1

I have the ability to configure IO logging for sudo by setting iolog_dir, and according to the sudoers man page, these are the following variables I can use:

%{seq}
expanded to a monotonically increasing base-36 sequence number, such as 0100A5, where every two digits are used to form a new directory, e.g. 01/00/A5

%{user}
expanded to the invoking user's login name

%{group}
expanded to the name of the invoking user's real group ID

%{runas_user}
expanded to the login name of the user the command will be run as (e.g. root)

%{runas_group}
expanded to the group name of the user the command will be run as (e.g. wheel)

%{hostname}
expanded to the local host name without the domain name

%{command}
expanded to the base name of the command being run

I understand the purpose of all of these variables, except for %{seq}. I can't see a benefit of expanding a variable that produces something like this. Can someone explain why this exists?

EDIT: My coworker actually found an answer for me. It seems that you can use a command called sudoreplay along with a given sequence number to literally replay a given sudo session in real time. I didn't know about it before today, and it's pretty cool to see it happen in my terminal, but I don't think I will ever actually use it.

  • I would assume its the userID. just a guess. – Frank Thomas Jan 10 '18 at 19:51
  • See this article – harrymc Jan 10 '18 at 20:45
  • I had already seen that article, but it didn't explain the purpose of a sequence number. Luckily, my coworker actually found an answer for me. It seems that you can use a command called sudoreplay along with a given sequence number to literally replay a given sudo session in real time. – Nathan Lee Jan 10 '18 at 21:21
  • It would be better to post the answer as an answer not an edit to the question - then you can accept it and thus it does not show as an unanswered quesion – Ross Jan 10 '18 at 22:52
0

My coworker actually found an answer for me. It seems that you can use a command called sudoreplay along with a given sequence number to literally replay a given sudo session in real time. I didn't know about it before today, and it's pretty cool to see it happen in my terminal, but I don't think I will ever actually use it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.