How alun-hub/sudo-logger works
sudo-logger enforces privileged-session recording: the sudo plugin streams I/O to a local agent, which relays it to a central server for acknowledged recording. Operators then search and replay sessions in the web console and manage policy, approvals, users, and integrations. The graph preserves documented eBPF bypass detection, redaction, cgroup freezing, SIEM, and distributed storage capabilities. Some subsystem links rely on the README because their implementation files were not sampled; those evidence limits are reflected by omitting unverified call edges.
Main entry points: session_conn.go Log server · main.go Local agent · SessionList.tsx Session search · store.go Session storage
Components 19
Endpoint capture
- Sudo I/O plugin
plugin/plugin.c - Local agent
go/cmd/agent/main.go - eBPF recorder
go/cmd/agent/bpf/recorder.c - Divergence detection
go/cmd/agent/divergence.go
Session transport
- Wire protocol
go/internal/protocol/protocol.go
Server and storage
- Log server
go/cmd/server/session_conn.go - Recording and redaction
go/internal/iolog/iolog.go - Session storage
go/internal/store/store.go - Distributed storage
go/internal/store/distributed.go - Replay API
go/cmd/replay-server/handlers_session.go
Replay console
- Web application
go/cmd/replay-server/ui/src/App.tsx - Session search
go/cmd/replay-server/ui/src/components/sessions/SessionList.tsx - Session replay
go/cmd/replay-server/ui/src/components/terminal/TerminalPlayer.tsx - Admin controls
go/cmd/replay-server/routes.go
Security controls
- JIT policy engine
go/internal/policy/engine.go - SIEM forwarding
go/internal/siem/sender.go - Approvals
go/cmd/server/approval.go
Other components
- Sudo user
- Remote log server
Connections 18
- Sudo user → Sudo I/O plugin: starts sudo
README.md - Sudo I/O plugin → Local agent: streams I/O
README.md - Local agent → Remote log server: forwards sessions
README.md - Remote log server → Log server: receives sessions
README.md - Log server → Local agent: signed ACKs
README.md - Local agent → Wire protocol: frames messages
- Log server → Recording and redaction: writes recordings
README.md - Log server → Session storage: stores sessions
- Session storage → Distributed storage: selects backend
- eBPF recorder → Local agent: records sessions
README.md - Local agent → Divergence detection: detects bypasses
README.md - Replay API → Session storage: opens recordings
go/cmd/replay-server/handlers_session.go - Web application → Session search: routes sessions
go/cmd/replay-server/ui/src/App.tsx - Session search → Replay API: queries sessions
- Session search → Session replay: selects replay
- Admin controls → JIT policy engine: manages policy
- Log server → Approvals: handles approvals
- Log server → SIEM forwarding: forwards events