Skip to main content
Version: latest

Recording playback fails

VaultPAM records every proxied session and stores the recording in object storage (MinIO). Playback is rendered in the browser using a built-in player. When playback fails, the cause is usually one of four things: the recording is still being processed, the storage backend is temporarily unreachable, the browser does not support the required codec, or the viewer does not have permission to watch the recording.

Symptoms​

  • Clicking Play on a session in Sessions → History shows a spinner that never resolves.
  • An error banner appears: Recording unavailable, Playback error, or Failed to load recording.
  • The player loads but shows a blank or frozen frame with no controls.
  • Playback starts but stops partway through with a codec or decoding error.
  • You see the session entry in the list but the Play button is greyed out.

Causes​

1. Recording still processing​

Very recent sessions (ended in the last 2–5 minutes) may not yet be fully ingested and indexed. The recording pipeline finalises the recording file, verifies integrity, and registers it in the catalog before playback is available. During this window, the Play button is greyed out or the player returns "Recording unavailable".

Check: Look at the session's Ended at timestamp. If it is less than 5 minutes ago, the recording is likely still processing.

Fix: Wait 5 minutes and refresh the page. The Play button will become active once processing completes. If the session ended more than 15 minutes ago and playback is still unavailable, proceed to the next cause.

2. MinIO storage unreachable​

Recordings are stored in MinIO (or an S3-compatible backend). If the storage service is unreachable — due to a network partition, service restart, or misconfiguration — the playback endpoint cannot retrieve the recording file and returns an error.

Check for operators: On the VaultPAM host or in the cluster, confirm MinIO is running and reachable:

curl -sv http://<minio-host>:9000/minio/health/live

A 200 OK response confirms MinIO is healthy. Also confirm the recording bucket exists and the VaultPAM service account has read access.

Fix for operators: Restore MinIO connectivity or restart the MinIO service. After recovery, retry playback — recordings are retrieved on demand and do not need to be re-ingested.

3. Browser codec unsupported​

The VaultPAM player uses WebM/VP8 or VP9 video encoding. Some older browsers or enterprise-hardened browser builds have codec restrictions that prevent playback.

Check: Try playback in a different browser (Chrome or Firefox are recommended). If playback succeeds in another browser, the original browser has a codec restriction.

Supported browsers for recording playback:

  • Chrome 90+
  • Firefox 90+
  • Edge 90+ (Chromium-based)

Safari has limited VP9 support on older macOS versions.

Fix: Use a supported browser. If a specific browser is required by policy, ask your VaultPAM admin whether the recording format can be changed (this is a server-side configuration).

4. Insufficient permissions​

Playback is controlled by Safe membership and role permissions. A user must have the View recordings permission for the Safe that the session belongs to. Admins and Safe owners have this permission by default; regular members may not.

Check: Confirm you are a member of the Safe that the session belongs to and that your role includes View recordings. In Safes → pick Safe → Members, find your user or group and confirm the permission is granted.

Fix: Ask a Safe admin to update your role to include the View recordings permission.

Resolution steps​

  1. Check the session's Ended at timestamp. If the session ended less than 5 minutes ago, wait and refresh the page before investigating further.
  2. Try opening the recording in a supported browser (Chrome or Firefox). If it plays there, the issue is a codec restriction in your original browser.
  3. Confirm you are a member of the relevant Safe and your role includes View recordings. If not, request the permission from a Safe admin.
  4. If none of the above applies and playback is still failing, ask an operator to verify that MinIO is healthy using curl -sv http://<minio-host>:9000/minio/health/live.
  5. After any fix, retry playback by refreshing the Sessions → History page and clicking Play again.

Escalation path​

If playback is still failing after working through all four causes:

  1. Note the session ID (visible in the URL when viewing the session details), the exact error message, and the browser and version you are using.
  2. If you are an operator, check VaultPAM application logs for errors containing recording, playback, or minio at the time of the failed playback attempt.
  3. Open a support ticket with: session ID, error message, browser version, and the MinIO health check result if you were able to run it.