[QUESTION] is it possible to discover the recorded sessions with the cli?

Hi all,

It seems it is only possible to see the list of recorded sessions in the web UI, is there a functionality how I can discover a list of recorded sessions with tsh or tctl? We are not exposing the proxy to the Internet, so we cannot access the web UI conveniently.

I did not find any possibility using tsh get all for example or any subcommand.

Best regards

Hey @balpert89,

Each recorded session is a file which is saved in var/lib/teleport/log/sessions by default. Each day is represented as a file.

When you identify the file you can replay a session via the CLI by the following command:

tsh --proxy=proxy play FILENAME

There is more details on this and an example here.

Hi @abdu,

thanks for replying. However, that way is not really feasible - all applications are running on openshift/kubernetes. In addition, all apps are running in HA mode, the auth service is using etcd (auditlog) and S3 (recorded sessions). That means, the way you describe it an operator has to look in each auth service pod to gather the recorded sessions.

I was more referring to something like tsh get recorded_sessions or the like.

Best regards

The answer is that currently, no, there is no such functionality. The web UI is populated using Teleport’s own internal API so it is very likely possible to make a request to that to get the recorded sessions, but that functionality isn’t currently exposed using via CLI using either tctl or tsh.