<p>I want to log activity of users in k8s. I want to log each users that exec commands in pods. for example if a user has username 'user01' in k8s (or openshift) and executes 'whoami' in a pod, I want to log this activity with username 'user01'.</p>
<p>I explored Tetragon and Falco. these tools cannot give me k8s username. they just give real and effective user in pod.
k8s audit log stores username but it does not store whole activity.</p>

Michael Cab
<p>Tetragon team here! As pwoltschk explained, one solution would be to correlate the k8s audit logs with the Tetragon logs about execution. Using the k8s metadata Tetragon adds to events (pod names, container ID, etc.) and the date you should be able to retrieve who performed the action at the k8s user level.</p>
<p>Thus said, this is recurring demand from the community and we are aware that it could be useful.</p>
