that whenever you run the adduser program through Privilege Manager for Unix, it logs all input and output in the specified file:

if(command=="adduser") { 
   iolog="/var/log/iolog/" + user + mktemp("_XXXXXX"); 
   logstdin=true; 
   logstdout=true; 
   logstderr=true; 
   runuser="root"; 
   accept; 
}