Skip to main content

Terminal Observability

Metrics

MetricTypeLabelsDescription
proxima_terminal_sessions_totalcounterlogin, roleTotal sessions started
proxima_terminal_sessions_activeupdowncounterCurrently active sessions
proxima_terminal_sessions_lingeringupdowncounterSessions in the disconnect linger window (PTY alive, WebSocket gone)
proxima_terminal_session_duration_secondshistogramend_reasonSession duration distribution
proxima_terminal_reconnects_totalcounterresult (success|expired|denied)Auto-reconnect attempts
proxima_terminal_auth_denied_totalcounterlogin, roleRBAC denials at connect time
proxima_terminal_errors_totalcounterSession-level errors (I/O, PTY, NATS)
proxima_host_users_created_totalcounterhost_idHost users auto-created by the agent
proxima_host_users_deleted_totalcounterhost_idHost users cleaned up in drop mode
proxima_host_user_create_errors_totalcounterhost_id, stepUser creation failures (by step: useradd, chage, homedir, groups, etc.)
proxima_host_user_create_duration_secondshistogramTime to complete the full user creation sequence
proxima_terminal_template_resolve_totalcounterstatus (ok|error)Total login template resolution attempts
proxima_terminal_template_resolve_duration_secondshistogramTime to resolve login templates per session
proxima_terminal_recording_upload_duration_secondsHistogramR2 upload time
proxima_terminal_recording_upload_errors_totalCounterFailed recording uploads
proxima_terminal_recording_sessions_totalCounterstatus (completed/truncated/failed)Recording outcomes
proxima_terminal_peers_activegaugemodeCurrently connected session peers
proxima_terminal_peer_joins_totalcountermodeTotal peer join events
proxima_terminal_file_transfer_totalcounterdirection, statusTotal file transfers
proxima_terminal_file_transfer_bytes_totalcounterdirectionTotal bytes transferred
proxima_terminal_file_transfer_duration_secondshistogramdirectionTransfer duration

Traces

SpanAttributesDescription
TerminalHandler.CheckAccesshost_idRBAC access check
TerminalHandler.HandleWebSockethost_id, login, user_idFull WebSocket session
TerminalHandler.ResolveTemplatesterminal.template_logins_raw, terminal.template_logins_resolved, terminal.traits_countLogin template resolution
Agent.CreateHostUserterminal.sudoers_count, terminal.default_shell, terminal.uid_min, terminal.uid_maxHost user auto-creation

Trace Attribute Reference

AttributeWhereDescription
terminal.sudoers_countAgent.CreateHostUserNumber of sudoers rules written for the user
terminal.default_shellAgent.CreateHostUserShell path set for the auto-created user
terminal.uid_minAgent.CreateHostUserLower bound of the UID range from role options
terminal.uid_maxAgent.CreateHostUserUpper bound of the UID range from role options
terminal.template_logins_rawTerminalHandler.ResolveTemplatesComma-separated raw template strings before resolution
terminal.template_logins_resolvedTerminalHandler.ResolveTemplatesComma-separated resolved login names after template execution
terminal.traits_countTerminalHandler.ResolveTemplatesNumber of OIDC traits available to the template engine

Audit Events

EventDetailsDescription
terminal.session_startedsession_id, host_id, linux_userSession opened
terminal.session_endedsession_id, host_id, linux_userSession closed

Security Logging

The agent logs security-relevant events at WARN level when session token verification fails. Look for these in agent logs:

Log MessageMeaning
session token verifiedToken valid, PTY allocated (INFO)
terminal session rejected: no token providedAgent received a command with empty token (WARN)
terminal session token verification failedInvalid signature, expired, or wrong host_id (WARN)
terminal session token login mismatchToken's login doesn't match requested user (WARN)

Query agent logs for failed terminal auth attempts:

./scripts/obs.sh logs '"terminal session token verification failed"' 1h
./scripts/obs.sh logs '"terminal session rejected"' 1h

Database

Query active sessions:

SELECT id, user_id, host_id, linux_user, role_name, started_at
FROM terminal_sessions
WHERE ended_at IS NULL
ORDER BY started_at DESC;

Query session history:

SELECT id, linux_user, role_name, started_at, ended_at, end_reason,
EXTRACT(EPOCH FROM (ended_at - started_at)) AS duration_s
FROM terminal_sessions
WHERE host_id = '<host-id>'
ORDER BY started_at DESC
LIMIT 20;