This topic describes how terminal session audit logging works within the Delphix OS. These logs contain keystroke by keystroke recordings of all terminal activity during a given shell session initiated by a super user (Delphix support).
Super user activity by Delphix support is recorded to an individual log file for each shell session. Each log file is named using the format session_<shell user ip>_<epoch timestamp>. The contents of the logs include commands entered into the shell and the output of those commands. Timestamps are additionally prepended to each line of the log to facilitate assessing the timeline of events.
Session logs created during a super user shell session are kept forever unless deleted by a Delphix engine SYSTEM user.
Listing the session audit logs
Super user session logs can be reviewed/deleted through the CLI or API and downloaded through the API only. Any DOMAIN or SYSTEM user can list the current logs or download a given log file but only SYSTEM users can delete them. To review a list of the session logs currently present on a Delphix engine:
Login to the Delphix CLI using admin or sysadmin credentials.
Navigate to superuser session and press enter.
Use list or ls to view the files.
ip-12-345-678-90 superuser session> ls Objects NAME IPADDRESS STARTTIMEUTC DURATION session_123.45.678.90_1686923517171 123.45.678.90 2023-06-16T13:51:57.171Z 20sec session_123.45.678.90_1686923559856 123.45.678.90 2023-06-16T13:52:39.856Z 439sec session_123.45.678.90_1686924008788 123.45.678.90 2023-06-16T14:00:08.788Z 87sec
Here is an example of calling the list API directly using curl:
curl -b ~/cookies.txt -X GET "http://mydelphixengine.myorg.com/resources/json/delphix/superuser/session"
Downloading a session audit log
Any DOMAIN or SYSTEM user can download a super user session log file via the Delphix API. Here is an example of calling the download API using curl:
curl -v -O -J "http://mydelphixengine.myorg.com/resources/json/delphix/superuser/session/download?sessionLogName=session_123.45.678.90_1686923517171" -b ~/cookies.txt
Reviewing a session audit log
It is recommended that session logs be viewed through a program such as cat, which is capable of interpreting control characters. This is because the logs not only include key strokes and terminal output, but also the control characters that dictate how that output was formatted and displayed, ensuring that the logs reflect what was actually seen during the shell session as accurately as possible. It is also possible to view the logs using any text editor, but in most cases this will be more difficult to read because the control characters themselves will be visible. Here is a snippet from a brief session log as it might be displayed by cat:
[2023-06-16T13:52:28.061Z] delphix:~$ echo testing 123 [2023-06-16T13:52:28.062Z] testing 123 [2023-06-16T13:52:30.599Z] delphix:~$ exit
Note that each line of the log includes a timestamp. This timestamp is prepended to each line as the log is written. It is not from the session terminal output, but rather is provided to more conveniently assess the timeline of a given session. The timestamp is generated in the instant before a given command is executed rather than when the prompt was first printed to the terminal to maximize its accuracy.
Shell activity that involves opening a pager or buffer (e.g. less, more, vi, etc.) may not be fully reflected in the session log, though the command that initiates the pager/buffer will be present. For example, if a super user opens a file in vi for editing, the line to open the file would be present, followed by the next command run after vi was closed.
Deleting a session audit log
These audit logs are meant to live as long as they are needed, and thus are not governed by a retention policy. Should you wish to delete a log this can be done by SYSTEM users only through the Delphix CLI or API. To use the CLI:
Login to the Delphix CLI using sysadmin credentials.
Navigate to superuser session and press enter.
Review the current log files using list or ls
Select the log file that you wish to delete.
Use list or ls to review the log details and confirm this is the log you want to delete.
Type delete and press enter.
Type commit and press enter to delete the log.
ip-12-345-678-90 superuser session> select "session_123.45.678.90_1686923517171" ip-12-345-678-90 superuser session 'session_123.45.678.90_1686923517171'> ls Properties type: SuperuserSession name: session_123.45.678.90_1686923517171 duration: 20sec ipAddress: 123.45.678.90 reference: SUPERUSER_SESSION-session_123.45.678.90_1686923517171 startTimeUTC: 2023-06-16T13:51:57.171Z Operations delete ip-12-345-678-90 superuser session 'session_123.45.678.90_1686923517171'> delete ip-12-345-678-90 superuser session 'session_123.45.678.90_1686923517171' delete *> commit ip-12-345-678-90 superuser session> ls Objects NAME IPADDRESS STARTTIMEUTC DURATION session_123.45.678.90_1686923559856 123.45.678.90 2023-06-16T13:52:39.856Z 439sec session_123.45.678.90_1686924008788 123.45.678.90 2023-06-16T14:00:08.788Z 87sec
The delete API can also be called directly. Unlike the download API, delete requires the session log reference, which is always SUPERUSER_SESSION-<log name>.Here is an example of calling the delete API using curl:
curl -X POST "http://mydelphixengine.myorg.com/resources/json/delphix/superuser/session/SUPERUSER_SESSION-session_123.45.678.90_1686923517171/delete" -b ~/cookies.txt