Customer did create custom/etc/tlog/tlog-rec-session.conf :

Unknown macro: {"shell"}

,"writer":"file","file":{"path":"/var/log/tlog.log"}}

This is also the example at https://www.redhat.com/sysadmin/terminal-logging

Checking strace we see:

2928019 12:33:22.674994 setresuid(-1, 191, -1) = 0 <0.000017>
2928019 12:33:22.675031 setresgid(-1, 154, -1) = 0 <0.000013>
2928019 12:33:22.675065 openat(AT_FDCWD, "/var/log/tlog.log", O_WRONLY|O_CREAT|O_APPEND, 0600) = -1 EACCES (Permission denied) <0.000265>
2928019 12:33:22.675361 setresuid(-1, 0, -1) = 0 <0.000017>
2928019 12:33:22.675401 setresgid(-1, 0, -1) = 0 <0.000013>

and from sosreport:

sosreport-m1-simp08d-03676513-2023-11-30-bqrvquh/sos_commands/logs/ls_alRh_.var.log:-rw-r----. 1 root root 0 Nov 8 18:13 tlog.log

If correctly understood, the issue is fixed with
from report at https://github.com/Scribery/tlog/pull/211
from Open JSON writer file with euid/egi