Safeguard for Sudo 7.3 - Administration Guide

pmlog [-dlvq] [-p|a|e|r|x <printexpr>] [-f <filename>] [[-c] <constraint>] 
         [[-c] <constraint>] [-f <filename>] -h 
         [--user <username>] 
         [--runuser <username>] [--runhost <hostname>] [--reqhost <hostname>]  
         [--masterhost <hostname>][--command <pattern>] [--reqcommand <pattern>]  
         [--runcommand <pattern>][--before "<YYYY/MM/DD hh:mm:ss>"]  
         [--after "<YYYY/MM/DD hh:mm:ss>"][--result Accept|Reject]

Examples

Without arguments, pmlog reads the default eventlog file and prints all its entries. If you have chosen a different location for the event log, use the -f option to specify the file for pmlog.

By default, pmlog displays one entry for each completed session (either rejected or accepted). You can filter the results to print only entries which satisfy the specified constraint using the -c option. In these examples the -c option is used to specify a constraint as a Boolean expression:

pmlog -c'event=="Reject"'

pmlog -c'date > "2008/02/11"'

pmlog -c'user=="dan"'

Which prints only rejected entries, entries that occur after February 11, 2008, or requests by user Dan, respectively.

For more information about policy variables, see Safeguard for Sudo Variables.

The following options accept shortcut notations to specify constraints:

• --user username

• --runuser username

• --reqhost hostname

• --runhost hostname

• --masterhost hostname

• --command command

• --runcommand command

• --reqcommand command

• --before "YYYY/MM/DD hh:mm:ss"

• --after "YYYY/MM/DD hh:mm:ss"

• --result Accept|Reject

For example, here are equivalent constraints to the previous example specified using shortcuts:

pmlog --result Reject

pmlog --after "2008/02/11 00:00:00"

pmlog --user dan

With shortcuts, you can express user names and host names as patterns containing wild card characters (? and *). For example, to display entries for all requests for user1, user2, and user3, use the following shortcut:

pmlog --user “user?"

Enclose patterns containing wild card characters in quotes to avoid being interpreted by the command shell.

Use the -d and -v options for debugging. Normally, when pmlog finds an 'accept' entry, it refrains from printing until the matching 'end' entry is found; all requested information including exitstatus, exitdate, and exittime is then available to print.

The -d (dump) option forces pmlog to print each entry as it is read from the file. The default output format includes a unique identifier at the start of each record, allowing 'end' events to be matched with 'accept' events.

The -v (verbose) option prints all the variables stored with each entry.

The -t option turns on tail follow mode. The program enters an endless loop, sleeping and printing new event records as they are appended to the end of the log file. The -d flag is implied when using -t.

You can specify the output format for each of the three event types - 'accept', 'reject' or 'finish' - with the -a, -r, and -e options. Use the -p option to set the output for all three event types.

For example, to print only the dates and names of people making requests, enter one of the following:

pmlog -p'date + "\t" + user + "\t" + event'

pmlog -p 'sprintf("%s %-8s %s", date, user, event)'