How-To Guides
...
Log Formats

Session Log

2 min

Session logs are stored for SSH/Telnet, RDP/VNC, SFTP, and SQL Proxy sessions established by the user on Kron PAM. The packets are sent to the server in the following format:

sessionId

Specific ID of the log in the PAM Database

userName

The username that started the session

userId

User ID of the user who started the session

tenantId

Tenant that the session was started

host

KRON PAM Host IP

hostName

Device name of the established session

startTime

When the session started

endTime

When the session finished

globalUserName

GlobalUserName is used for authentication

clientIp

Source IP of the device that started the session

instanceName

The instance by which the session was started

accessProtocol

Access protocol with which the session was started

totalDuration

Total duration of the user in the session in seconds

idleDuration

Idle duration of the user in the session

remoteApplicationName

Application name in the RDP Proxy session

Example:

The test user initiated an SSH session to a device named PAM4260 on Kron PAM:

{sessionId='748ebef5ba062fc56d0911a7', userName='Test', userId='25e53f47-ce66-4df2-9abc-6961dc668264', tenantId='krontech', host='10.10.10.10', hostName='PAM4260', startTime=2025-04-22 13:51:07.308, endTime=2025-04-22 13:51:12.791, globalUserName='root', clientIp='10.0.1.1', instanceName=''localhost.localdomain ', accessProtocol='SSHv2', totalDuration=5, idleDuration=null}

The test user initiated a remote desktop session to a device named Windows on Kron PAM:

{sessionId='7c57fa28-4436-47f4-b23f-0399c943ad66', userName='Test', userId='25e53f47-ce66-4df2-9abc-6961dc668264', tenantId='krontech', host='10.10.10.10', hostName='Windows', startTime=2025-04-16 14:41:37.247, endTime=2025-04-16 14:41:42.065, globalUserName='Administrator', clientIp='10.0.1.1', instanceName='localhost.localdomain', accessProtocol='RDP', totalDuration=4, idleDuration=0, remoteApplicationName='Desktop'}