Keycyte PAM 3.2 · Administrator Guide
Reviewing Command and File History
Keycyte PAM keeps a searchable record of the commands that users run in terminal sessions and of the files they transfer. The Command History and File History pages show these records, one row per command or per transfer, with a link to the session recording.
Both pages work the same way:
- To search, type a word in Search Keyword and press Enter.
- To filter, click Advanced Filter, fill in the fields and click Apply. To remove the filters, click Clear Filters.
- To download the current list as an Excel file, click Export to Excel.
- To see all the details of a row, expand the row or click Detail.
- To open the recording of the session at that entry, click Jump to session recording.
Command History
To open the page, select Sessions > Command History.
| Column | Description |
|---|---|
| Date Time | When the command was run. |
| User | Keycyte PAM user. |
| Server | Address of the target server. |
| Account | Account used on the target. |
| Type | Connection type: SSH, TELNET, KUBERNETES or WEBTERMINAL. |
| Command | The command line. |
| Risk | Result of the command filter check (see below). You can sort by this column. |
The Risk column shows one of the following values:
| Value | Meaning |
|---|---|
OK | No command filter rule matched. |
INFO | A rule at an informational level matched (levels 1–3). |
WARN | A warning rule matched. |
BLOCK | The command was blocked. |
REJECTED, ACCEPTED, CANCELLED | Risk levels 6, 7 and 8 as reported by the SSH proxy. |
Command filter rules are configured in Access Control > Command Filters. For details, see Command Filters.
The Advanced Filter dialog has the following fields:
| Field | Description |
|---|---|
| Start Date, End Date | Time range. |
| Session ID | Full or partial session ID. |
| Portal User | Keycyte PAM user name. |
| Server Address | Host name or address of the target. |
| Target Username | Account used on the target. |
| Command Contains | Text that the command must contain. |
| Connection Type | SSH, TELNET, KUBERNETES or WEBTERMINAL. |
| Min Risk Level | Shows only commands at or above this level (0 = OK, 1–3 = INFO, 4 = WARN, 5 = BLOCK, 6 = REJECTED, 7 = ACCEPTED, 8 = CANCELLED). |
The Command Detail dialog also shows the client type and version, the remote address, the action taken, and the command output when it was captured.
File History
To open the page, select Sessions > File History.
| Column | Description |
|---|---|
| Date Time | When the transfer happened. |
| User | Keycyte PAM user. |
| Server | Address of the target server. |
| Account | Account used on the target. |
| Type | Connection type. |
| Client IP | Address the user connected from. This column is hidden by default; to show it, click Columns and select Client IP. |
| Direction | upload or download. |
| Filename | Name and path of the file. |
| Size | Size of the file. |
| Status | OK if the transfer succeeded, FAIL if it did not. |
| Action | Action that Keycyte PAM took: allowed, aborted or blocked. |
The Advanced Filter dialog has the following fields: Start Date, End Date, Session ID, Portal User, Server Address, Target Username, Filename Contains, Direction, Connection Type (SSH or WEBTERMINAL), Action Taken and Status.
Tip
To send command and file transfer records to a SIEM, enable Command and File Transfer for a syslog target. For details, see Forwarding Logs to Syslog.