It’s 3 a.m. and an alert fires: a production database table was dropped. Who ran the command? When? What else did they touch before and after? In most organisations the honest answer is a shrug and a desperate grep through shell history files that may have been cleared, rotated, or never captured at all.
Shell history is not an audit log. It records commands, not context — not the output the operator saw, not the prompts they answered, not the moment they realised something was wrong. To understand an incident, you need to watch it happen.
Logs tell you what; replay tells you how
Command logs answer “what command ran.” Replay answers a richer set of questions: what the operator saw, how they got there, where they hesitated, and exactly what the terminal printed back. During an investigation, that difference is everything.
An audit trail you can’t watch is a list of claims you have to trust.
How recording works
Subnomic captures the full terminal stream — input and output — for every terminal and pod shell opened through it, attributed to the person who opened it. Recording isn’t a separate tool on the host that a privileged user could switch off; it happens in the path every session already travels.
- The real byte stream — replay a session with its original timing, and scrub through it.
- Stored away from the host — recordings are written by Subnomic, not by the machine being audited.
- Where you look for it — every server keeps its sessions on its own Sessions tab, and an active one can be watched live.
- A person, not an account — each recording belongs to whoever opened it; on Linux, the shell even runs as their own operator user.
Databases too
A database console session is recorded as well: every query with its timing and the number of rows it returned — never the result rows themselves. Obvious secrets are redacted from the query text before it is stored.
Replay during an incident
When something breaks, you open the session and watch it. Scrub to the moment the table was dropped. See the command, the confirmation prompt, the output. Rewind to see what led there. With AI enabled, a plain-language summary of the session sits above the player. The investigation that used to take hours of correlating fragments becomes a few minutes of watching what actually happened.
Compliance as a side effect
SOC 2, ISO 27001, HIPAA and PCI DSS all expect privileged access to be logged and reviewable. With every session recorded, the evidence already exists when the audit arrives — and on the Enterprise tier, evidence packs bundle the session inventory with access reviews and the audit log.
Privacy and scope
Recording everything raises fair questions about sensitive data. Recordings are protected like everything else in the workspace: replaying sessions, watching a live one and taking one over are separate permissions. Visibility for auditors does not mean visibility for everyone.
The bottom line
You can’t secure what you can’t see. Recording every session turns the most dangerous moments — privileged access to production — from a blind spot into your best source of truth.
See how it fits into Fleet.