# Border0 session logs

Last validated Jul 31, 2026

Border0 + Tailscale is currently [in beta][docs-release-stage-beta].

Session logs give you full real-time visibility into what's happening in your privileged access environment.

A session represents the network connection between a user and a socket. For example, a user sending a request to a database creates a session. Each session contains rich contextual data, answering security and audit questions about the following.

* **Who**: The single sign-on [Tailscale identity][docs-tailscale-identity] of the user or [tagged][docs-tags] device.
* **What**: The resource in your Tailscale network (known as a tailnet) that was accessed. This could be an SSH connection to a server, a database, or other service on your network. The available resources are known as [sockets][docs-border-sockets].
* **Where**: The geographic location (city and country) and originating IP address of the user or tagged device.
* **When**: The date and time of the session.
* **What happened**: A session recording. Depending on the context, this could be a capture of SSH commands, database queries, HTTP session replays, or Kubernetes API requests.

This session data provides administrators with full context behind who did what and when for each connection, beyond only IP addresses and ports.

Session recording is currently supported for the following resource types:

* SSH, including SSH sessions for:
  * Docker
  * AWS Systems Manager (SSM)
  * Amazon Elastic Compute Cloud (EC2)
  * Amazon Elastic Container Service (ECS)
* Kubernetes
* Databases
* HTTP

## Examine session data

As an administrator, you can access session data from the **Session** page of the Border0 admin portal.

1. Open the [**Sessions**][xt-border0-sessions-page] page.
2. (Optional) Use the **Sessions** page filters to find a session, such as for a specific socket or user.
3. Select a session.

Each session entry provides an overview of *who* accessed *what* resources *when*. Once you select a session, you can get more details and context specific for the type of socket accessed. For example, a database session entry would show details for who accessed, or tried to access, the database, at what time, from which device and IP address, whether access was granted, and any queries that were performed.

## Replay a session recording

If session recording is enabled for a socket, you can replay the recording for a session. Depending on the recording type, the **Sessions** page presents different tabs:

* **Video Replay**: Displays a movie-like replay of the session, capturing all user actions.
* **Text Replay**: Provides a text output of the session, ideal for uploading to a security information and event management (SIEM) system or conducting log analysis.
* **Events**: Displays additional session metadata, including denied access attempts and details on the client software used during the session.

Select a tab as needed to replay a recording or examine any events. These tabs offer multiple perspectives on session activity, providing information useful for auditing, compliance, and security investigations.

[docs-border-sockets]: /docs/border0/services

[docs-release-stage-beta]: /docs/reference/tailscale-release-stages

[docs-tags]: /docs/features/tags

[docs-tailscale-identity]: /docs/concepts/tailscale-identity

[xt-border0-sessions-page]: https://portal.border0.com/sessions