Skip to content

Lack of implant sessions in client logs #1982

@hypnoticpattern

Description

@hypnoticpattern

Is your feature request related to a problem? Please describe.
When reading the json_*.log files, it's currently difficult to determine which session/beacon a command was executed in, requiring users to track down the last use ID command.

jq 'select(.level == "DEBUG")' ~/.sliver/logs/clients/op1/json_2025-08-10_18-11-42.log
{
  "time": "2025-08-10T18:11:42.101202985Z",
  "level": "DEBUG",
  "msg": "sessions",
  "type": "command"
}
{
  "time": "2025-08-10T18:11:44.296619485Z",
  "level": "DEBUG",
  "msg": "use 418df39c",
  "type": "command"
}
{
  "time": "2025-08-10T18:11:45.459282175Z",
  "level": "DEBUG",
  "msg": "ls",
  "type": "command"
}
{
  "time": "2025-08-10T18:11:52.00341901Z",
  "level": "DEBUG",
  "msg": "info",
  "type": "command"
}
{
  "time": "2025-08-10T18:11:54.497524988Z",
  "level": "DEBUG",
  "msg": "help",
  "type": "command"
}
{
  "time": "2025-08-10T18:11:59.324111386Z",
  "level": "DEBUG",
  "msg": "background",
  "type": "command"
}
{
  "time": "2025-08-10T18:12:00.270205959Z",
  "level": "DEBUG",
  "msg": "exit",
  "type": "command"
}

Describe the solution you'd like
Add session information when available.

Describe alternatives you've considered
Write a log parser to track the last use of use ID but that is not feasible.

Additional context
None

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions