User Activity Views

The User Activities View provides information about all user activities on every monitored endpoint. Each time a user logs on to a monitored endpoint, all actions performed by that user are captured screenshots, and metadata is collected about the applications, registry settings, files the user accessed, and so on. (It is the default view in the Use Diary.)

From this User Activities View you can:

• See latest user sessions from all the monitored endpoints with the default date filter.

• Display session time by the endpoint or server location.

• See each time a user logs on to a monitored endpoint, all actions performed by that user are captured s screenshots, and metadata is collected about the applications, registry settings, files the user accessed, and so on.

• Launch the ObserveIT Session Player, which replays the entire recorded session from beginning to end.

• Filter what you see by time period, user and/or endpoint.

• View detailed information about the session as well as user activity in chronological order.

• Export to Excel and print the User Diary Activities list.

The table describes the fields in the Endpoint Activities View.

Click for details about a selected session. See Session Details Views.

Field	Description
Session Duration	The last activity performed by the user in the session.
Endpoint time zone	The time shown is according to the endpoint time zone.
Alert Indication	If alerts were generated during the session, an alert indication is displayed showing the highest alert severity level.
Login	The login account used to enter the session (user account used in the Windows logon process).
User	The actual user name used to enter the session provided by ObserveIT's Identification Services.
	The endpoint name of IP address from which the connection was made. The , and icons show whether the endpoint is running a Windows-based, Mac-based or Unix-based operating system.
	The client name or client IP address.
Slides	The number of screenshots taken during the session (or commands in the case of Unix sessions). The warning icon indicates the session was modified.
Video	A link to a video of screenshots with detailed session data. This replays the entire recorded session from beginning to end. indicates that the session is live, and that a user is currently logged in to the endpoint. Clicking this icon will launch the Session Player in real-time playback mode.

If the appears the session was modified. For example, this icon would appear if a screenshot was deleted from a recorded session. Note that the warning icon will only be displayed if the Enable Session Integrity check box was selected in the Security tab of the Configuration > Security page (for details, see Securing Images on the File System ).

Filtering the Display of Sessions on a Recorded Endpoint

You can filter the display by:

• Period: Show the activities for specific dates or for the latest days, weeks, months, or years.

• Login: Show for all users or a specific user. The Filter by login/user is available from the Endpoint Diary tab.

• Show time: Show time by the server location or local endpoint location. Use to switch between the time options. (See Showing Agent Time.)

• Endpoint: Show for all endpoints or a specific endpoint.

If alerts were generated during the session, an alert indication is displayed showing the highest alert severity level.

To filter, do the following:

1. Select the Period of time or date range for which you want to display the sessions.

2. From Show time by, select Server time or Endpoint (local) time.

3. From the Login drop-down list, select the relevant user name (or use auto-complete which provides a list of matching user names). You can also enter text directly in the Login field to search for the required login name or select the required user name from the Login List popup window.

   Clicking the User statistics link opens a window displaying statistics about the selected user during the specified time period, including a breakdown of the computers that were accessed by the user and the daily number of screen frames that were recorded by ObserveIT.

   Clicking the Search link enables you to see the results of search operations for the required logins (see Viewing Search Results).

4. From the Filter by endpoint drop-down list, select the endpoint name you want to filter by.

   Select Show IP if you want to show the IP in addition to the endpoint name.

5. Click the Show button to refresh the page to display list of sessions per your selected criteria.

By default, the page shows up to 20 activities; you can change the default by selecting 50 or 100 from the Items per page drop-down list above the table.