Playing Remote X-Forwarded Client Sessions

X-forwarding can be used to monitor X Windows System applications opened by users in remote Linux SSH sessions.

These X Windows System applications cannot otherwise (i.e. directly in SSH sessions) be monitored by Syteca.

Use cases for X-forwarding include:

• When an application cannot be installed locally.

• When a user wants to launch a Linux application on a macOS or Windows desktop.

• When an application needs to be physically located on a remote server, and launched on a local workstation.

The functionality for viewing and playing these monitored sessions is slightly different to usual, and is described in this document, where the applications opened are monitored as separate X-forwarded "child" sessions of the SSH "parent" session.

A user can start playing a remote X-forwarded Linux Client session in the usual way, by clicking on the required X-forwarded session in the grid displaying the list of Client sessions monitored (on the Monitoring Results page).

The session opens in the usual way, in a new tab or new window (depending on your browser settings).

Viewing Additional X-Forwarded Child Sessions for Each Application Monitored

SSH Client sessions are displayed in the list of Client sessions in the grid in the usual manner.

However, for each X Window System application opened by the user in the SSH (parent) session, an additional X-forwarded (child) session is also displayed in the grid as a separate session.

Viewing X-Forwarded Child Sessions in the List of Sessions 

The list of Client sessions displayed on the Monitoring Results page for X-forwarded Client sessions is slightly different to usual, in the following ways:

• In addition to the usual session record for the SSH Client session concerned (known as the SSH "parent" session in this case), a separate session record is also displayed for each application opened by the user (known as the X-forwarded "child" session).

• The 

• The User's Comments column displays the name of the X-forwarded application opened by the user.

NOTE: The "User's Comments" column is not displayed by default, and can be added to the grid by clicking the Columns Display button and then dragging & dropping this column into the desired location between column headers. 

• The Linux X forwarded option in the OS filter can be used to display only X-forwarded sessions.

NOTE: The OS filter is not displayed by default, and can be added by clicking the "More criteria" button (next to the other filters displayed).

Viewing X-Forwarded Child Sessions in the Session Viewer 

The Session Viewer interface is also slightly different to usual when an X-forwarded child session is opened (by clicking the

• [In the Session Player:] The To Parent Session button is displayed (in the top right, in place of the usual Tools button) to enable the user to easily switch to viewing the SSH parent session.

• [In the Metadata grid:]

- The Activity Title and Application Name are displayed (along with the usual Activity Time) in the corresponding columns.

- No other data is displayed (except in the Activity Time column as usual).

NOTE: The Search box on the Monitoring Results page can be used to find records for the required X-forwarded sessions (e.g. in this case by entering "xtrem" to display all sessions for that application name).

Viewing SSH Parent Sessions in the Session Viewer

The Session Viewer interface is also slightly different to usual when an SSH parent session is opened:

• [In the Metadata grid:] For each X-forwarded "child" session record displayed:

- In the Command column, the word "xwindow" is displayed to indicate that this is an X-forwarded child session.

- In the Action column, the application name is displayed after an

- No other data is displayed (except in the Activity Time column as usual).