Working with session transcripts

A session transcript comprises several files.

Before you begin:

You must be a regular user on the terminal server. ts-shell users and iucvconn_on_login users cannot work with session transcripts.
You need read access to /var/log/ts-shell where ts-shell creates the session transcripts.

Within /var/log/ts-shell there is a subdirectory for each user who conducted a terminal session for which a transcript was created.

The raw terminal data stream is written to a file within the directory for the respective user with a name of the format:

<vm_guest>_<YY-MM-DD-hhmmss>

where <vm_guest> is the z/VM® user ID that identifies the target system and <YY-MM-DD-hhmmss> is a time stamp that indicates when the session was started.

The complete transcript includes two more files:

<vm_guest>_<YY-MM-DD-hhmmss>.timing: with timing information about the session.
<vm_guest>_<YY-MM-DD-hhmmss>.info: with more terminal session information.

The file with extension .info is a human readable text file. The transcript file without an extension and the file with extension .timing are intended for replaying a session. See the scriptreplay man page for details.

Consider a cron job to purge obsolete transcripts according to your audit policies.