Working with session transcripts

Edit online

A session transcript comprises several files.

Before you begin:
  • You must be a regular user on the terminal server. ts-shell users and iucvconn_on_login users cannot work with session transcripts.
  • You need read access to /var/log/ts-shell where ts-shell creates the session transcripts.

Within /var/log/ts-shell there is a subdirectory for each user who conducted a terminal session for which a transcript was created.

The raw terminal data stream is written to a file within the directory for the respective user with a name of the format: 
<vm_guest>_<YY-MM-DD-hhmmss>
where <vm_guest> is the z/VM® user ID that identifies the target system and <YY-MM-DD-hhmmss> is a time stamp that indicates when the session was started.
The complete transcript includes two more files:
<vm_guest>_<YY-MM-DD-hhmmss>.timing
with timing information about the session.
<vm_guest>_<YY-MM-DD-hhmmss>.info
with more terminal session information.

The file with extension .info is a human readable text file. The transcript file without an extension and the file with extension .timing are intended for replaying a session. See the scriptreplay man page for details.

Consider a cron job to purge obsolete transcripts according to your audit policies.