CommandLog_Keylog

1 min

This log type applies only to RDP Proxy and contains the logs of which keyboard keys are used by the user during a remote desktop connection in Kron PAM. The packets are sent to the server in the following format:

sessionId	Specific ID of the log in the PAM Database
userName	The username used to log in to PAM and execute the command
host	KePAM Host IP
tenantId	Tenant, the command log was captured.
sessionStartTime	When the session started
sessionEndTime	When the session finished
globalUserName	GlobalUserName is used for authentication
clientIp	Source IP of the device that executed the command
commandTime	Exact time the command was executed
command	Key used in the keyboard.
allowed	If the executed command is allowed by the administrator or not allowed=true is the default value for RDP sessions
instanceName	Which instance executed the command
deviceGroups	Group names of the device on which the command is executed

Example:

The test user executes the Enter keyboard key during a remote desktop connection on Kron PAM:

{sessionId='37a98f56-897a-41a7-9062-17088d7c2709', userName='test', host='10.10.10.10', tenantId='krontech', sessionStartTime=2025-04-15 14:00:49.503, sessionEndTime=2025-04-15 14:04:39.637, globalUserName='Administrator', clientIp='10.0.1.1', commandTime=2025-04-15 14:01:19.388, command='[Alt] + [Enter]', allowed=true, instanceName='localhost.localdomain', deviceGroups=DG1, DG2', context=null}