Looking inside sudo shell sessions: auditd, session recordings, log_subcmds