Monitoring Remote SSH Sessions

In remote SSH Client sessions, the Linux Client monitors the following actions performed:

1. User actions (i.e. keystrokes input, including commands and parameters executed).

3. Commands executed in scripts that are run.

2. System function calls.

4. System responses (i.e. command outputs) from the terminal.

Linux Clients start recording a new monitoring session each time a remote SSH session is opened.

Furthermore, the maximum duration of one SSH session is 24 hours, as at 00:00 (midnight) all live sessions are terminated. After termination (their status changes from Live to Finished), and new live sessions start automatically.

A session status changes to Finished whenever the remote SSH terminal is closed or the Linux Client is disconnected from the Application Server. Whenever the Linux Client reconnects to the Application Server, the session status changes from Finished back to Live. Even if the license is unassigned from the Linux Client or the Linux Client process is killed, monitoring of sessions started continues until the remote SSH terminal is closed.

In case any Client ever stops working for any reason, it is restarted automatically by a watchdog mechanism process (EkranAgent).

NOTE: Remote X-forwarded sessions can also be monitored, but in a slightly different way, as child sessions of a remote SSH parent sessions.