--- title: CommandLog_Keylog slug: kronpam-how-to-guides-180/commandlogkeylog docTags: createdAt: 2025-04-30T11:38:41.341Z --- This log type applies only to RDP Proxy and contains the logs of which keyboard keys are used by the user during a remote desktop connection in Kron PAM. The packets are sent to the server in the following format: | **sessionId** | Specific ID of the log in the PAM Database | | -------------------- | ---------------------------------------------------------------------------------------------------------------------- | | **userName** | The username used to log in to PAM and execute the command | | **host** | KePAM Host IP | | **tenantId** | Tenant, the command log was captured. | | **sessionStartTime** | When the session started | | **sessionEndTime** | When the session finished | | **globalUserName** | GlobalUserName is used for authentication | | **clientIp** | Source IP of the device that executed the command | | **commandTime** | Exact time the command was executed | | **command** | Key used in the keyboard. | | **allowed** | If the executed command is allowed by the administrator or not
allowed=true is the default value for RDP sessions | | **instanceName** | Which instance executed the command | | **deviceGroups** | Group names of the device on which the command is executed | **Example:** The test user executes the **Enter** keyboard key during a remote desktop connection on Kron PAM: :::BlockQuote \{sessionId='37a98f56-897a-41a7-9062-17088d7c2709', userName='test', host='10.10.10.10', tenantId='krontech', sessionStartTime=2025-04-15 14:00:49.503, sessionEndTime=2025-04-15 14:04:39.637, globalUserName='Administrator', clientIp='10.0.1.1', commandTime=2025-04-15 14:01:19.388, command='\[Alt] + \[Enter]', allowed=true, instanceName='localhost.localdomain', deviceGroups=DG1, DG2', context=null} :::