Tlog Guide: The “Security Camera” for Recording Every Linux Terminal Session

The Problem: When Command History Lies

Have you ever stayed up all night trying to trace who accidentally typed rm -rf on a server? I’ve been in that situation when an SSH brute-force bot successfully broke in. Digging through fragmented logs at 2 AM is a truly miserable experience.

Many still put absolute faith in the .bash_history file. However, a malicious actor only needs a single history -c or unset HISTFILE command to make all traces vanish. More dangerously, history only records what the user types; it doesn’t show you the returned output or what they modified inside vi or nano.

If you are managing a system with multiple Admins or hiring external vendors for maintenance, a lack of oversight is a fatal vulnerability. Tlog is the solution to “fix” this problem once and for all.

Why tlog and not other tools?

Tech professionals often weigh several options. Let’s look at the reality:

• script command: Available on every Linux machine. It logs to text files but is extremely easy to delete. One rm and you’re left empty-handed.
• Auditd: Very powerful for tracking system calls. Conversely, its logs are incredibly difficult for humans to read and it lacks a replay feature.
• tlog: Records sessions as JSON and pushes them directly to journald. You can forward these logs to a centralized server (like ELK or Graylog). Users have almost no way to tamper with or delete these logs.

Valuable advantages of tlog:

• Records every keystroke, backspace, and all displayed output.
• The Replay feature lets you watch the session like a screen recording video.
• JSON format makes searching logs with centralized management tools extremely simple.

Install tlog in just 30 seconds

Tlog is a favorite in the Red Hat ecosystem (RHEL, AlmaLinux, Rocky Linux), but it runs smoothly on Ubuntu as well.

For RHEL/CentOS/Rocky:

sudo dnf install tlog -y

For Ubuntu/Debian:

sudo apt update && sudo apt install tlog -y

Configuring Session Recording

You have two choices: a quick configuration for a few users or a proper setup for the entire system.

Option 1: Force users through tlog (For individuals)

Instead of letting users directly into /bin/bash, we wrap them in tlog-rec-session. Let’s try it with the user dev-user:

sudo usermod -s /usr/bin/tlog-rec-session dev-user

From now on, every time dev-user logs in via SSH, all their actions will be right under your nose.

Option 2: Using SSSD (For Enterprise)

If the server is connected to Active Directory, edit the file /etc/sssd/conf.d/sssd-session-recording.conf:

[session_recording]
scope = all # Record everyone on the system

Don’t forget to restart the service to apply changes:

sudo systemctl restart sssd

How to Replay Like a Movie

This is where tlog shines. Since the data is in journald, we use journalctl to fetch the data and tlog-play to play it back.

Find the Recording ID:

journalctl -t tlog-rec-session

Start Playback:

To replay the most recent session, run the command:

journalctl -t tlog-rec-session -o cat | tlog-play

The screen will display every key they pressed and every typo they deleted. It feels like you’re sitting right behind them.

Real-world Experience and Key Considerations

Don’t just store logs on the server itself. If a hacker gains root access, they can still tamper with journald.

Push logs to a centralized server using systemd-journal-remote. That way, even if the main server’s data is wiped, you still have secure digital evidence kept elsewhere.

Be Careful with Disk Space

Tlog records everything. If a user runs commands that refresh constantly, like top or htop, for 10 minutes, the log can take up 5-10MB. With 100 active users, log files will swell quickly. Ensure you’ve configured Log Rotation for journald to avoid system hangs due to full disks.

System Performance

Based on real-world testing, tlog introduces extremely low latency, usually under 1-2% CPU usage. Regular users will never realize they are being recorded.

Conclusion

Tlog isn’t just an employee monitoring tool. It’s a security layer that helps you answer the question: “Who changed the Nginx config at 2 AM and crashed the site?”.

Instead of guessing, just open the replay and find the cause in minutes. Install tlog today. Don’t wait until an incident occurs to regret not knowing what actually happened.