One Identity Safeguard for Privileged Sessions 6.0 LTS - Administration Guide

The closed_connection_audit_channels view

This view returns all audited channels whose connection have been closed. The view is defined as follows:

create view closed_connection_audit_channels
as
select *
from channels
where audit is not null
and index_status = 1;

For details on the returned columns, see The channels table.

The closed_not_indexed_audit_channels view

This view returns all audited channels whose connection have been closed, but have not been indexed yet. The view is defined as follows:

create view closed_not_indexed_audit_channels
as
select *
from channels
where audit is not null
and (index_status = 1
or index_status = 2);

For details on the returned columns, see The channels table.

The connection_events view

For terminal connections, this view collects the commands issued in a connection. For graphical connections, this view collects the window titles detected in the connection. The view is defined as follows:

select
    channels._connection_channel_id as id,
    events.event,  
    events.printable
from channels,  
    events
where channels.id = events.channel_id;

Querying the table (for example, select * from connection_events limit 10;) will return results similar to the following:

 id |                                         event             | printable
----+-------------------------------------------------------------+-----------
1  | [user@exampleserver ~]$ ls                                  | t
1  | [user@exampleserver ~]$ exit                                | t
2  | [user@exampleserver ~]$ su -                                | t
2  | Password:                                                   | t
2  | [root@exampleserver ~]#                                     | t
2  | [root@exampleserver ~]# ifconfig                            | t
2  | [root@exampleserver ~]# ifconfig                            | t
2  | [root@exampleserver ~]# ifconfig                            | t
4  | [user@exampleserver ~]$                                     | t
4  | [user@exampleserver ~]$                                     | t

The connection_events view has the following columns.

The connection_occurrences view

The view is defined as follows:

select
    channels._connection_channel_id as id,
    results.token,
    occurrences.start_time,
    occurrences.end_time,
    occurrences.screenshot
from channels,
     results,  
     occurrences
where channels.id = results.channel_id
and results.id = occurrences.result_id;