Syntax
pmlog [-dlvq] [-p|a|e|r|x <printexpr>] [-f <filename>] [[-c] <constraint>] [[-c] <constraint>] [-f <filename>] -h [--user <username>] [--runuser <username>] [--runhost <hostname>] [--reqhost <hostname>] [--masterhost <hostname>][--command <pattern>] [--reqcommand <pattern>] [--runcommand <pattern>][--before "<YYYY/MM/DD hh:mm:ss>"] [--after "<YYYY/MM/DD hh:mm:ss>"][--result Accept|Reject]
Description
Use the pmlog command to selectively choose and display entries in a Privilege Manager for Unix event log. Each time a job is accepted, rejected, or completed by pmmasterd, an entry is appended to the file specified by the eventlog variable in the configuration file. eventlog is sent to /var/opt/quest/qpm4u/pmevents.db on all platforms.
Options
pmlog has the following options.
Option | Description |
---|---|
-a <expression> |
Sets the print expression for accept events to the specified expression. |
-c <constraint> |
Selects particular entries to print; specify constraint as a Boolean expression. For more information, see Examples. |
-d |
Dumps each entry as it is read without matching 'accept' and 'end' entries. The -d (dump) option forces pmlog to print each entry as it is read from the file. The default output format includes a unique identifier at the start of each record, allowing 'end' events to be matched with 'accept' events. |
-e <expression> |
Sets the print expression for finish events to the specified expression. |
-f <filename> |
Reads the event log information from the specified file. |
-h |
Displays usage information. |
-l |
Dumps alert log entries only. |
-p <expression> |
Sets the print expression for all event types to the specified expression. |
-q |
Runs in quiet mode; no expression errors (for example, undefined variables) are printed. |
-r <expression> |
Sets the print expression for reject events to the specified expression. |
-v |
Turns on verbose mode. |
-x <expression> |
Sets the print expression for alert events to the specified expression. |
Quick Search Options | |
--user <username> |
Selects entries in which the requesting user matches username. |
--runuser <username> |
Selects entries in which runuser matches username. |
--runhost <hostname> |
Selects entries in which runhost matches hostname. |
--reqhost <hostname> |
Selects entries in which the requesting host matches hostname. |
--masterhost <hostname> |
Selects entries in which masterhost matches hostname. |
--command <pattern> |
Selects entries in which the requested command matches pattern. |
--reqcommand <pattern> |
Return events where the given text appears anywhere in the requested command line. |
--runcommand <pattern> |
Selects entries in which the runcommand host matches pattern. |
--before "<YYYY/MM/DD hh:mm:ss>" |
Selects entries occurring before the specified date and time. |
--after "<YYYY/MM/DD hh:mm:ss>" |
Selects entries occurring after the specified date and time. |
--result Accept|Reject |
Selects entries that were accepted or rejected. |
Examples
Without arguments, pmlog reads the default eventlog file and prints all its entries. If you have chosen a different location for the event log, use the -f option to specify the file for pmlog.
By default, pmlog displays one entry for each completed session (either rejected or accepted). You can filter the results to print only entries which satisfy the specified constraint using the -c option. In these examples the -c option is used to specify a constraint as a Boolean expression:
pmlog -c'event=="Reject"'
pmlog -c'date > "2008/02/11"'
pmlog -c'user=="dan"'
Which prints only rejected entries, entries that occur after February 11, 2008, or requests by user Dan, respectively.
For more information about policy variables, see Safeguard for Sudo Variables.
The following options accept shortcut notations to specify constraints:
-
--user username
-
--runuser username
-
--reqhost hostname
-
--runhost hostname
-
--masterhost hostname
-
--command command
-
--runcommand command
-
--reqcommand command
-
--before "YYYY/MM/DD hh:mm:ss"
-
--after "YYYY/MM/DD hh:mm:ss"
-
--result Accept|Reject
For example, here are equivalent constraints to the previous example specified using shortcuts:
pmlog --result Reject
pmlog --after "2008/02/11 00:00:00"
pmlog --user dan
With shortcuts, you can express user names and host names as patterns containing wild card characters (? and *). For example, to display entries for all requests for user1, user2, and user3, use the following shortcut:
pmlog --user “user?"
Enclose patterns containing wild card characters in quotes to avoid being interpreted by the command shell.
Use the -d and -v options for debugging. Normally, when pmlog finds an 'accept' entry, it refrains from printing until the matching 'end' entry is found; all requested information including exitstatus, exitdate, and exittime is then available to print.
The -d (dump) option forces pmlog to print each entry as it is read from the file. The default output format includes a unique identifier at the start of each record, allowing 'end' events to be matched with 'accept' events.
The -v (verbose) option prints all the variables stored with each entry.
The -t option turns on tail follow mode. The program enters an endless loop, sleeping and printing new event records as they are appended to the end of the log file. The -d flag is implied when using -t.
You can specify the output format for each of the three event types - 'accept', 'reject' or 'finish' - with the -a, -r, and -e options. Use the -p option to set the output for all three event types.
For example, to print only the dates and names of people making requests, enter one of the following:
pmlog -p'date + "\t" + user + "\t" + event'
pmlog -p 'sprintf("%s %-8s %s", date, user, event)'
For more examples of using the pmlog command, see Listing event logs.
NOTE If you run pmlog --csv console to obtain CSV output from pmlog. For a list of the column headings, see pmlogsearch.