Re: sudoreplay with agrument command not working?

I spoke too soon, since sudoreplay does a depth-first traversal it
will find I/O logs in non-default locations as long as they are
somewhere under the default I/O log directory.

However, it will only find the command that was initially run via
sudo.  In other words, if the session was for a shell, sudoreplay
will not find commands run from within that shell.  There is no
full-text search of the I/O logs.

The I/O logs are just gzip'd files so you could use something like
zgrep to search for specific strings within the logs.

 - todd
____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users