> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Linux Clients
> How Syteca Linux Clients monitor SSH and terminal sessions, optionally X Window System GUI sessions, and how to fix Rescue mode and post-update status.
A Linux Client is the Syteca agent installed on a target Linux computer to monitor user activity in the terminal - and optionally GUI sessions in the X Window System. The Client sends monitored data to the Application Server, where it can be reviewed in the Session Viewer. This page covers how a Linux Client monitors each kind of session, how to read its status, and how to resolve Rescue mode.
GUI monitoring (X Window System) is optional and is **enabled during installation**. See [Installing Linux Clients](/docs/administration/clients/install-linux).
For configuration parameters and uninstallation, see the dedicated pages under this section.
## Remote SSH and local terminal sessions
In SSH and local terminal sessions, the Linux Client records:
1. **User actions** - keystrokes (including commands and parameters executed).
2. **Commands** executed in any scripts that run.
3. **System function calls.**
4. **System responses** - command output from the terminal.
### Session lifecycle
* A new monitoring session starts every time a remote SSH session is opened.
* The maximum duration of one SSH session is **24 hours** - all live sessions terminate at midnight, change from **Live** to **Finished**, and new live sessions start automatically.
* A session changes to **Finished** when the remote SSH terminal is closed or the Linux Client is disconnected from the Application Server. When the Client reconnects, the session returns from **Finished** to **Live**.
* Even if the license is unassigned from the Linux Client or the Client process is killed, monitoring of in-progress sessions continues until the remote SSH terminal is closed.
* If the Client ever stops, the **EkranAgent** watchdog process restarts it automatically.
[Remote X-forwarded sessions](/docs/session-monitoring/player/per-os-playback#remote-x-forwarded-sessions) can also be monitored - slightly differently, as child sessions of a remote SSH parent session.
## GUI (X Window System) sessions
When GUI monitoring is enabled, Syteca records local or remote sessions started via the GUI - screen captures, application names, activity titles, and activity times.
* The Client starts monitoring after a user opens a new application window.
* **User activity is recorded every 10 seconds.**
* A new session starts every time the computer is restarted.
* The maximum duration of one local session is **24 hours** - all live sessions terminate at midnight, change from **Live** to **Finished**, and new live sessions start automatically.
* If the user has multiple monitors, the Linux Client records screen captures from all of them.
* If the Client ever stops, the **EkranAgent** watchdog process restarts it automatically.
## Read the Client status
### Up-to-date Client
If [automatic update](/docs/administration/clients/update-clients) is enabled, the Client updates itself as soon as it connects to a newer Application Server.
### Not-up-to-date Client
If the **Update Client automatically** checkbox is **not** selected for a Client, it must be [updated manually](/docs/administration/clients/update-clients#update-manually). Such Clients appear with a **gray (offline) status icon** in the Clients list.
Clients that aren't up to date **continue to monitor user activity and send data** to the Application Server as normal. After an update, the monitored data recorded **before** the update remains accessible.
### Yellow status icon - Rescue mode
If a Linux Client appears with a **yellow status icon** in the Clients list, it's in **Rescue mode** - the Client is experiencing some issue. Rescue-mode Clients can be **Online** or **Offline** (hover the icon to see which).
Rescue mode does **not** affect sessions that have already started. It prevents *hooking*, which means the session recorder will not start for any **new** sessions while the Client is in Rescue mode. In other words, no new sessions are recorded until Rescue mode is resolved.
Sign in to the Management Tool and click **Clients** in the left navigation.
Select the checkbox next to each Client showing the yellow Rescue-mode status icon.
Use the **Search** box and filters at the top of the Clients tab to find specific Clients.
Click **Bulk Action** in the top left and choose **Troubleshoot Rescue Mode**.
If **at least one Client** anywhere has an issue, a yellow exclamation mark also appears next to the **Clients** navigation link in the left menu.
## Check the Client from the Linux command line
The **Read the Client status** section above covers the status view in the Management Tool UI. On the Linux machine itself, use the Terminal to verify that the Client service and its processes are running. This is the first diagnostic step when a Linux Client does not appear on the **Clients** page of the Management Tool after installation.
### Check the Client service status
Run the following command in the Terminal:
```bash theme={"system"}
service Ekran status
```
Expected output shows the service in the `active (running)` state along with the service description and its process IDs.
### Check the Client processes
To confirm that the Client processes are running, list the running processes and filter to Syteca:
```bash theme={"system"}
ps -ef | grep -i ekran
```
Expected output shows one or more processes with `ekran` in their command line. The exact number of processes depends on the Client version and configuration; the absence of any matching process indicates the Client is not running.
If the Client service reports `active (running)` but the Client still does not appear on the Clients page of the Management Tool, check network connectivity from the Linux machine to the Application Server and confirm that the Application Server hostname or IP resolves correctly from the Linux machine.
## Related
Automatic and manual update procedures for any OS.
The Windows equivalent - local and multiple concurrent sessions.
The macOS equivalent - including required system permissions.
Online / Offline / Disconnected Client counts.