Click Compliance Auditor on the home page of the console.
Select the record for which you want to view a keystroke report.
Click View Record in the task pane.
Click View Keystroke Report in the task pane, or click the Keystroke button.
The text that the user entered during the session is shown on the Input page. The first column displays color-coded indicators for command risk level and rule risk level, ranging from green (low) to red (high). For more information, see Setting the Command Risk and Modifying a Rule.
On the Command Control Keystroke Report page, edit the following fields:
Terminal Type: Change the terminal type if it is set incorrectly.
Find: To find a specify command or string in the report, specify the text in the text box, then click Find.
Show control characters: Use the Show control characters check box to show or hide control characters on the screen.
Show audited commands: Use the check box to show or hide the full list of audited commands. If this option is enabled, the screen shows the actual commands that are being run when a user types a command. You can also view each input command individually by mousing over the command.
Show profile commands: Use the check box to show or hide the commands run in the user’s login profile when the user’s pcksh login shell has auditing configured to level 2.
(Optional) To see the keystroke text being played back with the screen output, click Output.
You can start the playback from a specific line in the input by selecting that line before clicking Output.
Click Play to play the keystroke entries and view the output.
Click Rewind to go back to the beginning.
Click Pause to pause the playback.
Click Forward to skip any pauses in the playback where the user might have taken a break from typing.
Set the Playback Speed to Real Time, Double Speed, or Full Speed.
Set the Scrollback field to the amount of text you want to be able to scroll back through, in kilobytes.
Change the Terminal Type to the one you want.
Click Cancel to return to the record list.