Playing Remote SSH and Local Client Sessions

A user can start playing any Linux Session by clicking the Play (

) icon next to the required session (on the left) in the list of Client sessions (on the Activity Monitoring page).

The session then opens in a new tab or new window, depending on the browser settings.

While playing remote SSH Linux sessions (and local Terminal sessions), all graphically recreated interactive data can be viewed in the form of video (i.e. a series of screen captures) in the Session Player, while the associated keystrokes input by the user, commands executed with their parameters, system function calls executed, and command outputs can be viewed in the Metadata grid.

NOTE: Remote X-forwarded sessions are viewed and played in a slightly different way, since X Window System applications can only be monitored as child sessions of a remote SSH parent session.

Searching and Filtering the Data

When viewing a remote SSH Linux session (or local Terminal session) in the Session Viewer, the data in the Metadata grid (on the right) and the main Session Viewer pane (on the left) can be searched by entering a keyword (i.e. search expression) into the Search field (at the top of the Metadata grid), after which the associated records found are displayed in the Metadata grid, and the keywords found are highlighted in the Session Player.

The data displayed in the Metadata grid can also be filtered by clicking the Search button (on the right of the Search field), to open the drop-down list, and then selecting any of the following options:

• Search in output: Select this checkbox to also search records containing command output response data.

• Either of the following 2 options:

- Show function calls: Select this option to display records containing system function calls executed (where the function calls are displayed in the Action column, and the associated Commands and Parameters are displayed in the corresponding columns).

- Show only execution commands: Select this checkbox to filter the records so as to only display records containing "exec" system function calls executed (where the exact “exec” function calls are displayed in the Action column).

- Show inputs: If the User Input Monitoring feature is enabled, select this option to (alternatively, instead of records containing system function calls) display records containing keystrokes input by the user, i.e. not only commands and parameters, but all keystrokes entered by the user (where the word “input” is displayed in the Action column of the Metadata grid, and the user's keystrokes, including commands and parameters input, are displayed in the Parameters column).

NOTE: Keystroke input events are detected by the system as user actions, separated by the user pressing the Enter key after inputting any number of keystrokes.

NOTE: The Linux User Input Monitoring feature is not enabled by default. To enable it (and for the "Show inputs" option to display the keystrokes input by the user), the EnableUserInputMonitoring key (with a value of "1") first needs to be added to the EkranServer.Settings.config text file (which is located on the computer where the Application Server is installed, in the folder: C:\Program Files\Ekran System\Ekran System\Server). Next, the Application Server needs to be restarted, and the "Enable user input monitoring" checkbox will then be displayed in the Management Tool (while editing a Client / Client Group, on the "Monitoring [Linux]" tab), and this checkbox needs to be selected.

Switching Between Linked Sessions

Remote SSH sessions which have restarted automatically at midnight are linked to each other in the Session Player, and can therefore easily be switched between by clicking the Previous Session and Next Session buttons.

NOTE: The adjacent (

) buttons (to the right of the Previous Session and Next Session buttons) are used to switch between the (next and previous) records in the Metadata grid. It should also be noted that switching between records, actually means switching between the screen captures in them, and therefore, since each record may contain multiple screen captures, these buttons will not always switch between records every time they are clicked (i.e. in the event that there is more than one screen capture in the record concerned). In a similar way, some records may not contain any screen captures, and will therefore be skipped.