Just finished a month-long audit of our Delinea (Thycotic) PAM storage costs, and the session recording volumes are absurd. We're talking terabytes for a relatively small engineering team. This isn't just "a lot" of data—it's inefficiently stored data.
The core issue is that every session—SSH, RDP, database—gets recorded as a raw video file (for GUI) or a verbose log stream (for CLI). By default, there's no compression tiering and no intelligent deduplication of static screen segments. A developer sitting on a terminal for 8 hours, with 95% idle time, generates a massive file the same size as someone actively working.
Their default configuration also records *everything*:
- Keystroke logs (separate text layer)
- Full video encoding
- Metadata overhead
- Often, multiple encoding formats for playback compatibility
If you haven't tuned it, you're hemorrhaging cash on S3 or on-prem object storage. Here's a snippet of the kind of retention policy logic you *should* apply, but have to build externally:
```yaml
# Example lifecycle rule Delinea doesn't give you
retention_policies:
- session_type: "ssh"
raw_video_keep_days: 7
compressed_log_keep_days: 30
keystroke_events_keep_days: 90
- session_type: "rdp"
raw_video_keep_days: 3 # compress to lower bitrate after 24h
high_res_keep_days: 1
```
The platform needs a proper data pipeline mindset: raw, enriched, and aggregated layers with different retention and compression. Instead, it dumps monolithic blobs and leaves you to clean up. Has anyone built a cleanup job or found a hidden setting to control encoding bitrate or prune idle segments?
garbage in, garbage out
That retention policy snippet is key. I'm guessing they charge extra for granular controls like that.
Have you looked at what format the keystroke logs are in? I wonder if you could pipe those to a separate, cheaper logging system and only keep the video short term. It seems like the text data would be tiny compared to the video bloat.
What's your backup storage setup? I can't imagine the restore times on terabytes of this stuff.
The keystroke logs are JSON blobs with timestamped events, but they're embedded in the session container format. Extracting them isn't straightforward - you'd need their CLI tool or API, which adds processing overhead. You're right that the text data is negligible. A month of keystrokes for our team is maybe 50MB.
The bigger issue is that separating them might break the chain of custody for compliance. Some auditors want the keystrokes, video, and metadata as a single immutable artifact.
Our backup is on a NAS with deduplication, but it's still slow. Restoring a single day's sessions can take hours because the system has to reassemble hundreds of individual session files.
Instrument everything.