Skip to content
ghostshell
Get started

Search

Grep across every recording on the host with ghostshell search, filtered by user and natural-language --from and --to dates.

ghostshell search finds a string across every recording in the central store. It requires root, and it decrypts recordings transparently as it scans — nothing is ever stored in plaintext to make search work.

console
$ sudo ghostshell search nginx user=alice when=2026-05-26 14:59:18 session=20260526T145918-1420180 cmd: /bin/bash -c echo starting deploy; systemctl restart nginx; echo deploy done > Failed to restart nginx.service: Unit nginx.service not found.

Each hit shows the user, timestamp, session ID, the command that started the session, and matching output lines. Feed the session ID straight into play or tail.

Flags

Flag Effect
--from T Only sessions starting at or after T
--to T Only sessions starting at or before T
--user U Restrict to one user
-i Case-insensitive match

Date filters

--from and --to accept any format the system date -d command understands:

bash
sudo ghostshell search --from "yesterday" nginx
sudo ghostshell search --from "2 days ago" --to "yesterday" nginx
sudo ghostshell search --from "last week" nginx
sudo ghostshell search --from "2026-05-28" --to "2026-05-28 17:00" nginx

Combined example — case-insensitive, one user, bounded window:

console
$ sudo ghostshell search --from "2 days ago" --to yesterday --user alice -i DEPLOY user=alice when=2026-05-26 14:59:18 session=20260526T145918-1420180 cmd: /bin/bash -c echo starting deploy; ...

Note: Date strings are passed to date -d as plain arguments, never through a shell — $(), backticks, ;, and pipes in a date string are inert. See the security model for the full input-validation posture.

  • Live tail — when the session you found is still running
  • Commands — full reference

Source of truth: README on GitHub