Session Log

session logs are stored for ssh/telnet, rdp/vnc, sftp, and sql proxy sessions established by the user on kron pam the packets are sent to the server in the following format sessionid specific id of the log in the pam database username the username that started the session userid user id of the user who started the session tenantid tenant that the session was started host kron pam host ip hostname device name of the established session starttime when the session started endtime when the session finished globalusername globalusername is used for authentication clientip source ip of the device that started the session instancename the instance by which the session was started accessprotocol access protocol with which the session was started totalduration total duration of the user in the session in seconds idleduration idle duration of the user in the session remoteapplicationname application name in the rdp proxy session example the test user initiated an ssh session to a device named pam4260 on kron pam {sessionid='748ebef5ba062fc56d0911a7', username='test', userid='25e53f47 ce66 4df2 9abc 6961dc668264', tenantid='krontech', host='10 10 10 10', hostname='pam4260', starttime=2025 04 22 13 51 07 308, endtime=2025 04 22 13 51 12 791, globalusername='root', clientip='10 0 1 1', instancename=''localhost localdomain ', accessprotocol='sshv2', totalduration=5, idleduration=null} the test user initiated a remote desktop session to a device named windows on kron pam {sessionid='7c57fa28 4436 47f4 b23f 0399c943ad66', username='test', userid='25e53f47 ce66 4df2 9abc 6961dc668264', tenantid='krontech', host='10 10 10 10', hostname='windows', starttime=2025 04 16 14 41 37 247, endtime=2025 04 16 14 41 42 065, globalusername='administrator', clientip='10 0 1 1', instancename='localhost localdomain', accessprotocol='rdp', totalduration=4, idleduration=0, remoteapplicationname='desktop'}