To view the activities of a database user, perform the following:
In the Reporting console, select the appropriate database command, such as DBOracleAccess command for Oracle database, DBMSSQLAccess command for Microsoft SQL Server database, and so on.
Command control keystroke reports appears, which displays all the commands executed by the user on the database on that particular session.
(Conditional) If Command Risk for database query/ table is defined in the Command Control console, based on the level of risk a color is displayed against a particular input.
You can disconnect a session if the activity of a user is suspicious. For more information, refer Disconnecting a Privileged Session.
NOTE:
When a user logs in to any database server through Privileged Account Manager, the database session can contain multiple connections. If the user executes any suspicious query (for which auto-disconnect is configured in the Command Risk), Privileged Account Manager disconnects the connection on which the query is executed. The user can still use the existing session, or establish a new database session. If the suspicious query results in blocking the user (if Auto Block is also configured in the Command Risk), Privileged Account Manager will not allow any new session, or any new connections within the existing sessions.
For any database, Privileged Account Manager disconnects a session if auto-disconnect is configured for a user. In case of such progressive session with multiple active connections, if the Privileged Account Manager terminates any connection, the remaining connections of the session won't be affected.