ID plays back or lists the output logs created by When replaying,
     can play the session back in real-time, or the playback speed may
     be adjusted (faster or slower) based on the command line options.
     The should either be a six character sequence of digits and upper
     case letters, e.g., a pattern matching the option in the file, or
     a  path  name.   Path  names may be relative to the option in the
     file (unless  overridden  by  the  option)  or  fully  qualified,
     beginning  with  a  character.   When  a  command is run via with
     enabled in the file, a string is logged via syslog or to the  log
     file.  The may also be determined using list mode.  In list mode,
     can be used to find the ID of a session  based  on  a  number  of
     criteria  such  as the user, tty or command run.  In replay mode,
     if the standard input and output are connected to a terminal  and
     the  option  is  not  specified,  will operate interactively.  In
     interactive mode, will attempt to adjust  the  terminal  size  to
     match that of the session and write directly to the terminal (not
     all terminals support this).   Additionally,  it  will  poll  the
     keyboard  and  act on the following keys: Skip to the next replay
     event; useful for long pauses.  Pause output; press  any  key  to
     resume.   Reduce  the  playback  speed  by  one half.  Double the
     playback speed.  The session can be  interrupted  via  control-C.
     When  the  session  has finished, the terminal is restored to its
     original size if it was changed during playback.  The options are
     as  follows: Store session logs in instead of the default, Select
     which I/O type(s) to  display.   By  default,  will  display  the
     command's  standard  output,  standard error and tty output.  The
     argument is a comma-separated list, consisting of one or more  of
     following:  and Enable When replaying a session, will ignore end-
     of-file and keep replaying until the log is complete.   This  can
     be used to replay a session that is still in progress, similar to
     An I/O log file is considered to be complete when the write  bits
     have  been  cleared  on  the  session's  timing  file.  Note that
     versions of prior to 1.9.1 do  not  clear  the  write  bits  upon
     completion.   Display a short help message to the standard output
     and exit.  Enable In this mode, will list available sessions in a
     format  similar  to  the log file format, sorted by file name (or
     sequence number).  If a is specified, it will be used to restrict
     the  IDs  that  are  displayed.  An expression is composed of the
     following predicates:  Evaluates  to  true  if  the  command  run
     matches  the  POSIX extended regular expression Evaluates to true
     if the  command  was  run  with  the  specified  current  working
     directory.   Evaluates to true if the command was run on or after
     See for  a  description  of  supported  date  and  time  formats.
     Evaluates  to true if the command was run with the specified Note
     that unless a was explicitly specified when was  run  this  field
     will  be  empty in the log.  Evaluates to true if the command was
     run on the specified Evaluates to true if the command was run  as
     the  specified  Note  that  runs  commands  as  user  by default.
     Evaluates to true if the command was run on or prior to See for a
     description  of  supported  date  and time formats.  Evaluates to
     true if the command was run on  the  specified  terminal  device.
     The  should  be  specified  without  the prefix, e.g., instead of
     Evaluates to true if the ID matches a command run  by  Predicates
     may be abbreviated to the shortest unique string.  Predicates may
     be combined using and operators as well  as  and  grouping  (note
     that  parentheses must generally be escaped from the shell).  The
     operator is optional, adjacent predicates have an implied  unless
     separated  by  an  Specify  an  upper  bound  on how long to wait
     between key presses or output data.  By default, will  accurately
     reproduce  the  delays  between  key  presses  or program output.
     However, this can be  tedious  when  the  session  includes  long
     pauses.  When the option is specified, will limit these pauses to
     at most seconds.  The value may be specified as a floating  point
     number,  e.g.,  A  of  zero  or  less  will  eliminate the pauses
     entirely.  Do not prompt for user input or attempt to re-size the
     terminal.   The  session  is  written to the standard output, not
     directly to the user's terminal.  Do not attempt to  re-size  the
     terminal  to  match the terminal size of the session.  Wait while
     the command was suspended.  By  default,  will  ignore  the  time
     interval  between  when the command was suspended and when it was
     resumed.  If the option is specified, will  wait  instead.   This
     option  causes  to  adjust  the  number  of  seconds it will wait
     between key presses or program output.  This can be used to  slow
     down  or  speed up the display.  For example, a of would make the
     output twice as fast whereas a of would make the output twice  as
     slow.   Print the versions version number and exit.  The time and
     date may be specified multiple ways, common formats  include:  24
     hour  time  may  be  used in place of am/pm.  24 hour time may be
     used  in  place  of  am/pm,  and  month  and  day  names  may  be
     abbreviated.   Note  that month and day of the week names must be
     specified in English.  ISO time format  The  month  name  may  be
     abbreviated.   Either  time or date may be omitted, the am/pm and
     timezone are optional.  If no date is specified, the current  day
     is  assumed;  if  no  time  is specified, the first second of the
     specified date is used.  The less significant parts of both  time
     and date may also be omitted, in which case zero is assumed.  The
     following are all valid time and date specifications: The current
     time and date.  Exactly one day from now.  24 hours ago.  2 hours
     ago.  The first second of the Friday in the next (upcoming) week.
     Not  to  be  confused  with  which  would match the Friday of the
     current week.   The  current  time  but  7  days  ago.   This  is
     equivalent  to  The  current  time  but  14  days ago.  10:01 am,
     September 17, 2009.  10:01 am on the current day.   10:00  am  on
     the  current  day.   00:00  am,  September  17,  2009.  10:01 am,
     September 17, 2009.  Note that relative  time  specifications  do
     not  always  work  as  expected.   For  example, the qualifier is
     intended to be used in conjunction with a day such as  When  used
     with  units  of  weeks, months, years, etc the result will be one
     more than expected.  For example, will result in a  time  exactly
     two  weeks  from  now,  which  is probably not what was intended.
     This will be addressed in a future version of versions 1.8.4  and
     higher  support a flexible debugging framework that is configured
     via lines in the  file.   For  more  information  on  configuring
     please  refer  to  its manual.  Debugging framework configuration
     The  default  I/O  log  directory.   Example  session  log  info.
     Example session log info (JSON format).  Example session standard
     input log.  Example session standard output log.  Example session
     standard  error  log.   Example  session tty input file.  Example
     session tty output file.  Example session timing file.  Note that
     the and files will be empty unless was used as part of a pipeline
     for a particular command.  List sessions run by user # sudoreplay
     -l  user  millert  List  sessions  run  by  user  with  a command
     containing the string vi: # sudoreplay -l  user  bob  command  vi
     List  sessions  run  by  user  that match a regular expression: #
     sudoreplay -l user jeff command '/bin/[a-z]*sh' List sessions run
     by  jeff  or  bob  on the console: # sudoreplay -l ( user jeff or
     user bob ) tty console Many people have worked on over the years;
     this  version  consists  of  code  written  primarily by: See the
     CONTRIBUTORS        file        in        the        distribution
     ( for an exhaustive list of
     people who have contributed to If you feel you have found  a  bug
     in  please  submit  a  bug  report  at
     Limited free support is  available  via  the  sudo-users  mailing
     list,   see  to
     subscribe or search the archives.  is provided and any express or
     implied  warranties,  including,  but not limited to, the implied
     warranties  of  merchantability  and  fitness  for  a  particular
     purpose are disclaimed.  See the LICENSE file distributed with or for complete details.