View Logs from the CLI

When your organization is configured to allow StrongDM to retain logs, you can view the following kinds of log entries from the Admin UI or using the CLI:

• Administrative activities

• Queries

• SSH, RDP, or Kubernetes session replays

If you store logs with StrongDM, they are visible in the Admin UI for varying periods of time depending on the type of log. For more information about log retention and the more extensive logs available from the CLI, see the log retention documentation.

From the sdm command-line interface (CLI), you can access all auditing—activities, queries, and replays—via the StrongDM API.

To see all of the commands and options available via the CLI, see the CLI Reference.

Viewing logs at the CLI can involve not only knowing the correct cli audit commands but also how to decrypt and/or interpret the data that is available. To learn more about decrypting gateway/relay log files or locating information within those files directly, see the Node Log Files section.

View Activities With the CLI

To review activities on the StrongDM Admin UI, you can use the sdm audit activities command. By default, it returns the most recent Admin UI activities, from the last seven days.

Example:

$ sdm audit activities
Timestamp,IP Address,Actor ID,Actor Name,Activity,Description
2025-05-27 12:28:40.276507 +0000 UTC,71.232.116.201,1016,Joe Admin,user logged into the UI,Joe Admin ([email protected]) logged into the UI.
2025-05-27 15:23:26.375064 +0000 UTC,71.232.116.201,1016,Joe Admin,organization setting updated,Joe Admin ([email protected]) changed the organization setting local log storage to none.
2025-05-27 15:23:26.376804 +0000 UTC,71.232.116.201,1016,Joe Admin,organization setting updated,Joe Admin ([email protected]) changed the organization setting local log encode to plaintext.
2025-05-27 18:05:49.45456 +0000 UTC,71.232.116.201,1016,Joe Admin,user suspended,Joe Admin ([email protected]) suspended Bob User ([email protected]).
2025-05-27 18:05:51.002598 +0000 UTC,71.232.116.201,1016,Joe Admin,user type changed,Joe Admin ([email protected]) changed type of Bob User ([email protected]) to user.
2025-05-27 18:05:51.07059 +0000 UTC,71.232.116.201,1016,Joe Admin,user added to role,Joe Admin ([email protected]) assigned Bob User ([email protected]) to Junk.
2025-05-27 19:51:53.343206 +0000 UTC,71.232.116.201,1016,Joe Admin,organization setting updated,Joe Admin ([email protected]) changed the organization setting remote log encode to strongdm.
2025-05-27 19:51:53.346103 +0000 UTC,71.232.116.201,1016,Joe Admin,organization setting updated,Joe Admin ([email protected]) changed the organization setting local log storage to stdout.
2025-03-23 14:37:43.710974 +0000 UTC,71.232.116.201,1016,Joe Admin,user logged out from the local client,Joe Admin ([email protected]) logged out from the local client.
2025-03-23 14:38:16.927605 +0000 UTC,71.232.116.201,1016,Joe Admin,user logged into the local client,Joe Admin ([email protected]) logged into the local client.

To look for activity in a specific timeframe, you can make use of the --from and --to flags. Each takes a timestamp of the form YYYY-MM-DD or "YYYY-MM-DD HH:MM:SS" (note the quotes). They can also take specific time values, such as five seconds (5s), five minutes (5m), or five days (5d). When using these flags, you can specify --from alone, or use --from and --to together. With these flags, the command returns all activities within the specified time frame. At this point, you can further narrow your search by using grep or other text processing to look for specific user, datasource, or server activity.

To view a continuous stream of Admin UI activities or to redirect the output to another location, you can use the -f (follow) flag.

View Queries With the CLI

Similarly to Activities, you can use the sdm audit queries command to find the most recent queries. This command alone returns the most recent queries, but you can use the --from and --to flags to time-box your search, just as with sdm audit activities. You can also use the -f flag to get a streaming output to STDOUT.

Example:

$ sdm audit queries
Time,Resource ID,Resource Name,User ID,User Name,Duration (ms),Record Count,Query,Hash,Source IP,Target,Authorization Decision,Metadata
2025-05-27 08:42:27.501482 +0000 UTC,rs-5230cd4c6835a981,ExamplePG,a-0a12345678b9c0d1,Alice Glick,0,0,-- execute unnamed portal using unnamed prepared statement\nSET application_name = 'DataGrip 2025.1',9c617efab0726f543487cc4233034ee5cc53590b,127.0.0.1,sdmlocal:5432,,"{""SessionID"":""2590"",""SessionStartTime"":""2025-05-27 08:42:26.255868 +0000 UTC""}"
2025-05-27 11:22:33.456789012 +0000 UTC,rs-12a345b678c901de,Example,a-0011223344aa5566,Joe Admin,1,0,SELECT VERSION(),bfdacb2e17fbd4ec7a8d1dc6d6d9da37926a1198,00.123.456.789,aa-pgsql-public.abc.ab.uk:5432,allow,,
2025-05-27 18:34:03.86193793 +0000 UTC,rs-12a345b678c901de,Example,a-0011223344aa5566,Joe Admin,1,0,SHOW ALL,1ac37f50840217029812c9d0b779baf64e85261f,00.123.456.789,aa-pgsql-public.abc.ab.uk:5432,allow,,
2025-05-27 18:34:03.960313826 +0000 UTC,rs-12a345b678c901de,Example,a-0011223344aa5566,Joe Admin,8,0,"SELECT oid, nspname, nspname = ANY (current_schemas(true)) AS is_on_search_path, oid = pg_my_temp_schema() AS is_my_temp_schema, pg_is_other_temp_schema(oid) AS is_other_temp_schema FROM pg_namespace",da39a3ee5e6b4b0d3255bfef95601890afd80709,00.123.456.789,aa-pgsql-public.abc.ab.uk:5432,allow,,
2025-05-27 18:38:34.166008919 +0000 UTC,rs-12a345b678c901de,Example,a-0011223344aa5566,Joe Admin,0,0,"SELECT oid, nspname, nspname = ANY (current_schemas(true)) AS is_on_search_path, oid = pg_my_temp_schema() AS is_my_temp_schema, pg_is_other_temp_schema(oid) AS is_other_temp_schema FROM pg_namespace",da39a3ee5e6b4b0d3255bfef95601890afd80709,00.123.456.789,aa-pgsql-public.abc.ab.uk:5432,allow,,
2025-05-27 18:38:34.959912057 +0000 UTC,rs-12a345b678c901de,Example,a-0011223344aa5566,Joe Admin,29,0,"SELECT   rel.relname,    rel.relkind,    rel.reltuples,  coalesce(rel.relpages,0) + coalesce(toast.relpages,0) AS num_total_pages,   SUM(ind.relpages) AS index_pages,   pg_roles.rolname AS owner FROM pg_class rel     left join pg_class toast on (toast.oid = rel.reltoastrelid) left join pg_index on (indrelid=rel.oid)    left join pg_class ind on (ind.oid = indexrelid)    join pg_namespace on (rel.relnamespace =pg_namespace.oid )  left join pg_roles on ( rel.relowner = pg_roles.oid ) WHERE rel.relkind IN ('r','v','m','f','p') AND nspname = 'public'GROUP BY rel.relname, rel.relkind, rel.reltuples, coalesce(rel.relpages,0) + coalesce(toast.relpages,0), pg_roles.rolname;",da39a3ee5e6b4b0d3255bfef95601890afd80709,00.123.456.789,aa-pgsql-public.abc.ab.uk:5432,allow,"{""SessionID"":""56""}",
2025-05-27 18:38:35.081213693 +0000 UTC,rs-12a345b678c901de,Example,a-0011223344aa5566,Joe Admin,2,0,"SELECT    rel.relname,    rel.relkind,    rel.reltuples,  coalesce(rel.relpages,0) + coalesce(toast.relpages,0) AS num_total_pages,   SUM(ind.relpages) AS index_pages,   pg_roles.rolname AS owner FROM pg_class rel     left join pg_class toast on (toast.oid = rel.reltoastrelid) left join pg_index on (indrelid=rel.oid)    left join pg_class ind on (ind.oid = indexrelid)    join pg_namespace on (rel.relnamespace =pg_namespace.oid )  left join pg_roles on ( rel.relowner = pg_roles.oid ) WHERE rel.relkind IN ('r','v','m','f','p') AND nspname = 'public'GROUP BY rel.relname, rel.relkind, rel.reltuples, coalesce(rel.relpages,0) + coalesce(toast.relpages,0), pg_roles.rolname;",da39a3ee5e6b4b0d3255bfef95601890afd80709,00.123.456.789,aa-pgsql-public.abc.ab.uk:5432,allow,,
2025-05-27 18:44:29.240677811 +0000 UTC,rs-12a345b678c901de,Example,a-0011223344aa5566,Joe Admin,0,0,"SELECT name, setting FROM pg_settings WHERE source = 'session';",da39a3ee5e6b4b0d3255bfef95601890afd80709,00.123.456.789,aa-pgsql-public.abc.ab.uk:5432,allow,,
2025-05-27 18:44:29.0869904 +0000 UTC,rs-12a345b678c901de,Example,a-0011223344aa5566,Joe Admin,1,0,"SELECT name, setting FROM pg_settings WHERE source = 'session';",da39a3ee5e6b4b0d3255bfef95601890afd80709,00.123.456.789,aa-pgsql-public.abc.ab.uk:5432,allow,,
2025-05-27 18:44:29.069202957 +0000 UTC,rs-12a345b678c901de,Example,a-0011223344aa5566,Joe Admin,1,0,"SELECT name, setting FROM pg_settings WHERE source = 'session';",da39a3ee5e6b4b0d3255bfef95601890afd80709,00.123.456.789,aa-pgsql-public.abc.ab.uk:5432,allow,",
2025-05-27 18:44:29.339510043 +0000 UTC,rs-12a345b678c901de,Example,a-0011223344aa5566,Joe Admin,1,0,"SELECT name, setting FROM pg_settings WHERE source = 'session';",da39a3ee5e6b4b0d3255bfef95601890afd80709,00.123.456.789,aa-pgsql-public.abc.ab.uk:5432,allow,,

If you have turned on StrongDM log encryption, you need to have the private key to view the query contents. You can use the -k <private.key> flag to decrypt the queries and use the result. This flag can also be used in conjunction with the -f flag to stream decrypted query logs to another location.

There is an additional option for this command, --full, that pulls query logs from long-term storage. This has the following effects:

• The time frame precision is more coarse; results are returned in one-hour blocks.

• Query results may be delayed up to one hour (that is, results may not return queries performed within the last hour).

• All queries are returned, including those that skip the Admin UI and short-term storage.

View SSH Replays With the CLI

You can list SSH replays, play them, and grep for strings within replays via the CLI.

List SSH replays

Just like Activities and Queries, you can use sdm audit ssh and sdm audit rdp to list recent or time-specified SSH or RDP sessions, using the same flags.

$ sdm audit ssh
Time,Resource ID,Resource Name,User ID,User Name,Duration (ms),Query ID,Hash,Replay,Command,Identity Alias Username,Source IP,Target,Authorization Decision,Metadata
2025-03-21 20:51:16.098221 +0000 UTC,1334,prod-312-test,1016,Joe Admin,8572,s1lAGI1niKKwdSYQtwi62HIuYTIO,afb368770931a2aae89e6a8801b40eac44569d93,false,,,00.111.222.333,ec2-11-22-333-444.us-west-2.compute.amazonaws.com:22,allow,,
2025-03-21 20:53:01.4391 +0000 UTC,1334,prod-312-test,1016,Joe Admin,7515,s1lAxGI1uuKe7zpgJtwi6j2dIfjY,aa4aa0646469757df9f0b92fb5ca39a9c1bfd38d,false,,,20.245.209.241,52.39.163.86:22,allow,,
2025-05-27 21:57:10.920914 +0000 UTC,1334,prod-312-test,1016,Joe Admin,10440,s1lAxGI1niKKwSYQtwi6229NmTpG,aa4aa0646469757df9f0b92fb5ca39a9c1bfd38d,true,,,20.245.209.241,52.39.163.86:22,,{},
2025-05-27 23:16:40.170815 +0000 UTC,1334,prod-312-test,1016,Joe Admin,5433,s1lAGI7rekCY29NmTpGQD5G22WlK,883b03873229301e58fb6c9ccf1a3f584953d13c,false,,,20.245.209.241,52.39.163.86:22,allow,,
2025-05-27 23:21:49.987304 +0000 UTC,1334,prod-312-test,1016,Joe Admin,4529,s1lAGIfjYkNrEW5MDbi62HIuYTIO,883b03873229301e58fb6c9ccf1a3f584953d13c,false,,,20.245.209.241,52.39.163.86:22,allow,,
2025-03-23 01:18:02.167322 +0000 UTC,1334,prod-312-test,1016,Joe Admin,6318,s1lAA4Jkn4LPkosDulWmyHgCqqeB,883b03873229301e58fb6c9ccf1a3f584953d13c,false,,,20.245.209.241,52.39.163.86:22,,{},

View SSH replays

In addition, you may view live replays of SSH sessions, much like the replay window in the StrongDM Admin UI. To do so, you first need the Capture ID, which is conveniently displayed in the output of the sdm audit ssh command. Once you have the Capture ID of the capture you want to replay, you can use the sdm ssh play command to replay it in your command-line window.

$ sdm ssh play s1lAA4Jkn4LPkosDulWmyHgCqqeB
[... output elided ...]

If you just want to dump the commands and outputs from an SSH session to a file, perhaps for further analysis, you can use sdm ssh dump with the same syntax. This command dumps the contents of the session to STDOUT, letting you redirect the output to a file if you choose.

Similarly to queries, you need to use the -k <private.key> flag with capture replay/dump if you have turned on StrongDM log encryption.

View Kubernetes Replays With the CLI

You can list Kubernetes replays and play them from the CLI.

List Kubernetes replays

Similar to SSH, you can use sdm audit kubernetes to list recent, or time-specified Kubernetes sessions, using the same flags.

Example:

$ sdm audit kubernetes
Time,Resource ID,Resource Name,Pod,Container,User ID,User Name,Duration (ms),Client Command,Request URI,Query ID,Hash,Replay,Identity Alias Username,Impersonation User,Impersonation Groups,Privilege Groups,Source IP,Target,Authorization Decision,Metadata
...
2025-05-06 03:50:04.456764253 +0000 UTC,rs-1n123ffa11aad78c,TestCluster,,,a-1234abc123ab1234,Alice Glick,0,,,02lgH414jEIwP7GoQrMNKcz86NTq,da39a3ee5e6b4b0d3244bfef12301555afd12341,false,,,,,136.56.222.198,testcluster-dns-adsfg5hi.hcp.awsregion.azmk8s.io:443,allow,"{""SessionID"":""2590"",""SessionStartTime"":""2025-05-06 08:42:26.255868 +0000 UTC""}",
2025-05-06 03:50:05.231376408 +0000 UTC,rs-1n123ffa11aad78c,TestCluster,,,a-1234abc123ab1234,Alice Glick,55,,/api/v1/namespaces/default/pods/shell-demo,k2lgH4FFFb7bKWUqhuqG6BjE1GRM,e5f19047ca76a58925c4d8193a076a2a141148ec,false,alice,,,,,136.56.222.198,testcluster-dns-adsfg5hi.hcp.awsregion.azmk8s.io:443,"{""SessionID"":""2590"",""SessionStartTime"":""2025-05-06 08:42:26.255868 +0000 UTC""}",
2025-05-06 03:50:06.48886773 +0000 UTC,rs-1n123ffa11aad78c,TestCluster,shell-demo,nginx,a-1234abc123ab1234,Alice Glick,103,kubectl exec shell-demo -c nginx -it /bin/bash,/api/v1/namespaces/default/pods/shell-demo/exec?command=%2Fbin%2Fbash&container=nginx&stdin=true&stdout=true&tty=true,k2lgH4GblXwL4Fp33i0dJ8QdIRP2,da0b8ff55d43a5d5090cfe435ea43d08f2a89776,true,alice,,,,,136.56.222.198,testcluster-dns-adsfg5hi.hcp.awsregion.azmk8s.io:443,,
2025-05-06 03:50:42.719211575 +0000 UTC,rs-1n123ffa11aad78c,TestCluster,,,a-1234abc123ab1234,Alice Glick,52,,/api/v1/namespaces/default/pods/shell-demo,,k2lgH8nDz69NPccerRrfB7KQzBZk,e5f19047ca76a58925c4d8193a076a2a141148ec,false,alice,,,,,136.56.222.198,testcluster-dns-adsfg5hi.hcp.awsregion.azmk8s.io:443,,
2025-05-06 03:50:43.389475637 +0000 UTC,rs-1n123ffa11aad78c,TestCluster,shell-demo,nginx,a-1234abc123ab1234,Alice Glick,89,kubectl exec shell-demo -c nginx -it /bin/bash,/api/v1/namespaces/default/pods/shell-demo/exec?command=%2Fbin%2Fbash&container=nginx&stdin=true&stdout=true&tty=true,k2lgH8y0D40gZOzaScnzSlcXscUI,d98e02f88e52aa92e7a2d7e7be0c837048ad8406,true,alice,,,,,136.56.222.198,testcluster-dns-adsfg5hi.hcp.awsregion.azmk8s.io:443,,
2025-05-06 03:50:44.20127368 +0000 UTC,rs-1n123ffa11aad78c,TestCluster,shell-demo,nginx,a-1234abc123ab1234,Alice Glick,22099,kubectl exec shell-demo -c nginx -it /bin/bash,/api/v1/namespaces/default/pods/shell-demo/exec?command=%2Fbin%2Fbash&container=nginx&stdin=true&stdout=true&tty=true,k2lgH94T4xOLqwDdq6v3ptOqQgVT,ef4c49334bc9f7dc4b797dcbcb2537e0105a0ff8,true,alice,,,,,136.56.222.198,testcluster-dns-adsfg5hi.hcp.awsregion.azmk8s.io:443,,
2025-05-06 03:50:05.901160685 +0000 UTC,rs-1n123ffa11aad78c,TestCluster,shell-demo,nginx,a-1234abc123ab1234,Alice Glick,89,kubectl exec shell-demo -c nginx -it /bin/bash,/api/v1/namespaces/default/pods/shell-demo/exec?command=%2Fbin%2Fbash&container=nginx&stdin=true&stdout=true&tty=true,k2lgH48gGSUZCazNWYtbsoxVUCc5,d98e02f88e52aa92e7a2d7e7be0c837048ad8406,true,alice,,,,,136.56.222.198,testcluster-dns-adsfg5hi.hcp.awsregion.azmk8s.io:443,,
2025-05-06 03:50:45.260431444 +0000 UTC,rs-1n123ffa11aad78c,TestCluster,shell-demo,nginx,a-1234abc123ab1234,Alice Glick,0,kubectl exec shell-demo -c nginx -it /bin/bash,/api/v1/namespaces/default/pods/shell-demo/exec?command=%2Fbin%2Fbash&container=nginx&stdin=true&stdout=true&tty=true,k2lgH94T4xOLqwDdq6v3ptOqQgVT,da0b8ff55d43a5d5090cfe435ea43d08f2a89776,true,alice,,,,,136.56.222.198,testcluster-dns-adsfg5hi.hcp.awsregion.azmk8s.io:443,,
2025-05-06 03:50:41.881588734 +0000 UTC,rs-1n123ffa11aad78c,TestCluster,,,a-1234abc123ab1234,Alice Glick,0,,,02lgH8frjMmDhXpytP5OsW7zzpEF,da39a3ee5e6b4b0d3244bfef12301555afd12341,false,,,,,136.56.222.198,testcluster-dns-adsfg5hi.hcp.awsregion.azmk8s.io:443,allow,,
2025-05-06 03:50:43.437773331 +0000 UTC,rs-1n123ffa11aad78c,TestCluster,,,a-1234abc123ab1234,Alice Glick,0,,,02lgH8yDDSEjEC3zgj2t3ATrJZAr,da39a3ee5e6b4b0d3244bfef12301555afd12341,false,,,,,136.56.222.198,testcluster-dns-adsfg5hi.hcp.awsregion.azmk8s.io:443,allow,,
...

View Kubernetes replays

For any Kubernetes replay listed that has true as the value for Replay, you should be able to view a replay.

bob.belcher@PC-100 ~ % sdm kubernetes play k2lgH94T4xOLqwDdq6v3ptOqQgVT

This outputs a line by line replay of the Kubernetes session:

root@aks-agentpool-12345678-vmss000000:/# echo hello
hello
root@aks-agentpool-12345678-vmss000000:/# exit
exit

Render and View RDP Replays Locally

Because RDP Replays are binary objects, and not typical logs, they must be kept in object storage systems (such as AWS S3, Azure Blob, Google Cloud Storage, and so forth) and not in logging systems (such as AWS CloudWatch, Azure Monitor, Splunk, and so forth) to ensure they don't get corrupted.

Only the most minimal of RDP settings are supported for RDP via StrongDM. Trying to use advanced options or configurations may prevent replays from being rendered and played.

Render RDP sessions using Docker

It is possible to render RDP sessions locally via a Docker image:

docker run --rm -ti -v ~/.sdm/logs:/logs public.ecr.aws/strongdm/rdpreplay:latest --format 'csv' r1po3p80VaPnzSSjAobzV2RavzWW

Pointers for using the Docker image:

• You need the FFmpeg package installed locally in order to play RDP session videos.

• If you have changed your SDM HOME location away from the default ~/.sdm, change that path in the above command.

• Substitute the sample session ID in the above command with the session ID you intend to replay.

• Completed MP4 files are deposited in the /logs folder.

Render RDP sessions using the CLI

The local rendering can be done via the CLI as well, if desired:

sdm replay rdp

NAME:
   sdm replay rdp - render an RDP session in movie format from local or remote RDP session logs

USAGE:
   Render from local relay logs:
   sdm replay rdp r2tVQUuoNefeUF66r5OcfV4cCAGX

   Render from local relay logs in CSV format:
   sdm replay rdp --format csv r2tVQUuoNefeUF66r5OcfV4cCAGX

   Render from local relay logs in CSV format encrypted with a public key:
   sdm replay rdp --format csv --key local-log.key r2tVQUuoNefeUF66r5OcfV4cCAGX

   Render from specified local relay log files:
   sdm replay rdp r2tVQUuoNefeUF66r5OcfV4cCAGX logs/relay.1740434641.0.log logs/relay.1740434761.0.log

   Render from downloaded remote logs:
   sdm replay rdp --tmpdir out --download r2tVQUuoNefeUF66r5OcfV4cCAGX

   Render from downloaded remote logs encrypted with a public key:
   sdm replay rdp --tmpdir out --download --key remote-log.key r2tVQUuoNefeUF66r5OcfV4cCAGX

OPTIONS:
   --format value            file format of local relay log files ('json', 'csv', or 'logstream') (default: "json")
   --tmpdir value, -t value  path to directory for temporary storage during rendering. Longer sessions may require more temporary space (default: "/Users/youruser/.sdm/logs")
   --download                download remote session logs from StrongDM instead of using local relay logs
   --key value, -k value     path to organization private key file. Required to decrypt logs encrypted with public key encryption

RDP Replay With Log Stream Files

To replay using data provided via Log Stream you can use the sdm replay rdp command and give it the list of the related Log Stream files for the replay you'd like to construct. Replace <UUID> with the UUID of the query in question, and replace <QUERY_FILES> and <REPLAY_FILES> with the file names of all of the associated replay log files.

sdm replay rdp --format logstream <UUID> <QUERY_FILES> <REPLAY_FILES>

Example:

sdm replay rdp --format logstream r2vXbdVgT4DqiLu4GB79v3FLHf3O queries/2025/04/08/21/08/aaaaaaaa-bbbb-1111-2222-333344445555.json replays/2025/04/08/21/08/cccccccc-dddd-6666-7777-888899990000.json replays/2025/04/08/21/08/eeeeeeee-ffff-1111-3333-555577779999.json queries/2025/04/08/21/08/gggggggg-hhhh-2222-4444-666688880000.json

There are often many log files for a given session. To make the replay rendering process easier, you can also provide directories to search instead, as in the following command. Replace <UUID> with the UUID of the query in question, and for <QUERIES_DIR> and <REPLAYS_DIR>, provide the paths to the directories that contain query files and replay files. The UUID is how those files will be found, collected, and rendered into a single replay.

sdm replay rdp --format logstream <UUID> `ls <QUERIES_DIR> <REPLAYS_DIR> | xargs`

Example:

sdm replay rdp --format logstream r2vXbdVgT4DqiLu4GB79v3FLHf3O `ls queries/2025/04/08/21/08/* replays/2025/04/08/21/08/* | xargs`

If you do not know the UUID for the RDP session you wish to replay, you can obtain it by locating the query in the Admin UI, under Logs > RDP, and copying the SessionID.

Log References

To view a list of all available fields and their descriptions for each event type, please see the Log References section.