The Dockerfile PROMPT_COMMAND logger uses --msgid command, so the MSGID field arrives as 'command' not '-'. The CMD rewrite block was guarded by event_type == '-' so it never fired, leaving fields['command'] unpopulated and cmd_text=None for every SSH session command. Broaden the guard to also match event_type == 'command' with no existing 'command' field, which covers both the intended (MSGID=NIL) and actual (MSGID=command) wire formats.
5.9 KiB
5.9 KiB