How to search for O&M sessions that are established in a bastion host and view the details of the sessions - Bastionhost

Each time an O&M operation is performed in Bastionhost, a session is generated. After the session ends, a record is generated for the session of the O&M operation. Auditors can view the session record to check whether an unauthorized operation is performed.

Procedure

Log on to the console of a bastion host. For more information, see Log on to the console of a bastion host.
In the left-side navigation pane, choose O&M Audit > Session Audit.
Click the tab on which you want to view the sessions.
- Graphic Text: You can query the sessions of O&M operations that are performed on servers by using your bastion host in Remote Desktop Protocol (RDP) mode. You can query the sessions of O&M operations only on servers that run Windows Server 2008 or earlier versions.
  Note
  If you select SSH Options when you configure RDP Options for a control policy, the keyboard operations that are performed during RDP-based O&M are displayed in the session list. For more information, see Configure a control policy.
- Commands: You can query the commands that are used to perform O&M operations on servers by using your bastion host in SSH mode.
- File Transfer: You can query the sessions of O&M operations, such as file upload, file deletion, and file renaming, that are performed on servers by using your bastion host.
- Database Audit: You can query the SQL statements that are used in the O&M operations on databases by using your bastion host and the execution results.
- Log Backup: You can use your bastion host to manage O&M logs. For more information, see Log backup.
Configure the search conditions and click Search.
You can configure search conditions based on search items, such as host IP addresses, usernames of sessions, and session IDs.
You can also click Save in the Filters section to save the search conditions. In the Save dialog box, specify the Filter Template parameter and click OK. After you save the search conditions as a template, you can select the template name from the Default Condition drop-down list in the upper-right corner of the session list. This way, the saved search conditions are applied.
In the session list, find the required session. In the Actions column, you can play the session video or view the session details.
- Play the session video
  Click Play to view the O&M video.
- View the session details
  Click Details. In the Session Details panel, view the basic information about the session, user, and host.