Displaying session information

After you select a query to see a list of sessions, such as the Today query to see a list of today’s sessions or an individual user to see a list of sessions for that user, you can view an indexed list of the activity that took place during any of the individual UNIX or Windows sessions captured.

For example, you can select a Windows session, right‑click, then select Indexed Event List to review a list of the applications that were opened during the session, in the order in which they were opened, the title of the active window, the type of activity, the desktop role used to access the application, and whether audit data was captured for the role being used. If you have video capture auditing enabled for the installation, you can replay the session entirely or from any point in the indexed list.

Similarly, for UNIX sessions, you can select a specific session, right-click, then select Indexed Command List to display a list of commands executed and the order they occurred. If you have video capture auditing enabled for the installation, you can replay the session entirely or from any point in the indexed list.