List of Monitoring Sessions

To view user activity, select UAM Log Viewer in the console tree. The upper part of the details pane contains a list of user activity records - monitoring sessions stored in the log. For each record, the list provides the following information:

•Computer - The name of the computer on which this monitoring session was recorded.

The computer name is displayed only in the log on the DeviceLock Enterprise Server. It is not displayed in the log on the DeviceLock Service.

•Date/Time - The date and time that the recording of this session started.

•Type - The types of recording available in this session. Possible values:

•Video, Keylogger - The computer screen recording and keystrokes recording.

Note: If the session contains only screen recording or only keystroke recording, the session type is Video or Keylogger, respectively, even if the monitoring rule is configured to capture both the computer screen and keystrokes. This happens, for example, when the DeviceLock Service fails to take screenshots or capture keystrokes during recording.

•Rule - The name of the rule that caused the recording. Multiple rules could be listed here if more than one rule triggered during this recording.

•Reason - The triggering criteria of the rule that caused the recording. In case of multiple rules, a separate list of triggering criteria is specified for each rule.

Note: As the rule always has the triggering criterion User logged in, the Reason field normally does not display this well-known criterion. It is displayed only if the rule does not have other triggering criteria.

•Duration - The time span (hours, minutes and seconds) that recording lasted.

•User - The name of the user whose activity is recorded in this session.

•Received Date/Time - The date and time that the DeviceLock Enterprise Server received this record from the DeviceLock Service.

The received date and time is displayed only in the log on the DeviceLock Enterprise Server. It is not displayed in the log on the DeviceLock Service.

•Server - The name of the DeviceLock Enterprise Server computer that received this record from the DeviceLock Service.

The server name is displayed only in the log on the DeviceLock Enterprise Server. It is not displayed in the log on the DeviceLock Service.

•Consolidation Server - The name of the remote server from which this record was last received during log consolidation (see Consolidating Logs).

•Consolidated Date/Time - The date and time that this record was last received from the remote server during log consolidation (see Consolidating Logs).

The consolidation-related information is displayed only in the log on the DeviceLock Enterprise Server. It is not displayed in the log on the DeviceLock Service.

On each record, the shortcut menu provides the following record management commands (next to the command name is the toolbar button corresponding to that command):

•Open - Opens the recorded file in the application that is registered for the given file type in the operating system. If the session contains screen recording, this command opens the recorded video file. If the session contains only keystroke recording, this command opens the file where keystrokes are recorded.

•Save

- Saves the recorded video and/or keyboard input (keylog) to the file/s you specify. The keylog (if exists) is saved as an HTML file.

•Delete

- Deletes the selected record/s. Use the Ctrl and Shift keys to select and delete multiple records at a time.

The shortcut menu on each record also includes the log management commands listed in Managing the UAM Log.

Use filtering to look for sessions of interest (see Filtering the list of sessions). Select a session in the list to view its recording (see Session Viewer).