One Identity Safeguard for Privileged Sessions 7.0.3.1 LTS

NOTE: The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions.

This view returns all audited channels whose connection have been closed. The view is defined as follows:

create view closed_connection_audit_channels
as
select *
from channels
where audit is not null
and index_status = 1;

For details on the returned columns, see The channels table.

The closed_not_indexed_audit_channels view

NOTE: The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions.

This view returns all audited channels whose connection have been closed, but have not been indexed yet. The view is defined as follows:

create view closed_not_indexed_audit_channels
as
select *
from channels
where audit is not null
and (index_status = 1
or index_status = 2);

For details on the returned columns, see The channels table.

The connection_events view

NOTE: The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions.

For terminal connections, this view collects the commands issued in a connection. For graphical connections, this view collects the window titles detected in the connection. The view is defined as follows:

select
    channels._connection_channel_id as id,
    events.event,  
    events.printable
from channels,  
    events
where channels.id = events.channel_id;

Querying the table (for example, select * from connection_events limit 10;) will return results similar to the following:

 id |                                         event             | printable
----+-------------------------------------------------------------+-----------
1  | [user@exampleserver ~]$ ls                                  | t
1  | [user@exampleserver ~]$ exit                                | t
2  | [user@exampleserver ~]$ su -                                | t
2  | Password:                                                   | t
2  | [root@exampleserver ~]#                                     | t
2  | [root@exampleserver ~]# ifconfig                            | t
2  | [root@exampleserver ~]# ifconfig                            | t
2  | [root@exampleserver ~]# ifconfig                            | t
4  | [user@exampleserver ~]$                                     | t
4  | [user@exampleserver ~]$                                     | t

The connection_events view has the following columns.

Table 18: Columns of the connection_events table
Column	Type	Description
event	text	The command executed, or the window title detected in the channel (for example, ls, exit, or Firefox).
id	integer	The unique ID number of the entry.
printable	boolean	Set to 1 if every character of the command can be displayed.

The connection_occurrences view

The view is defined as follows:

select
    channels._connection_channel_id as id,
    results.token,
    occurrences.start_time,
    occurrences.end_time,
    occurrences.screenshot
from channels,
     results,  
     occurrences
where channels.id = results.channel_id
and results.id = occurrences.result_id;

NOTE: The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions.

Table 19: Columns of the connection_occurrences table
Column	Type	Description
end_time	integer	End time: Date when the channel was closed.
id	text	The unique id of the entry.
screenshot	text	The filename of the PNG screenshot (as stored on SPS) about the occurrence of the search token.
start_time	integer	Start time: Date when the channel was started.
token	text	The search token visible on the screenshot.

One Identity Safeguard for Privileged Sessions 7.0.3.1 LTS - Administration Guide

The closed_connection_audit_channels view

The closed_not_indexed_audit_channels view

The connection_events view

The connection_occurrences view

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

One Identity Safeguard for Privileged Sessions 7.0.3.1 LTS - Administration Guide

The closed_connection_audit_channels view

The closed_not_indexed_audit_channels view

The connection_events view

The connection_occurrences view