Privileged sessions and recordings (watch, terminate, replay)

Every privileged session is recorded and sealed. Under «PAM» › «Sessions», administrators follow live sessions and replay recordings.

What does the list show?

«User», «Account», «Target», «Channel» («SSH client» or «Web terminal»), «Started», «Duration», «State» and «Recording». Use «Live sessions only» to filter those that are «Live».

Recording states: «Recording», «Sealed», «Broken», «Being purged», «Purged».

People appear by email and accounts by name, for example "root on srv-db-01" (also in «Rotation jobs»). A short identifier shows only until the name is read; an account deleted since shows «Removed account» and a person who can no longer be found shows «Unknown user».

Watch and terminate

• «Watch» opens the session live, read-only.
• «Terminate» cuts the session. The console shows «The appliance is ending the session.» and the end is recorded as «Terminated by an administrator».

Replaying a recording

1. Choose «Play». «Session recording» opens.
2. Use «Play» and «Pause», the «Playback speed» (1×, 2×, 4×) and the «Position in the recording».
3. The «Command index» lists the commands; pick one to jump to it. «Best effort: commands are reconstructed from the keystrokes.»
4. «Search whole words» filters the index.

Integrity

Before replay, the service checks the recording:

Appliances

«PAM» › «Appliances» lists the appliances running the privileged access module, their live sessions and when they were last seen.