Syteca (Ekran System) vs shellz for Linux session recording

Auditors ask whether any route to a server skips the recorder. With a gateway or bastion, the answer depends on your network rules, because a session that reaches the server another way leaves no record. Syteca and shellz both install on each server, so it doesn't matter how the user connected.

Syteca's Linux agent records keystrokes, commands (including those inside scripts), system calls and terminal output for SSH and local sessions. If its process is killed, open sessions keep recording.

shellz becomes every account's login shell, so it sees interactive SSH, one-off remote commands, SFTP, su -, tmux, consoles and AI agents that log in. For open-source options, see shellz vs tlog and shellz vs auditd.

Both products encrypt recordings on the server. What matters is who can decrypt them.

Syteca encrypts each piece of a recording with its own key, then locks those keys with a certificate. The private key that unlocks them lives on Syteca's Application Server, which decrypts recordings when someone opens them. If you self-host, that server is yours, and Syteca supports keeping the master key in a Thales hardware security module.

On Syteca SaaS, Syteca runs that server, so by its own architecture docs the decryption key sits with the vendor. Most SaaS works this way, but your vendor risk review should list it as a way a third party could read recordings.

shellz encrypts each session with its own key, on the server. With Perfect Secrecy, the key that unlocks them exists only on your team's passkeys, and shellz staff can't decrypt anything. In standard mode, shellz can release keys to authorized teammates (security design).

On Windows and macOS, Syteca requires an uninstall key to remove its agent, and on Windows a driver stops even administrators from changing its files. Linux gets neither. Root can remove the agent with one uninstall script, and Syteca's docs confirm the uninstall key doesn't apply. Recordings already uploaded are kept, and the server shows as offline.

shellz assumes root may be the person you're watching. Root changes to the recorder are undone within seconds and reported. A server that stops reporting raises an alert within about a minute, and uninstalling needs approval in the dashboard. Root can still interfere with software on its own machine, but not without leaving evidence. Each recording segment is signed and chained to the one before, so a gap or an edit shows up.

As of 3 November 2026, Syteca's documentation doesn't describe the first two items below. That doesn't prove the features are missing, so ask Syteca to confirm in writing or test them yourself.

• ›Container sessions. shellz records docker exec and similar commands as separate sessions, with the container name, image and user, each linked to its SSH login.
• ›One-off remote commands and file transfers. shellz records ssh host cmd and SFTP. Syteca's Linux page describes only interactive SSH and local sessions.
• ›Stopping a session. Syteca can block users on Windows only. shellz can't end sessions on any platform, so neither product stops a Linux session in progress.

Syteca records Windows, RDP, Citrix, macOS, Linux desktops, Solaris and AIX. It adds USB device control, behaviour analytics (UEBA, self-hosted only), and a privileged access module with a password vault and temporary admin rights. For a mixed fleet or a formal insider-threat program, one agent and console for everything outweighs anything shellz offers.

shellz records Linux terminals only. It has no password vault, RDP, command blocking, session termination, SIEM integration, public API or self-hosted version. If you're still deciding whether you need a privileged access management (PAM) suite, read PAM vs session recording.

Syteca's pricing page asks you to request a quote and offers a 30-day trial. One US reseller lists a perpetual Linux recording licence at $1,169.55 per server for 1 to 4 servers, and $916.51 each for 10 to 49 (checked 3 November 2026). Those are reseller prices, not Syteca's. Self-hosting also needs a Windows server and a database.

shellz is free for ten active devices. Commercial is $10 a month per member plus $1 per GB stored, with no device limit. Installing takes one command per server, and the first live session usually appears about two minutes after sign-up.