Exporting sessions and session data

In addition to specifying the criteria for finding sessions of interest, you can use Find Session to selectively export session data to a file. You can export the following information:

  • A list of sessions matching the criteria you specify.

  • An indexed list of events associated with the Windows sessions that match the criteria you specify.

  • An indexed list of commands associated with the UNIX sessions that match the criteria you specify.

  • The UNIX input associated with the UNIX sessions that match the criteria you specify.

  • The UNIX input and output associated with the UNIX sessions that match the criteria you specify.

You specify the export operation, type of data to export, file format, and file location using the following command line options:

/export=[SessionListZZ_BAR_ZZWashEventsZZ_BAR_ZZUnixCommandZZ_BAR_ZZUnixInput
|UnixInputOutput]
/format=[htmlZZ_BAR_ZZhtmZZ_BAR_ZZcsvZZ_BAR_ZZpdfZZ_BAR_ZZxml]
/path=<folder_path>

You can use these options in combination with other criteria, such as /user or /machine, to export information for a specific user, computer, or time. You can specify the /format option used for exporting the sessions of interest. If you don’t specify the /format option, sessions matching the criteria you specify are exported as comma-separated values (.csv) in a text file. If you are exporting Windows events, UNIX commands, UNIX input, or UNIX input and output, each session is exported as a separate file in the format you specify.

If you are exporting UNIX commands, UNIX input, or UNIX input and output, you can also use the command line options /role and /ticket to export sessions based on specific role or trouble-ticket information. Before you can use these options, however, you must configure the information required. For example, if you want to find all of the UNIX commands executed by a user running the db_backup role, you must first define and assign the db_backup role using Access Manager.