Skip to content
Tessera Tessera Docs

The audit log

Availability Audit log & database query audit: all editions. Session recording: Pro and up. SIEM export: Ultimate.

Because every connection passes through the broker, Tessera records what happens without anything installed on your targets. The full log lives in Postgres and is the source of truth.

What’s recorded

Section titled “What’s recorded”
  • Authentication — logins and their outcome, and lifecycle events (a user disabled or enabled, sessions revoked).
  • Connections — every session started and closed, by user and target.
  • Activity — SSH commands, database queries, Kubernetes API requests (verb, resource, namespace, name, status), and RDP connect/disconnect.
  • Read-only enforcement — commands and statements blocked in read-only sessions.
  • Access changes — grants created and revoked, and every just-in-time request with its decision and approver.
  • Settings changes — configuration made in the console.

Session recording

Section titled “Session recording”

Beyond the event log, the full terminal stream of an SSH session can be recorded in asciinema format and replayed in the console. Recording is a per-target toggle (Record sessions on the target) — turn it on where you need it, e.g. production but not a sandbox. A user can retrieve recordings of their own sessions; administrators can access all of them. To bound storage, see Retention.

Review in the console

Section titled “Review in the console”

Open Audit to browse the event log with filters, and Audit → Sessions to see per-session activity — the command list for an SSH session, the queries for a database session — with a play button where recording is enabled. Sessions lists active connections, which an administrator can force-close.

Get it out

Section titled “Get it out”

The database always retains the complete log regardless of what you export.

Retention

Section titled “Retention”

By default the controller keeps the audit log and session replays forever. To bound growth, set a retention window at startup (see Configuration):

  • TESSERA_AUDIT_RETENTION_DAYS — delete audit-log entries older than N days.
  • TESSERA_RECORDING_RETENTION_DAYS — delete session replays (.cast files and their metadata) older than N days.

A background job runs once a day (and once at startup) and removes anything past the window; 0 (the default) disables purging for that class. If you need long-term retention beyond the controller, stream events to your SIEM — that copy is independent of the local window.

Section titled “Related”

Cookies