tlog session recording vs shellz

Root first. tlog can record root, but Red Hat's RHEL 10 docs say root can disable or bypass the recording, so those recordings aren't reliable evidence. If your auditor samples privileged sessions, this is the deciding issue.

Then reboots. tlog writes to the system journal, and Red Hat says the journal is kept in memory by default. A reboot erases every recording on the server. The fix is one setting: Storage=persistent in /etc/systemd/journald.conf.

tlog runs as the user's login shell. It sits between the terminal and the real shell and saves everything shown on screen to the system journal. SSSD, the RHEL service that connects servers to your user directory, decides which users and groups get tlog as their shell. Cockpit, RHEL's web admin console, has a plugin to play recordings back.

Keystroke recording ships turned off because it saves typed passwords in plain text. Leave it off. For many servers, Red Hat's Ansible role for tlog does the setup for you.

• ›Install it: dnf install tlog
• ›Choose who to record in an SSSD config file, under [session_recording].
• ›Turn it on: authselect select sssd with-tlog, then systemctl restart sssd

• ›Terminals opened in a GNOME desktop aren't recorded.
• ›A recorded user who watches the journal live ends up recording their own recordings. Red Hat's docs give a filter to avoid the loop.
• ›A remote command like ssh admin@client rm -f /some/file is recorded only if recording is set up for that user on that server.

tlog's recordings are plain, unsigned JSON. Anyone who can read the journal can read them. The journal has an optional sealing feature that adds tamper evidence, but only for logs saved to disk, and you have to set up its keys.

To search recordings across servers, you forward them with rsyslog to an Elasticsearch cluster you run. Match on tlog's user ID rather than its program name, because any process can claim that name.

shellz encrypts each session on the server with its own key, signs every segment, and stores recordings so they can't be changed or deleted before retention ends. Every replay requires a fresh sign-in and is logged (security model).

Cockpit's player runs on each server, for admins of that server. That works for five servers and gets painful at fifty. In a terminal, tlog-play can follow a live session and change speed, but it can't rewind.

shellz shows every server in one browser view. You can follow live sessions, replay at any speed, read a transcript, and search by user, source IP, command, server or container.

If you run RHEL with Identity Management, record non-root admins and must keep data in-house, run tlog. Turn on persistent journal storage and forward to a log server you control.

Choose shellz if root is the account you're audited on, if Ubuntu or Debian is in the mix, or if you'd rather not run Elasticsearch to find out who ran a command. It also records AI agents that SSH in under their own accounts. shellz has no self-hosted version and can't block commands, and it doesn't have its own SOC 2 report yet.

Related: shellz vs auditd, what replaces sudo I/O logging on Ubuntu, and shellz pricing.