Team session logs

Team session logs record what sessions to a vault’s hosts show, for the team’s owners and those who manage the vault. They are off for every vault until an owner turns them on, and everyone who can open the vault is told, before and during each session that is logged. Each log is sealed with the vault’s key, so ZestSSH Cloud keeps it without being able to read it.

These are not the Session logs you keep on your own device. A team session log goes to the team, whatever your own logging is set to.

Turn session logs on for a vault (owners)

1. Open Team, then Vaults. On a computer, click the vault to open its pane. On a phone, each vault is a card with its settings under it (with more than three vaults, open them with What it allows).
2. Under Records, turn on the switch of the Session logs row.
3. Read Log sessions to Production’s hosts?. It says that sessions are logged for owners and those who manage the vault, that each log is kept 30 days, that everyone who can open the vault is told and sees that a session is logged before and during it, and what is left out.
4. Choose Log sessions, and sign in again if asked.

Only owners turn session logs on or off. While they are on, everyone else who can open the vault sees Sessions logged on that row.

To stop, turn the switch off, then choose Stop logging in Stop logging sessions to Production’s hosts?. The session logs kept so far are deleted, and everyone who can open it is told.

What members see

• When it changes. Everyone else who can open the vault gets a notification, for example “Sessions to Production are now logged”, and “Sessions to Production are no longer logged” with the note that the logs kept so far were deleted.
• Before they connect. On a computer, a host’s panel says Sessions to this host are logged for your team, and its card carries a small eye mark that says the same. On a phone, the host’s row in the host list carries the same mark.
• During the session. On a computer, the session’s header shows the chip Logged. On a phone, a strip under the toolbar says This session is logged for your team. Known credentials and sensitive fields are redacted; terminal output may still contain sensitive information. It appears as the session starts.
• While the log waits to be sent. On a computer the chip says Logged, not sent yet, and on a phone the strip adds that the log is kept on the device, sealed, and sent as soon as it can be.
• Before they join. An invitation says how many of the vaults someone would open log sessions, for example “Vaults you would open that log sessions: 2.”

What a log holds

• A header: who connected, the host’s name in their app, its address, port and user name, and when the session started by their device’s clock.
• What the terminal showed, as text, with the terminal’s escape sequences taken out. Its tmux panes and the snippets run in it are part of that.
• Runs. A command run on one of the vault’s hosts with Run on hosts is logged too, with the command and what it printed.
• Lines from ZestSSH, each starting with [ZestSSH]: when the session is shared and with whom, who joined, left or was given the keyboard, and, for a vault whose sessions are watched, when typing was held because nobody was watching (see Session sharing and moderation).

The log is redacted on the device, before it is sealed and sent. It leaves out:

• the value of every masked snippet variable (${VAR:secret}, ${VAR:password}) used in the session, wherever it appears, when it is four characters or longer;
• private key blocks, from -----BEGIN ... PRIVATE KEY----- to the matching END line;
• passwords inside URLs (scheme://user:password@host);
• Authorization: Bearer, Basic and Token values;
• well-known token formats: GitHub, GitLab, AWS access key ids, Slack, Stripe, Google API keys, OpenAI and Anthropic keys, npm tokens, and JSON Web Tokens;
• the value after a name ending in password, passwd, pwd, secret, token, api_key, apikey, access_key, secret_key or private_key, followed by = or : on the same line.

Known credentials and sensitive fields are redacted; terminal output may still contain sensitive information. The password or passphrase you signed in with is not looked for: the app wipes it from memory once you are signed in.

Read the logs (owners and managers)

1. Open Team, then Vaults, and open the vault (its pane on a computer, its card on a phone).
2. Under Records, choose View logs on the Session logs row. It shows only to owners and those who manage the vault, while session logs are on.
3. Session logs of Production lists the logs newest first, for example “priya@example.com on web-01”, with when the session started and how big the log is.
4. Choose Open to read one. Copy log copies its text.

A log marked Still going, or cut short has not been closed: the session is still running, or its device went away before it ended. A log that reached ZestSSH Cloud more than 10 minutes after its session began says when it was received.

Owners can also Delete a log, after Delete this session log?: It is deleted for everyone.

When part of a log is missing or cannot be opened, it says Part of this log is missing or could not be opened: what is shown ends there.

How long logs are kept

• 30 days after ZestSSH Cloud took the log’s start, then it deletes the log.
• All of them at once when an owner turns session logs off for the vault.
• One at a time when an owner deletes one.

When ZestSSH Cloud cannot be reached

A session to a host of a vault that logs is logged whether or not ZestSSH Cloud can be reached. What the device seals is kept in the team’s own database on that device first, sealed as it goes to the server, and taken out once the server has it. What could not be sent goes later, from the session itself or with a sync, also after the app was started again.

The device keeps about 64 MB of logs it could not send for each team. With no room left, the log says so where its output is missing, and goes on once there is room again.

Limits

• One log holds up to 32 MB, sealed. A session that shows more ends its log with [session log full], and the rest of it is not logged.
• 500 logs a day for each member. ZestSSH Cloud takes no more than 500 new logs from one member in 24 hours, across all their teams. Past that, the device keeps new logs and sends them later.
• 2 GiB a day for each member. The logs one member started in the last 24 hours hold at most 2 GiB together, across all their teams. Past that, ZestSSH Cloud takes no more of them, the log in progress stops, and the rest of that session is not logged.
• Terminal sessions and runs only. File transfers are not part of a log.
• A phone’s note before connecting is a mark. On a phone, the host list shows the eye mark before you connect, and the strip with the full words appears once the session starts.
• Times come from the member’s device. A header’s start time is the member’s device clock.
• Readers can copy. Anyone who may read a log can copy its text, and what they copy is theirs to keep.

What ZestSSH Cloud can see

ZestSSH Cloud keeps each log’s header and chunks sealed with the vault’s key, so it cannot read who connected where or what the session showed. It knows which account sent a log, which vault it belongs to, how big it is, and when it took it. It holds itself to the vault’s setting: it takes nothing while session logs are off, and deletes the vault’s logs when they are turned off.

Next steps

• Session logs: logs you keep on your own device.
• Session sharing and moderation: shared and watched sessions, which these logs also note.
• Trash, history and activity: what else the team records, and who sees it.
• Event export: send the team’s record changes and activity to a system of your own.
• Snippets: masked snippet variables are left out of team logs.