we've been trying to do things via shell logging (which is a dead end), audit logging (which has proven too difficult to capture in script form) until we suddenly can track and pivot on the root session? oh heck yes