Searching for Archived Sessions

After archiving data to the archive storage, you can retrieve specific sessions from the archive to replay them. You can search for sessions from specific servers (or Agents), or from a specific period of time or date range, as described in Restoring Archived Sessions.

Advanced search functionality is provided in the Search tab of the Configuration > Archive page, where you can search for archived sessions according to their titles.

To search for archived sessions by session titles

1. Navigate to Configuration > Storage Management > Archive.

2. Click the Search tab.

3. From the Search for drop-down list, select an option to search for a particular type of data:

   • Metadata: enables you to search for keywords in the metadata information that is stored in the ITM On-Prem (ObserveIT) Database. For details, see Recording Metadata Information.

   • Ticket number: if an IT ticketing system is integrated in ObserveIT, you can specify the ticket's unique reference number to quickly locate all sessions related to the ticket. For details, see Service Desk Integration.

   • Application: enables you to search for session titles in applications that were used on the monitored computers.

4. In the text box next to Search for, type the required string/keyword or ticket number.

5. If you are searching for Metadata, from the drop-down list on the right, select an option to specify the type of sessions in which you are searching: All, Windows, Unix, or Unix System Calls.

6. Select Archive Database and type the name of the database that contains the archived session title for which you are searching (or click to browse and select it from the Archive Databases List window).

7. Select Endpoint and type the name of the endpoint that was monitored when your required session was recorded (or click to browse and select a specific endpoint from the Endpoint List window). Alternatively, you can select the All Endpoints option to search through all monitored endpoints.

8. To further filter your search criteria, specify a time period, or start and end dates for your archived session search.

9. When you have finished defining your search criteria, click the Search button.

   After a short time, the search results are displayed listing all the sessions that include the window title that you specified in your search. You can expand each session by clicking on the [+] sign, and view a textual breakdown or transcript (similar to DVD chapters) of all the applications, files, and window titles, that the user accessed during the session.

   If any SQL Server queries were performed on a session, they will be displayed at the end of the session. For more information, see Auditing DBA Activity.

   

Viewing and Replaying the Retrieved Sessions

You can view and replay retrieved sessions directly from the archive. However, if you want to view and replay these archived sessions from the Endpoint or User Diaries, you must first restore them to the production database.

To restore the archived sessions to the production database

1. In the Archive Search results list, select one or more sessions to restore, and click Restore Selected Sessions.

   You can also click Restore All Sessions to restore all the archived sessions for the selected session title.

2. After a short time (depending on the number and size of the sessions you are restoring), the restored session will appear in the production database, and will be accessible via the regular Endpoint or User Diaries, or via the Free Text Search and Reports options.

   Although the specific sessions were restored to the production database, they will still remain in the archive database indefinitely.