// Module included in the following assemblies:
//
// * security/security_profiles_operator/spo-logging.adoc

:_mod-docs-content-type: PROCEDURE
[id="spo-log-debug_{context}"]
= Audit node debugging sessions

[role="_abstract"]
Enable privileged `seccomp` profiles in CRI-O so Advanced Audit Logging can record activity from `kubectl debug` and `oc debug` node sessions.

If you are using the CRI-O runtime, you must configure it to allow `seccomp` profiles on privileged containers by adding the `--privileged-seccomp-profile=/var/lib/kubelet/seccomp/operator/profile1.json` flag to your CRI-O runtime configuration.

[NOTE]
====
The `--privileged-seccomp-profile` flag is available starting with {product-title} 4.20 or later and CRI-O version 1.33 or later.
====

.Procedure
. SSH into the target node using the following command:
+
[source,terminal]
----
# ssh core@<node_ip_address>
----
+
. Check to see if the files are there:
+
[source,terminal]
----
# ls /var/lib/kubelet/seccomp/operator/
----
+
.Example output
[source,terminal]
----
# kubelet-config.json  profile1.json
----
+
. Stop the `kubelet` with the following commands:
+
[source,terminal]
----
# systemctl stop kubelet
----
+
. Stop CRI-O with the command:
+
[source,terminal]
----
# systemctl stop crio
----
+
. Set the CRI-O options with the following command:
+
[source,terminal]
----
# echo "CRIO_CONFIG_OPTIONS --privileged-seccomp-profile=/var/lib/kubelet/seccomp/operator/profile1.json" > /etc/sysconfig/crio
----
+
. Now restart the kubelet with this command:
+
[source,terminal]
----
# systemctl start kubelet
----
+
. Restart CRI-O with this command:
+
[source,terminal]
----
# systemctl start crio
----
+
. To audit kubectl debug sessions, run the following command:
+
[source,terminal]
----
# kubectl debug node/<node_name> -it --image=ubuntu -- bash
----
+
Create the file on the container for the debugging information.
. `chroot` to the host with this command:
+
[source,terminal]
----
# chroot /host
----
+
. Go into the `/tmp` directory with this command:
+
[source,terminal]
----
# cd /tmp
----
+
. Create an empty file named `demonodedebug` with this command:
+
[source,terminal]
----
# touch demonodedebug
----
+
. Exit the node with the command:
+
[source,terminal]
----
# exit
----
+
. To monitor the logs, SSH to a node with this command:
+
[source,terminal]
----
$ sudo ssh core@<node_name>
----
. View the audit log using this command:
+
[source,terminal]
----
$ cat /tmp/logs/audit1.log
----
+
.Example output
[source,yaml]
----
{
  "auditID": "edce381a-998d-4f3f-99d8-d0c4d0c8a613",
  "cmdLine": "touch demonodedebug",
  "executable": "/usr/bin/bash",
  "gid": 0,
  "node": {"name": "worker-1"},
  "pid": 99086,
  "resource": {
    "container": "container-00",
    "namespace": "openshift-security-profiles",
    "pod": "worker-1-debug"
  },
  "syscalls": ["execve", "getpid"],
  "timestamp": "2026-02-12T13:50:11.000Z",
  "uid": 0,
  "version": "spo/v1_alpha"
}
----
