[sudo-users] sudoreplay with agrument command not working?

[Todd C. Miller]

You need to specify the directory if it is not the default value.
For example, something like:

# sudoreplay -d /var/log/sudo-io/isc-zas -l user isc-zas command /usr/bin/less

Or just:

# sudoreplay -d /var/log/sudo-io/isc-zas -l command /usr/bin/less

since you appear to be using per-user I/O log directories.

sudoreplay doesn't know about the iolog_dir setting in sudoers.

 - todd