[sudo-users] sudoreplay -l filter weirdness
Todd C. Miller
Todd.Miller at courtesan.com
Wed Sep 4 20:45:18 MDT 2013
On Wed, 04 Sep 2013 21:13:57 -0400, "Michael W. Lucas" wrote:
> # sudoreplay -l fromdate 4 hours ago
> sudoreplay: unknown search term "hours"
> # sudoreplay -l fromdate this week
> sudoreplay: unknown search term "week"
You need to quote those. E.g.
# sudoreplay -l fromdate "4 hours ago"
# sudoreplay -l fromdate "this week"
I don't think that "this week" by itself actually does what it
sounds like it should.
> It appears that "todate" with dates matches only before, not on, the
> given date?
It's possible that this is a documentation error. I'll have to
delve into getdate.y and see.
More information about the sudo-users