---
title: Observing SSH Proxy Session Disconnect Reasons
slug: kronpam-reference-guide-3-9-0/observing-ssh-proxy-session-disconnect-reasons
docTags: 
createdAt: 2026-10-07T11:15:48.811Z
---

A user connects to a device over the SSH Proxy using PuTTY, MobaXterm, or the Kron PAM screens. After the user completes their work the session ends. 

A session can end in several ways: 

·     User runs the logout command, such as EXIT, 

·     Device ends the session when its idle time expires, 

·     User closes the session window, 

·     An administrator who is monitoring the session ends it, 

·     Server ends the session or client ends the session for any reason. 

For each session, Kron PAM writes a short description of the end reason to the Disconnect Reason field and user can view this description on the **Session Logs** screens.

Kron PAM writes one of the following values to the Disconnect Reason field, based on how the session ended.



| ***Disconnect Reason***                       | ***When Kron PAM Writes It***                                                                                                                                                 |
| --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ***Session Closed With Command***             | The user ends the session by entering the logout command defined in the Terminal Logout Prompt Pattern field, such as LOGOUT or EXIT                                          |
| ***Session Disconnected by Client***          | The user closes the session window (for example, with the close button on the Kron PAM, PuTTY, or MobaXterm screen), or the client ends the session without a logout command. |
| ***Session Disconnected By Server***          | The server ends the session for any reason, such as a network problem or a service restart.                                                                                   |
| ***Idle Time Reached, Session Disconnected*** | The session reaches the idle timeout defined by the sc.idlesession.timeout parameter, and Kron PAM ends it.                                                                   |
| ***Session Killed by Admin***                 | An administrator ends the session from the Active Sessions screen under Policy.                                                                                               |

:::hint{type="info"}
The Disconnect Reason field is optional and its default value is empty. Sessions that ended before this feature was enabled, or sessions from older versions, can show an empty value.
:::

**Configuring the Logout Command for a Device Type **

For Kron PAM to record the Session Closed With Command value, you first define the logout command for the device type. You do this with the **Terminal Logout Prompt Pattern** field.

To define the logout command: 

1.      Navigate to **Element Types**. 

2.      Select **Infrastructure** in the **Associated Tags** field. Kron PAM then shows the **Terminal Logout Prompt Pattern** field below the SSH panel.

3.      In the Terminal Logout Prompt Pattern field, enter the command that ends the session on the device, for example ***LOGOUT*** or ***EXIT.***

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/kX-bbJTNS42NSvUk9ELJl_image.png" size="90" caption="Figure – Definition of Terminal Logout Prompt Pattern Parameter" isUploading="false" width="723" height="891" darkWidth="723" darkHeight="891" showCaption="true"}

:::hint{type="info"}
The Terminal Logout Prompt Pattern field accepts a regular expression, so you can define with regex pattern.
:::

**Viewing the Disconnect Reason **

Kron PAM shows the disconnect reason in the **Disconnect Reason column on the Session Logs screen**. This column is available in both the web interface and the Desktop Client. It also applies to sessions started from native clients, such as PuTTY and MobaXterm, on port 2222. 

To view the disconnect reason:

1.      Navigate to **Logging > Session Logs.**

2.      Find the session in the list.

3.      Read the value in the **Disconnect Reason** column.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/xH2VGSCI7pKGlQtK7frOn_image.png "Figure - The Disconnect Reason column on the Session Logs screen in the web interface")

**Monitoring Users Waiting in the Lobby **

When a user authenticates from a native client on port 2222 but has not yet selected a target device, the user waits in the lobby. Kron PAM records the value **User Waiting in Lobby** for this state. 

You can see this value in the Reason field on the User Auth. Logs screen. 

To view users waiting in the lobby:

1.      Navigate to the **User Auth. Logs** screen. 

2.      Find the authentication record for the user. 

3.      Read the **User Waiting in Lobby** value in the **Reason** field.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/6QtimX1hC1IyN98Lq5xtB_image.png "Figure - The User Waiting in Lobby value in the Reason field on the User Auth. Logs screen")