---
title: Session Logs
slug: kronpam-agent-reference-guide-3-8-1/session-logs
description: Learn how session logs on the endpoint capture user actions, including application launches and agent-based permissions. Discover how to conveniently view logs either on a session or individual basis through session log and command log tabs. Access in-dep
docTags: 
createdAt: 2023-06-20T15:15:24.000Z
---

Sessions logs contain the actions carried by the user in the endpoint. It displays which applications are launched and whether it was allowed, blocked, or elevated by the agent. An example of a session log is shown below. Logs can be seen on session based in the session log tab or individually in the command logs tab. Session logs or command logs can be filtered by **“Windows Agent”**, as other protocols may also write to these logs.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Qgpvyzl5GlXya6gE8mAuQ_image.png "Session Logs")

Users can access the session details by clicking the button on the right side. 

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/nUDP9s8f37cP0B0icQBPD_image.png" size="50" width="980" height="396" position="center" caption="Options menu on session log for an Agent session" darkWidth="980" darkHeight="396" showCaption="true"}

For the agent to record a session video, the **“Record Session”** setting must be enabled via the Agent Group. This means the setting must be applied to the agent before the end user logs in. If the setting is enabled after the user has already logged in, the video recording will not start for that session.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/-Q4wtQrZN5K8KcxY7RRpv_image.png" size="80" width="982" height="1077" position="center" caption="Session log details" darkWidth="982" darkHeight="1077" showCaption="true"}

:::hint{type="info"}
In the session log details, you can also view which rule triggered the blocking, allowing, or elevation of an application as shown above.

Additionally, details such as the hash, vendor, version, certificate hash, and more are reported to PAM. These can be viewed in the Session Log details. 
:::