tlog — Record User Terminal Sessions

tlog records terminal activity for auditing and troubleshooting.

Install

dnf install -y tlog

Create a test user

useradd audituser
passwd audituser

Set tlog as the login shell:

usermod -s /usr/bin/tlog-rec-session audituser

Check:

getent passwd audituser

Expected shell:

/usr/bin/tlog-rec-session

Generate a recording

Login as the user:

ssh audituser@servera

Run some commands:

whoami
pwd
ls -l
cat /etc/hostname

Then:

exit

Find recordings

journalctl _COMM=tlog-rec-sessio

Filter by user:

journalctl _COMM=tlog-rec-sessio | grep audituser

Look for the recording ID:

"rec":"<RECORDING_ID>"

Replay a session

tlog-play -r journal -M TLOG_REC=<RECORDING_ID>

Remember

user login
   ↓
tlog-rec-session
   ↓
session stored in journal
   ↓
find recording ID
   ↓
tlog-play

By default, tlog mainly records terminal output; keyboard input such as passwords is not normally recorded.