[sudo-users] sudoreplay logs from syslog-server

[Todd C. Miller]

On Wed, 07 Sep 2011 10:14:08 +0200, Sebastian Ohliger wrote:

> is it possible with sudoreplay to replay sessions logged to an
> syslog-server?  We're using sudo with local logging on each server
> and sometimes user starts an top or nmon and he forget his session...
> Now we're implementing a new concept for user management, for
> sudo I don't wan't to store logs local.

The session logs are not plain text and so are not really suitable
for syslog, which is why they are currently only logged locally.
Remote logging of session would require a separate log daemon.

The sourceforge project sslogger comes with a dameon, slogd that
could probably be used if a sudo I/O logging plugin was written for
it.

 - todd