auth.log is way primitive compared to what teleport has. It logs the actual session data, and if "enhanced" recording is enabled, it uses BPF tracing to record

auth.log is way primitive compared to what teleport has. It logs the actual session data, and if "enhanced" recording is enabled, it uses BPF tracing to record all processes executions and files that were opened. fwiw, the web ui is optional. Nobody's taking away your ssh client.