→ Applies to: SynetoOS 6.x

Step 1. Connect to SynetoOS appliance via SSH as admin

ssh admin@<your_ip_address_or_hostname>

Step 2. Get root privileges

sudo su -

Step 3. Run command (replace <relative-time> with the correct information)

journalctl -u teleport --since "<relative-time>" | grep AUDIT

EXAMPLE

journalctl -u teleport --since "1 week ago" | grep AUDIT

EXAMPLE OUTPUT

Feb 27 15:49:29 syneto-os-9320134f teleport[2156]: 2025-02-27T15:49:29+01:00 INFO [AUDIT]     session.start addr.remote:34.154.214.5:443 cluster_name:proxy.t.syneto.eu code:T2000I ei:0 event:session.start initial_command:[] login:root namespace:default proto:ssh server_hostname:sn-sy2000000143 server_id:b5906f4a-67f8-4c85-9b72-748c03a66848 syneto/company-name:ozr syneto/machine-name:syneto-os-9320134f session_recording:node sid:3d73ac64-a7c9-4dc8-9d85-1dafc95e848a size:80:25 time:2025-02-27T14:49:29.327Z uid:4bcc463b-7e9d-45b0-8e39-2d66addf4e91 user:smaadman events/emitter.go:263
Feb 27 15:50:11 syneto-os-9320134f teleport[2156]: 2025-02-27T15:50:11+01:00 INFO [AUDIT]     session.start addr.remote:34.154.214.5:443 cluster_name:proxy.t.syneto.eu code:T2000I ei:0 event:session.start initial_command:[] login:support namespace:default proto:ssh server_hostname:sn-sy2000000143 server_id:b5906f4a-67f8-4c85-9b72-748c03a66848 syneto/company-name:ozr syneto/machine-name:syneto-os-9320134f session_recording:node sid:9bc414f0-5a6d-4d7a-bcf4-bb1b944e9030 size:80:25 time:2025-02-27T14:50:11.851Z uid:57f385e0-bf35-4628-aff7-dcc2e4253cf4 user:smaadman events/emitter.go:263