One Identity Safeguard for Privileged Sessions 6.0.4 - Safeguard Desktop Player User Guide

Export raw network traffic in PCAP format using the GUI

The following describes how to export the channels stored in the audit trail using the GUI.

To export the channels stored in the audit trail using the GUI

1. Open the audit trail in the Safeguard Desktop Player application.

   If the audit trail is encrypted, you need the appropriate decryption keys to open it. For details, see Replay encrypted audit trails.

2. Click EXPORT > Export pcap.

   A Select folder dialog box pops up.

3. Select the directory where you want to save the file(s). Click Choose.

   Once the export process has completed, a FILES dialog box pops up, indicating the number of files exported in brackets and listing the files that have been exported.

   Files have a number in their names, used for identifying the channels.

Export screen content text

The following describes how to export screen content text from text-based protocols (that is, terminal-based protocols and HTTP) in TXT format. Screen content text is saved into files as UTF-8 encoded text with UNIX timestamps.

To export screen content text from text-based protocols (that is, terminal-based protocols and HTTP) in TXT format

1. Open the audit trail in the Safeguard Desktop Player application.

   If the audit trail is encrypted, you need the appropriate decryption keys to open it. For details, see Replay encrypted audit trails.

2. Click EXPORT > Export screen content text.

   A Select folder dialog box pops up.

3. Select the directory where you want to save the file(s). Click Choose.

   Once the export process has completed, a FILES dialog box pops up, indicating the number of files exported in brackets and listing the files that have been exported.

   Filenames follow a pattern. Take the following example:

   1415176790.648000-1415176793.926000.txt

   Where:

   • the numbers before the hyphen (-) indicate the beginning of the interval in the session where the screen content text occurred

   • the numbers after the hyphen (-) indicate the end of the interval in the session where the screen content text occurred

   • the numbers are provided in UNIX timestamp format

Troubleshooting the Safeguard Desktop Player

Determine your Safeguard Desktop Player version

To find out which version of the Safeguard Desktop Player application you are using, complete one of the following.

• Start the Safeguard Desktop Player application, and on the opening screen, click > About. This displays the version number of Safeguard Desktop Player and also the underlying adp application.

• Execute the following commands from the command line in the directory where Safeguard Desktop Player is installed:

  Windows: adp.exe --version & player.exe --version

  Linux: ./adp --version; ./player --version