# What exactly gets captured in a PAM session recording?

**URL:** <https://community.infisical.com/t/what-exactly-gets-captured-in-a-pam-session-recording/41>\
**Category:** PAM\
**Created:** [September 2, 2026, 9:38pm UTC](https://community.infisical.com/t/what-exactly-gets-captured-in-a-pam-session-recording/41 "2026-09-02T21:38:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![richdex](https://avatars.discourse-cdn.com/v4/letter/r/aeb1de/32.png) [@richdex](https://community.infisical.com/u/richdex)\
**Post date:** [September 2, 2026, 9:38pm UTC](https://community.infisical.com/t/what-exactly-gets-captured-in-a-pam-session-recording/41/1 "2026-09-02T21:38:27Z")

</div>

Our auditors want evidence of what people actually did during a privileged session, not just that a session happened. For SSH and database sessions, does Infisical capture the commands and queries themselves, and can we review a session while it’s still running? Also curious whether there’s a way to block specific commands outright rather than only recording them after the fact.

---

<div class="post-metadata">

**Author:** ![Jake-Infisical](https://yyz2.discourse-cdn.com/flex048/user_avatar/community.infisical.com/jake-infisical/32/40_2.png) [@Jake-Infisical](https://community.infisical.com/u/Jake-Infisical)\
**Post date:** [September 2, 2026, 11:44pm UTC](https://community.infisical.com/t/what-exactly-gets-captured-in-a-pam-session-recording/41/2 "2026-09-02T23:44:02Z")

</div>

Hey, great questions!

Yes to all three. Infisical records the full session. For SSH that’s every command and its output, for databases it’s every query plus a result summary. Recording is always on, so you can give the auditors the real transcript.

You can also open a session while it’s live, see live in the dashboard and terminate it from there if needed.

Re blocking: PAM policies let you define regex rules and matching commands get rejected before they run, but that’s SSH only right now.

Thanks!  
Jake