Monitoring macOS Clients

macOS Clients operate as follows:

• Each macOS Client starts automatically on computer startup.

• A macOS Client with a Workstation Client endpoint license can monitor either one local session or one remote session.

• Every time a user logs in (or a Client computer is restarted), the macOS Client starts recording user activity in a new session. Furthermore, the maximum duration of one session is 24 hours, as at 00:00 (midnight) all live sessions are terminated. After termination (their status changes from Live to Finished), and new live sessions then start automatically.

• A session status changes to Finished whenever: the user is logged out, the computer is turned off, or the macOS Client is disconnected from the Application Server. Whenever the macOS Client reconnects to the Application Server, the session status changes from Finished back to Live.

• If a user works with several monitors, the macOS Client creates screen captures from all of them.

• In case there is no connection with the Application Server, the Client temporarily stores the monitored data locally (the default folder is: /Library/Application Support/Ekran) and automatically sends it to the Application Server as soon as the connection is restored. The Client will stop writing data to its offline cache if there is less than 500 MB of free space remaining on the hard drive.

• In case any Client ever stops working for any reason, it is restarted automatically by a watchdog mechanism process (which is performed by system services).

• The frequency of user activity recording of macOS Clients is as follows:

- If the user is typing text, user activity is recorded every 10 seconds.

- If the user clicks the mouse, user activity is recorded every 3 seconds.

- If the user changes the active window, user activity is recorded every 3 seconds.

The Client records user activity no more often than specified by the default values.

NOTE: User activity recording triggers usually influence each other. Therefore the average frequency of user activity recording is usually lower than that specified above.

NOTE: macOS Clients use AES-256 encryption to exchange the binary data with the Application Server.