-
Title
Cannot replay sessions.Keystroke logging is not working. -
Description
Cannot replay sessions. Keystroke logging is not working. -
Cause
Configuration issue.CAUSE 1:The sudoers policy only had the log_input option configured. Because of this, only the user’s input keystrokes are captured but the output was not.CAUSE 2:The policy server group does not exist -
Resolution
RESOLUTION 1:
The PrivilegeManager for Sudo keystroke log is only recording the user's input or no data is being recorded.To record both input and output, perform the following steps:
1. From the management console, navigate to the Sudo | Sudoers Policy tab.
2. Open the Open menu and select Current version to open the latest saved version of the sudoers policy file that is currently in use by the management console.
3. Add the following as the top line of the sudoers file to enable keystroke logs:
Defaults log_input,log_output
4. Save and close the sudoers file.
RESOLUTION 2:
Management Console for Unix (MCU) would not be able to report on the events for the policy group if the primary policy server for the policy group is not available.
1 - Check pmlog group exists in the /etc/group file
2 - Check the /etc/opt/quest/qpm4u/pm.settings file and look for the following setting "pmlogGroup pmlog"
-
Additional Information
Note that there was a change in the iologging between QPM for Sudo 1.0 and 2.0. In 1.0, using either the log_input, or log_output Defaults would cause both stdin and stdout to be recorded. In 2.0, both log_input and log_output must be specified if you wish to capture both stdin and stdout