Keycyte PAM 3.2 · Administrator Guide

Reviewing Session History

The Session History page lists the sessions that users opened through Keycyte PAM. For recorded sessions you can play the recording in the browser, read what the user typed, and download the recording.

To open the page, select Sessions > Session History.

Session List

Searching and Filtering Sessions

To search all columns for a word, type it in Search Keyword in the toolbar and press Enter.

To filter the list:

1. Click Advanced Filter in the toolbar.

2. Fill in one or more of the following fields:

   Field	Description
   Protocol	Protocol of the session.
   Session Type	User, Collaboration or Admin Watch.
   Portal User	Keycyte PAM user name.
   Client IP	Address the user connected from.
   Username	Account used on the target.
   Server Address	Address of the target server.
   Start Date Begin, Start Date End	Range for the session start time.
   End Date Begin, End Date End	Range for the session end time.

3. Click Apply.

To remove all filters, click Clear Filters in the toolbar.

Adding a Description to a Session

You can attach a note to a session, for example a change ticket number. You need the Edit permission for Session History.

To add a description:

1. In the row of the session, click Edit.
2. Type the note in Description.
3. Click Save.

Playing a Recording

The Play button is available only for sessions that were recorded. If a session was not recorded, the button is dimmed; point to it to see the reason, for example:

• No server role covering this server (or its account) has recording enabled.
• The encryption key was unavailable when the session started.
• The recording path could not be written to.
• The target host refused the connection, so no session ran.
• The session ended before anything was captured.

If recording was enabled but the file can no longer be found, Keycyte PAM shows the message “Recording was enabled for this session, but its file is missing”.

To play a recording:

1. In the row of the session, click Play.
2. Use the player controls described below.
3. To move to the previous or next session in the list without closing the player, use the arrow buttons at the top of the player.

The player that opens depends on the type of the recording.

Graphical Session Player

RDP, VNC and web application sessions open in the graphical player.

Moving backwards in a long recording can take a few seconds. While the player catches up, it shows a Seeking progress bar that you can cancel.

The key log panel lists the text that the user typed, grouped by time. Type in the search box to find text; click an entry to jump to that moment in the recording. Text is captured only when the Text Record feature is enabled in a server role that covers the server.

Terminal Session Player

SSH and Telnet sessions open in the terminal player, which replays the terminal output with its own play, pause, seek and speed controls. In addition:

• Commands opens a panel that lists the commands run in the session. Click a command to jump to it.
• Export Video downloads the terminal recording.
• The maximize button switches the player to full screen.

SFTP Transfer Log

For an SFTP session, the player shows the list of file operations instead of a recording: Time, Operation, Details, Size and Result.

RDP Gateway Recordings

Sessions recorded by the Keycyte RDP gateway open in a dedicated player for that recording format.

Downloading Recordings

To download several recordings at once:

1. Select the sessions in the table.
2. Click Download in the toolbar.
3. In the Bulk Download dialog, check the list of sessions and click Start Download.

Each recording is saved as a separate file named after the server address, the user name, the start and end time and the connection ID. Sessions without a recording file, and SFTP sessions, are skipped and listed as errors at the end. You can cancel the download while it runs.

Recording Formats

Keycyte PAM stores recordings in different formats depending on the protocol. When you download a recording, you receive the following file:

The MP4 video is encoded at the session’s own screen size.