|
NOTE:
The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions. |
This view returns all audited channels whose connection have been closed. The view is defined as follows:
create view closed_connection_audit_channels as select * from channels where audit is not null and index_status = 1;
For details on the returned columns, see The channels table.
|
NOTE:
The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions. |
This view returns all audited channels whose connection have been closed, but have not been indexed yet. The view is defined as follows:
create view closed_not_indexed_audit_channels as select * from channels where audit is not null and (index_status = 1 or index_status = 2);
For details on the returned columns, see The channels table.
|
NOTE:
The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions. |
For terminal connections, this view collects the commands issued in a connection. For graphical connections, this view collects the window titles detected in the connection. The view is defined as follows:
select channels._connection_channel_id as id, events.event, events.printable from channels, events where channels.id = events.channel_id;
Querying the table (for example, select * from connection_events limit 10;) will return results similar to the following:
id | event | printable ----+-------------------------------------------------------------+----------- 1 | [user@exampleserver ~]$ ls | t 1 | [user@exampleserver ~]$ exit | t 2 | [user@exampleserver ~]$ su - | t 2 | Password: | t 2 | [root@exampleserver ~]# | t 2 | [root@exampleserver ~]# ifconfig | t 2 | [root@exampleserver ~]# ifconfig | t 2 | [root@exampleserver ~]# ifconfig | t 4 | [user@exampleserver ~]$ | t 4 | [user@exampleserver ~]$ | t
The connection_events view has the following columns.
Column | Type | Description |
---|---|---|
event | text | The command executed, or the window title detected in the channel (for example, ls, exit, or Firefox). |
id | integer | The unique ID number of the entry. |
printable | boolean | Set to 1 if every character of the command can be displayed. |
The view is defined as follows:
select channels._connection_channel_id as id, results.token, occurrences.start_time, occurrences.end_time, occurrences.screenshot from channels, results, occurrences where channels.id = results.channel_id and results.id = occurrences.result_id;
|
NOTE:
The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions. |
Column | Type | Description |
---|---|---|
end_time | integer |
End time: Date when the channel was closed. |
id | text | The unique id of the entry. |
screenshot | text | The filename of the PNG screenshot (as stored on SPS) about the occurrence of the search token. |
start_time | integer |
Start time: Date when the channel was started. |
token | text | The search token visible on the screenshot. |
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Conditions d’utilisation Confidentialité Cookie Preference Center