Safeguard for Sudo 7.2.2 - Administration Guide

Syntax

pmreplay -V 
pmreplay -[t|s|i] -[Th] <filename> 
pmreplay -[e][I][o] -[EhKTv] <filename> 

Description

Use the pmreplay command to replay a log file to review what happened during a specified privileged session. The program can also display the log file in real time.

When using Safeguard for Sudo, enable keystroke logging by configuring the log_input and log_output variables. Please consult your sudoers manual for more information about configuring keystroke logging.

pmreplay can distinguish between old and new log files. If pmreplay detects that a log file has been changed, a message displays to tell you that the integrity of the file cannot be confirmed. This also occurs if you run pmreplay in real time and the Safeguard session that generated the events in the log file is active; that is, the client session has not completed or closed yet. In this case, the message does not necessarily indicate that the file has been tampered with.

The name of the I/O log is a unique filename constructed with the mktemp function using a combination of policy file variables, such as username, command, date, and time.

Safeguard sets the permissions on the I/O log file so that only root and users in the pmlog group can read it. That way, ordinary users cannot examine the contents of the log files. You must be logged in as root or be a member of the pmlog group to use pmreplay on these files. You may want to allow users to use Safeguard to run pmreplay.

By default pmreplay runs in interactive mode. Enter ? to display a list of the interactive commands you can use to navigate through the file.

For example, replay a log file interactively by typing:

pmreplay /var/opt/quest/qpm4u/iolog/demo/dan/id_20130221_0855_gJfeP4 

the results will show a header similar to this:

 Log File : /var/opt/quest/qpm4u/iolog/demo/dan/id_20130221_0855_gJfeP4 Date : 2013/02/21 Time : 08:55:17 Client : dan@sala.abc.local Agent : root@sala.abc.local Command : id Type ’?’ or ’h’ for help

Type ? or h at any time while running in interactive mode to display the list of commands that are available.

Options

pmreplay has the following options.

Table 38: Options: pmreplay

Option	Description
-e	Dumps the recorded standard error.
-E	Includes vi editing sessions when used with -K.
-h	When used with -o or -I, prints an optional header line. The header is always printed in interactive mode.
-i	Replays the recorded standard input.
-I	Dumps the recorded standard input, but converts carriage returns to new lines in order to improve readability.
-K	When used with -e, -I, and -o, removes all control characters and excludes vi editing sessions. Use with -E to include vi editing sessions.
-o	Dumps the recorded standard output.
-s	Automatically replays the file in slide show mode. Use + and - keys to vary the speed of play.
-t	Replays the file in tail mode, displaying new activity as it occurs.
-T	Displays command timestamps.
-v	Prints unprintable characters in octal form (\###)
-V	Displays the Safeguard version number.

Exit codes

pmreplay returns these codes: