Where a rule has been configured to capture session information, you can review the entire session in the report.
Click Reports on the home page of the console.
Click Command Control Reports in the navigation pane.
Select the report in the navigation pane.
In the navigation pane, select the session that you want to review
Commands for the session data that have been captured are indicated by a Yes in the Capture column.
Click Keystroke Replay in the task pane.
Edit the following fields:
Terminal Type: Change the terminal type if it is set incorrectly.
Find: To find a specific command or string in the report, specify the text in the text box, then click Find. If the report contains hundreds of lines, this allows you to find the command you are interested in.
Show control characters: Use this option to show or hide control characters on the screen.
Show audited commands: Use this option to show or hide the full list of audited commands. If this option is enabled, the screen shows the actual commands that are being run when a user types a command. You can also view each input command individually by mousing over the command.
Show profile commands: Use this option to show or hide the commands run in the user’s login profile when the user’s pcksh login shell has auditing configured to level 2.
From the list of input commands, select a command, then click Output.
Use the Play, Rewind, and Pause buttons to review the data.
Click Cancel to return to the list of reports.