# BPF to transform SSH Sessions to Structured Event

DevFeed: [BPF to transform SSH Sessions to Structured Event](<https://devfeed.tech/articles/bpf-to-transform-ssh-sessions-to-structured-event-29637.md>)

Original publisher: [Read original article](<https://goteleport.com/blog/enhanced-session-recording/>)

Author: info@goteleport.com (Russell Jones)

Published: 2020-02-27T00:00:00Z

Content type: article

Language: en

Sources: [Teleport](<https://devfeed.tech/sources/teleport.md>)

Topics: [eBPF](<https://devfeed.tech/topics/ebpf.md>), [ssh](<https://devfeed.tech/topics/ssh.md>), [audit](<https://devfeed.tech/topics/audit.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [session replay](<https://devfeed.tech/topics/session-replay.md>), [Shell](<https://devfeed.tech/topics/shell.md>), [Ansible](<https://devfeed.tech/topics/ansible.md>), [Parsing](<https://devfeed.tech/topics/parsing.md>)

Tags: [ansible](<https://devfeed.tech/tags/ansible.md>), [audit](<https://devfeed.tech/tags/audit.md>), [behavior](<https://devfeed.tech/tags/behavior.md>), [ebpf](<https://devfeed.tech/tags/ebpf.md>), [false-positives](<https://devfeed.tech/tags/false-positives.md>), [linux](<https://devfeed.tech/tags/linux.md>), [new-feature](<https://devfeed.tech/tags/new-feature.md>), [obfuscation](<https://devfeed.tech/tags/obfuscation.md>), [parsing](<https://devfeed.tech/tags/parsing.md>), [shell](<https://devfeed.tech/tags/shell.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [visibility](<https://devfeed.tech/tags/visibility.md>)

## AI overview

The article explains how Teleport 4.2 Enhanced Session Recording uses BPF to transform unstructured SSH session data into structured events. It describes limitations of traditional terminal recordings, including command obfuscation, shell scripts, and terminal controls, and outlines technology options considered for improving auditing.

## Source excerpt

Teleport's Enhanced Session Recording feature can add vital extra visibility into commands being run on your systems.