tlog-rec-session(8)
π tlog-rec-session(8) β the System Manager's Manual glow-up π
okay bestie, pull up a chair, because we're talking about tlog-rec-session β a program from the Tlog family, and honestly? it's giving "quietly running your entire login session and writing down everything you do" main character energy. π
β¨ NAME β¨
tlog-rec-session β start a shell and log terminal I/O π¦
πΈ SYNOPSIS πΈ
tlog-rec-session [OPTION...] [CMD_FILE [CMD_ARG...]]
tlog-rec-session -c [OPTION...] CMD_STRING [CMD_NAME [CMD_ARG...]]
like, two whole shapes of invocation. pick your fighter. π
π DESCRIPTION π
so tlog-rec-session is a terminal session I/O logging program, and its whole job is to be used as the login shell for a user. the actual user shell that it's gonna start? it gets that from configuration or from the environment. it does not just vibe in there β nope, it starts the actual shell under a pseudo-TTY, hooks it up to the actual terminal, and logs literally everything passing between them: user input, program output, and even terminal window size changes. full surveillance, but make it cute. πβ¨
no cap:tlog-rec-sessionwill not start recording if another process with the same audit session ID (as seen in/proc/PID/sessionid) is already being recorded. instead, it will simply start the shell. one recording per session, we don't double-dip. π
now for the argument lore, because this is the part everyone skips and then gets confused about:
- if no
-coption is specified, then the first non-option argumentCMD_FILEspecifies the location of a shell script the shell should read, and the following arguments (CMD_ARG) specify its arguments. π - if the
-coption is specified, then a non-option argumentCMD_STRINGis required and should contain shell commands to execute. the following arguments can specify first the script name (CMD_NAME, i.e.argv[0]) and then its arguments (CMD_ARG). π§ - if no non-option arguments are encountered, or the
-ioption is specified, then the shell is started interactively. periodt. π¬
πͺ the name-based identity crisis (affectionate)
if tlog-rec-session is invoked under a name beginning with a dash (i.e. argv[0] beginning with -), then the executed shell name is also prepended with a dash. this passes the "login shell" status to the recorded shell and is equivalent to using the -l option. π«Ά
if tlog-rec-session is invoked under a name containing -shell-, then the rest of the name after that string is considered an encoded absolute path to the shell to execute for the recorded session. the path is expected to be encoded by replacing all forward slashes / with dashes - and any characters to be preserved as is prepended with a backslash \. e.g. to have tlog-rec-session execute /bin/dash as the shell, invoke it with the name tlog-rec-session-shell-bin-dash. π₯
this is normally done by making a symlink with that name pointing to tlog-rec-session, and then executing the link. such links can be assigned to users as their shells to have specific shells started under recording for specific users. it's giving β¨personalizedβ¨.
ποΈ where the settings come from (priority list, bestie)
tlog-rec-session loads its parameters in this exact order, and each source overrides the previous one in turn:
- the system-wide configuration file
/etc/tlog/tlog-rec-session.confπ - then the file pointed at by the
TLOG_REC_SESSION_CONF_FILEenvironment variable (if set) π - then the contents of the
TLOG_REC_SESSION_CONF_TEXTenvironment variable (if set) π - and then command-line options π€
later ones win. that's the whole chain. don't fight it. π
π OPTIONS π
general options
-h,--helpβ output a command-line usage message and exit. the "help me bestie" button. π-v,--versionβ output version information and exit. π·οΈ--configurationβ output program configuration in JSON and exit. yes, JSON. yes, pretty. π-l,--loginβ make the shell a login shell.
if specified, the shell is signalled to act as a login shell. this is done by prepending argv[0] of the shell with a dash character. π
-i,--interactiveβ make the shell an interactive shell.
if specified, tlog-rec-session passes the -i option to the shell. π¬
-c,--commandβ execute shell commands.
if specified, tlog-rec-session passes the -c option to the shell, followed by all the positional arguments, which specify the shell commands to execute along with command name and its arguments. β¨οΈ
πΏ ENVIRONMENT πΏ
TLOG_REC_SESSION_CONF_FILEβ specifies the location of a configuration file to be read. the configuration parameters in this file override the ones in the system-wide configuration file/etc/tlog/tlog-rec-session.conf. πTLOG_REC_SESSION_CONF_TEXTβ specifies the configuration text to be read. the configuration parameters in this variable override the ones in the file specified withTLOG_REC_SESSION_CONF_FILE. πTLOG_REC_SESSION_SHELLβ specifies the shell to spawn. overrides configuration specified withTLOG_REC_SESSION_CONF_TEXT. can be overridden by invokingtlog-rec-sessionunder a special name (see above). π
π FILES π
/etc/tlog/tlog-rec-session.confβ the system-wide configuration file π
π EXAMPLES π
start recording a login shell:
tlog-rec-session -l
ask the recorded shell to execute a command:
tlog-rec-session -c whoami
ate. no crumbs. π₯
π SEE ALSO π
tlog-rec-session.conf(5), tlog-rec(8), tlog-play(8) β go read the whole friend group, they're all iconic. π
π AUTHOR π
Nikolai Kondrashov <spbnick@gmail.com> π
and that's the whole page, bestie!! this was Tlog, version dated May 2017, served fresh from the System Manager's Manual. mwah. πβ¨π¦
π¦ where this page comes from
- centos-stream 10: tlog 14-4.el10 Β· GPL-2.0-or-later
- centos-stream 9: tlog 14-1.el9 Β· GPLv2+
- centos-stream 9: tlog 14-1.el9 Β· GPLv2+
- debian bookworm: tlog 12.1-2 Β· GPL-2.0-or-later
- fedora 43: tlog 14-6.fc43 Β· GPL-2.0-or-later
- fedora 43: tlog 14-6.fc43 Β· GPL-2.0-or-later
- fedora 44: tlog 14-7.fc44 Β· GPL-2.0-or-later
- fedora 44: tlog 14-7.fc44 Β· GPL-2.0-or-later
- ubuntu jammy: tlog 12-1 Β· GPL-2.0-or-later
- ubuntu noble: tlog 14-1build2 Β· GPL-2.0-or-later
- ubuntu questing: tlog 14-2
- ubuntu resolute: tlog 14-2.1 Β· GPL-2.0-or-later
- ubuntu stonking: tlog 14-3 Β· GPL-2.0-or-later
- Copyright (C) 2016-2017 Red Hat
- π girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms