Skip to main content
Every monitored session a Syteca Client records appears on the Client Sessions tab of the Activity Monitoring page. With deployments of any real size, the question isn’t whether you have the data - it’s how to find the specific session you need in a list of thousands. This page covers how the session list is organized, every filter and search mode available, and the bulk actions you can run on selected sessions. For playing back a session once you’ve found it, see The Session Viewer.
Viewing the Activity Monitoring page requires the Viewing Monitoring Results administrative permission, plus the Viewing Monitoring Results Client permission for each specific Client whose sessions you need to see.

​
How sessions are organized

Monitored data from Windows, macOS, and Linux Clients is grouped into sessions. The data and lifecycle vary slightly by OS: In every case, the maximum duration of one session is 24 hours. At 00:00 (midnight), all live sessions terminate, change from Live to Finished, and new live sessions start automatically. The two halves remain linked in the Session Player so you can navigate between them.

​
When are new sessions started?

By default, a session starts automatically as soon as any user logs in to a Client machine, and ends automatically when they log out. Sessions still active at midnight are also terminated automatically at that point. What happens next depends on the Client’s operating system:
If an idle event was already registered before midnight and the user still hasn’t acted by midnight, that same idle event carries into the new session once it starts (Windows only - see the table above).
Example: 5 users are logged in to 5 different Client computers. In 2 of those sessions the user has taken at least one action; in the other 3, no action has occurred since login. At midnight, all 5 sessions end automatically. The 2 active ones restart immediately regardless of OS. The 3 inactive ones restart immediately only on Windows - on macOS and Linux, those 3 don’t start a new session until the user performs an action.
Automated system tasks (like a background script) don’t count as user actions and aren’t recorded. On Windows and macOS, an idle event still registers during a period with no user action, even if the system runs an automated task during that time.
If monitoring filters are configured (application, user, time, IP, or keystroke filtering), sessions still start normally - the filter only controls whether activity within the session gets recorded.

​
Open the Sessions List

Client Sessions tab grid showing sessions with status icons, OS icons, alert color indicators, user, Client, IP, and timing columns

The Client Sessions tab - every recorded session in one grid, with OS icons, alert risk-level indicators, and Live vs Finished status.

Sign in to the Management Tool and click Activity Monitoring in the left navigation. The Client Sessions tab is selected by default. The total number of sessions matching the current filters appears at the top. The grid below shows each session with these default columns:
Click any column header to sort by it. The up/down arrow indicates current sort order; click again to reverse. Only one column can be the sort key at a time. Columns where data can’t be sorted don’t show the arrow.
Drag column boundaries left or right to resize columns. Use Results on Page in the bottom right to change how many sessions appear per page. Click Refresh in the top right to re-pull from the database without changing your filters.

​
Add or hide columns

Click Column Display at the top of the page to open the Manage Columns pop-up. Select checkboxes to add columns, deselect to hide, drag with the up/down arrows to reorder. Beyond the defaults, these columns are available:
If the user logs into a Client computer remotely after the Client session already started using DameWare, Radmin, UltraVNC, or TightVNC, the remote IP address can’t be detected.

​
Filter sessions

Top of the Client Sessions tab showing active Who, Where, When filters plus expanded More criteria menu with additional filter options

The session filters - default Who / Where / When always present, with More criteria revealing additional filter parameters.

Filters narrow the list to sessions matching specific criteria. Multiple filters can be applied simultaneously, and within each filter (except When), multiple values can be selected - the list re-filters with each parameter you add.

​
Default filters

The Who filter defaults to displaying the first 1,500 session records. To raise this, add the SessionsFilteredByUserMaxCount key to the EkranServer.Settings.config file on the Application Server, for example:
The config file lives in C:\Program Files\Ekran System\Ekran System\Server. In SaaS, this file isn’t accessible - contact your Syteca vendor or the Syteca Support team to change the default.

​
Additional filters

Click More criteria to add any of these: To remove an additional filter, click the X next to its button. The default Who / Where / When filters always remain.

​
Search inside session content

The Search by box in the top right searches across multiple data types - not just session metadata, but the actual content recorded. The default search covers:
  • Application names
  • Activity titles
  • URLs
  • Linux commands and parameters
  • Alert names
  • USB rule names
To extend the search into more sensitive content, click the … button next to the Search by field and enable the relevant options:
Use Search in First N sessions (10, 100, 500, 1000, or all) on the same ... menu to limit search scope. Searching keystrokes across all sessions can be slow on large deployments - start with a smaller scope and widen if needed.

​
Search using a list of keywords

For investigations involving many search terms (a list of compromised account names, a list of regulated URLs, a list of forbidden commands), upload a keyword file:
1

Create the keyword file

Create a .txt file with one keyword per line (or separated by spaces).
2

Upload it

Click the … button next to the Search by field, then Browse keywords, and select the file.
3

Run the search

Click the Search icon. Results appear in the session list.
Searching large keyword lists across many sessions can take considerable time and impact Application Server performance - consider narrowing the session list with filters first, or using Search in First to bound the scope.

​
Bulk Action

Select one or more sessions with their checkboxes (or use Select All in the column header), then click Bulk Action in the top left for these options:
Only the Cleanup operation is available through Bulk Action - not the broader Archive & Cleanup operation, which is configured per-Client.

The Session Viewer

Play back a session once you’ve found it - three panes, magnifier, live mode, bookmarking.

Alerts

The alert events that show as colored icons in the Alerts column.

UEBA risk scores

The behavior anomaly risk scores in the Risk Score column.

Pseudonymizer

How the list looks when Pseudonymizer is enabled - randomized aliases, hidden columns, Expose Requests.