> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/privileged-access-pam-setup/session-management-and-recording.md).

# Session Management & Recording

Every privileged session runs through the SECUREpass Access Gateway, which means every one of them can be watched while it happens and replayed afterwards.

This guide covers how a user starts a privileged session, and how an administrator monitors, terminates and audits sessions from the admin console.

## Starting a privileged session

Users start sessions from the Self Service Portal, not from the admin console.

{% stepper %}
{% step %}

### Open the system

On the dashboard, open the **Systems** tab under **My Resources** and select the system.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/toOVWd4KushKdCVoObuk/assets/01.png)
{% endstep %}

{% step %}

### Choose a connection method

The resource menu offers the ways in:

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/egoYaMYF6ff2qdR8vgNd/assets/02.png)

| Option           | What it does                                                     |
| ---------------- | ---------------------------------------------------------------- |
| Browser          | Opens the session inside the browser — no client software needed |
| Native RDP       | Launches the local RDP client through the gateway                |
| Emergency Access | Break-glass, covered in *Privileged account vault*               |
| View Details     | Shows the resource without connecting                            |
| {% endstep %}    |                                                                  |

{% step %}

### Start the session

Select **Browser**. SECUREpass supplies the vaulted credential and the session opens.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/bcS1uaX8QTH7PilEHB5S/assets/03.png)

The session is being recorded from the moment it opens.
{% endstep %}
{% endstepper %}

## Finding sessions in the admin console

{% stepper %}
{% step %}

### Open the Dashboard

Select the **User & Authentication** tab.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/9oQ1V2ncS6zN9xjSJYuo/assets/04.png)
{% endstep %}

{% step %}

### Find Sessions / Token Creations

Scroll down to **Sessions / Token Creations**.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/avd0PuwOPePsFDy68R7r/assets/05.png)

The chart shows how many SSO tokens and PAM sessions were issued over time, split by protocol:

| Line   | Sessions |
| ------ | -------- |
| Purple | OIDC     |
| Teal   | SAML     |
| Orange | PAM      |

The x-axis is the date; the y-axis is the number of sessions created.
{% endstep %}

{% step %}

### Open the full Sessions page

Select the expand icon in the corner of the widget.
{% endstep %}
{% endstepper %}

## The Sessions page

The page opens with three tabs: **OIDC**, **SAML** and **PAM**.

**OIDC and SAML** list application sessions — who is signed in to which application, whether the session is still active or logged out, and an option to terminate an active one.

**PAM** lists privileged sessions. It is the rest of this guide.

### All Sessions

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/W9zTSScSwFSEMgW2GMRj/assets/06.png)

| Column                           | Shows                                                                               |
| -------------------------------- | ----------------------------------------------------------------------------------- |
| User                             | Who opened the session                                                              |
| Resource                         | The target system                                                                   |
| IP Address                       | The target's address                                                                |
| Protocol                         | RDP, SSH or DATABASE                                                                |
| Start Time / End Time / Duration | When it ran and for how long                                                        |
| Status                           | **TERMINATED** if an administrator ended it, **DISCONNECTED** if it closed normally |
| Recording                        | Play or download the recording, where one exists                                    |
| Files                            | Files transferred during the session                                                |

{% hint style="info" %}
A terminated session shows no recording in the list. Recordings are written for sessions that close normally.
{% endhint %}

### Active Sessions

Sessions currently running. This is where live monitoring happens.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/Zaalaq6XF7DUpI4nJ2vT/assets/07.png)

Each active row offers:

* **Terminate** — end the session immediately.
* **Watch Live** — join and observe the session as it runs.
* A **REC** indicator confirming the session is being recorded.

### Access Requests

Where **Requires Dual Control** is enabled on a system, the approval requests appear here — pending, approved and completed.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/uYa3rGANmkWvc0EzD3Jm/assets/08.png)

| Column                          | Shows                                                                     |
| ------------------------------- | ------------------------------------------------------------------------- |
| Type                            | **Session Gate** — a request to open a gated session                      |
| User / Resource / Account       | Who wants what                                                            |
| Access Period                   | The window requested                                                      |
| Justification                   | The reason the user gave                                                  |
| Status                          | **USED**, **EXPIRED**, or **SLA Expired** where no approver acted in time |
| Approval Level                  | Progress through the chain, for example **1 of 2**                        |
| Assigned Approver / Approved by | Who is responsible and who acted                                          |

{% hint style="info" %}
**SLA Expired** means the request timed out waiting for an approver, not that it was refused. If these accumulate, the approval chain needs attention rather than the requester.
{% endhint %}

### Break-Glass

Every emergency-access session, listed separately and flagged.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/le8hiMdy2nX6uzrfGBtK/assets/09.png)

Rows carry a **BREAK-GLASS** status and a warning marker, with recordings available to play or download. This tab is the review queue — break-glass is only defensible if someone reads it afterwards.

## Protocol views

Four views sit at the top right of the PAM tab: **Session**, **SSH**, **Database** and **RDP**. *Session* is the consolidated view above; the other three show native connection detail for one protocol.

### SSH

PAM connections to Linux systems.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/RbLHvs63aN5fdIO39MUy/assets/10.png)

Four sub-tabs: **Native SSH Sessions**, **Native SSH Logs**, **SSH Web Sessions** and **Live SSH Web Logs**.

The table shows the connection, target host, system user, the SECUREpass user, status, when it was created and when it expires, and the **SSH command** issued to reach the target. Each row can be **Revoked**. The list auto-refreshes every 30 seconds.

### Database

PAM connections to databases.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/mLL1oolu0wQwK7mkDsaY/assets/11.png)

Four sub-tabs: **Native DB Sessions**, **Native Database Logs**, **Database Web Sessions** and **DB Web Logs**.

The table shows the resource and database type, host and port, the database and user, the session token, when it started and expires, and — where a session was cut short — who revoked it and when.

### RDP

PAM connections to remote desktops.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/o82PNhjgSAnE2l8askCU/assets/12.png)

Two sub-tabs: **Native RDP Sessions** and **RDP Sessions**. The table shows the resource, host and port, user, token, status, when the session connected and when it expires.

Sessions are watchable while they run and replayable afterwards — and the two tabs worth checking regularly are Access Requests, where approvals go stale, and Break-Glass, where the emergencies are.