How to make sudoreplay work?

I recently discovered sudoreplay whose manpage says that it replays sudo session logs. But I am not sure how do I make it work. For whatever little commands I ran it kept on saying that /var/log/sudo-io doesn't exist.

$ sudoreplay -l user aditya command apt-get
sudoreplay: unable to open /var/log/sudo-io: No such file or directory
$ sudoreplay -l fromdate yesterday
sudoreplay: unable to open /var/log/sudo-io: No such file or directory

The man page says:

/var/log/sudo-io The default I/O log directory.

It looks like I need to enable logging and it isn't enabled by default. What changes do I need to make to use sudoreplay?

2 Answers

To add support for sudoreplay, we need to edit the /etc/sudoers file. For this, execute the following command:

$ sudo visudo

This would open the sudoers file for us. Then insert the following lines at the end of the file and save it:

Defaults log_output
Defaults!/usr/bin/sudoreplay !log_output
Defaults!/sbin/reboot !log_output

It will automatically create the directory /var/log/sudo-io when thevisudo command successfully exits AND you run sudo su -.

If it fails then that probably means that your version of sudoers package is out of date. Upgrade the package and try again.

To run a sudoreplay session - who do you need to be? root ofcourse, so

$ sudo sudoreplay -l
Nov 28 11:48:35 2014 : chrthomp : TTY=/dev/pts/1 ; CWD=/home/chrthomp/DJS/2014/Nov ; USER=root ; TSID=000001 ; COMMAND=/bin/su -
$ sudo sudoreplay 000001

will replay the session at normal speed.

If you ever have problems with sudoreplay check that the /var/log/sudo-io folder exists. If it doesn't, you NEED to go and create the directory as root.

$ sudo mkdir -m 750 /var/log/sudo-io

You need to go and create the directory as root.

$ mkdir -m 750 /var/log/sudo-io

then you need to enable logging in the sudoers file: Add the following 3 lines........

Defaults log_output
Defaults!/usr/bin/sudoreplay !log_output
Defaults!/sbin/reboot !log_output