Event Capture

I am having an issue with Event Capture on a Windows 2008 SP1 server. The Event Capture test passes, but i have been reviewing past session activity and have seen sessions of up 45 minutes but nothing is being captured, bookmarked, etc..   What would allow a PSM to connect but not record any of the events?

  • Hello,

    It's difficult to provide a root cause without investigating your issue in more detail.

    There are only certain types of actions or events that are captured. So the amount of events that are capture per session, will depend on the type of activity that is performed.

    It could also depend on options you have selected in the Access Policy assigned to the Account (Record Events?, Allow KSL View, Record Keystrokes etc).

    Have you seen Chapter 44 in the TPAM Administrator Guide, "Configuration for Capturing Events on Windows® Systems"? This chapter details exactly what requirements are needed and also suggests some possible causes for capture failure.