> ## Documentation Index > Fetch the complete documentation index at: https://syteca.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Per-OS Playback Details > What's specific to playing Syteca Client sessions for each operating system — Windows clipboard/USB/URL/idle/secrets data, macOS clipboard, and Linux SSH/X-forwarded/GUI sessions. The general behavior of the [Session Viewer](/docs/session-monitoring/player/overview) is the same regardless of which OS the session was recorded from — but each OS has its own data types and quirks worth knowing. This page is the per-OS reference: the data types that surface in the Details area for Windows, the macOS playback specifics, and the three Linux session variants (SSH/terminal, X-forwarded, and GUI). For the general interface — three-pane layout, playback controls, the magnifier — see [the Session Viewer overview](/docs/session-monitoring/player/overview). For the grid pane specifically, see [the Metadata grid](/docs/session-monitoring/player/metadata-grid). ## Open a session The starting flow is the same on every OS: click the **Play** icon next to a session on the **Client Sessions** tab (Activity Monitoring page), or just double-click the row. The session opens in a new browser tab or window depending on your browser settings. ## Windows session playback Windows sessions are the richest — they include screen captures or video, keystrokes, clipboard text, file upload operations, USB events, URLs visited, idle events, and secrets used. The **Session Player** shows the captures or video, the **Metadata grid** lists each recorded activity, and the **Details area** below the player shows fine-grained data for whichever record is currently selected. ### Clipboard text data The Client monitors **Copy**, **Cut**, and **Paste** operations performed by context-menu commands or these shortcuts: `Ctrl+C`, `Ctrl+Ins`, `Ctrl+X`, `Shift+Del`. Clipboard activity appears in the Metadata grid's **Text Data** column with operation-specific labels: | Label in Text Data | Operation | | ------------------------- | ----------- | | **\[Clipboard (Copy)]:** | Cut or Copy | | **\[Clipboard (Paste)]:** | Paste | When a clipboard record is selected in the grid, the full clipboard text appears in the **Details area** below the Session Player. Any alerts triggered by clipboard content are displayed alongside. ### USB device info Whenever a USB device is plugged into a Client computer, the activity is recorded with these grid fields: | Field | Value | | -------------------- | ------------------------------- | | **Activity Title** | `USBStorage - ` | | **Application Name** | `[Monitoring event]` | The USB device information appears in the **Details area** when you select the record in the grid. If a [USB monitoring rule](/docs/session-monitoring/usb-devices/usb-rules) was triggered: * The grid record gets a colored bar on the left (red / orange / blue per the risk level). * The Session Player shows an Alert icon at the bottom (matching color). If the **Enable screen capture recording along with user activity recording** option isn't selected on the Client, sessions from that Client won't contain any screen captures or video — but USB activity is still recorded in the grid. ### URLs visited When [URL monitoring](/docs/session-monitoring/recording/user-activity-recording) is enabled (Windows and macOS Clients), every URL the user visits in a browser is recorded. * The **URL** column in the Metadata grid always shows only the **top and second-level domain** (e.g. `example.com`), even if the **Monitor top and second-level domain names only** option isn't selected. * The **full URL** appears in the Details area when you select the record. * If the user views one page for a while, multiple records may share the same URL. Capturing a URL takes approximately **600 milliseconds**, so the screen capture and the URL associated with it may not be perfectly synchronized — a capture may briefly appear next to the URL from the previous capture. ### Idle state Idle activity is recorded and displayed as `Idle` in the Metadata grid if either monitoring option is enabled on the **Editing Client / Editing Client Group** page → **Monitoring \[Windows/macOS]** tab → **Monitoring Parameters** section: * **Detect system IDLE events** * **Register IDLE event when user is inactive** If neither is enabled, idle periods don't show up as separate records — only the next user activity does. ### Secrets used [PAM secrets used](/docs/pam/secrets/use-secrets) during a session are highlighted in color in the Metadata grid. When you select a secret-related record, the secret data associated with it appears in the Details area below the Session Player — useful for audit trails of "who accessed which credential, and when, and what did they do with it." ## macOS session playback macOS playback works the same way as Windows: open a session by clicking it on the Activity Monitoring page, view screen captures in the Session Player and associated metadata in the grid. The columns available are the same as Windows (see [Metadata grid columns](/docs/session-monitoring/player/metadata-grid#columns-per-client-os)). The notable difference is the clipboard shortcut set. ### Clipboard text data (macOS) The Client monitors **Cut**, **Copy**, and **Paste** operations triggered by any of these: | Input method | Examples | | --------------------- | ------------------------------------------------------------- | | **Shortcut keys** | `Cmd+X` (cut), `Cmd+C` (copy), `Cmd+V` (paste) | | **Context menu** | Right-click → Cut / Copy / Paste | | **Application menus** | Any menu command containing the word "Cut" / "Copy" / "Paste" | | **Drag & drop** | Counts as Cut/Copy + Paste | The labels are the same as Windows — `[Clipboard (Copy)]:` for Cut or Copy operations, `[Clipboard (Paste)]:` for Paste. When a clipboard record is selected, the full text appears in both the Session Player area and the Details area below. ## Linux session playback Session Viewer playing back a Linux SSH session showing the recreated terminal on the left and the Metadata grid with commands, actions, and parameters on the right Linux sessions come in three flavors, each with its own playback specifics: | Variant | What's recorded | | ------------------------------- | --------------------------------------------------------------------------------------------------------------- | | **Remote SSH / local terminal** | Commands executed (with parameters), system function calls, command outputs, and optionally all keystroke input | | **Remote X-forwarded** | GUI applications opened in remote SSH sessions, monitored as child sessions of the SSH parent | | **Local X Window System (GUI)** | Screen captures of local GUI sessions, application names, activity titles, actions, parameters | ### Linux SSH and local terminal sessions When you play an SSH or terminal session, the **Session Player** shows a graphically recreated terminal — what the user actually saw — and the **Metadata grid** shows the commands, function calls, parameters, and outputs. #### Search and filter Linux session data Beyond the standard [grid search](/docs/session-monitoring/player/metadata-grid#search-filter-and-sort-inside-a-session), Linux sessions have additional filter options. Click the **Search** button next to the Search field to open the drop-down: | Option | Effect | | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Search in output** | Also search the command output response data, not just commands and parameters. | | **Show function calls** | Display records containing system function calls (shown in the **Action** column, with their commands and parameters in the corresponding columns). | | **Show only execution commands** | Filter to only show records containing `exec` system function calls. | | **Show inputs** *(requires User Input Monitoring)* | Display records containing **all** keystrokes entered by the user — not just commands. The word `input` appears in the **Action** column, with the keystrokes in the **Parameters** column. | #### Enable User Input Monitoring (Linux) User Input Monitoring captures *every* keystroke a user types in an SSH or terminal session, not just executed commands. It's disabled by default and requires a server-side configuration change to enable. On the Application Server computer, open the `EkranServer.Settings.config` file in a text editor. The default location is: ```text theme={"system"} C:\Program Files\Ekran System\Ekran System\Server ``` Inside the configuration file, add: ```xml theme={"system"} ``` Restart the Application Server for the change to take effect. Sign back in to the Management Tool. On the **Editing Client** (or **Editing Client Group**) page, on the **Monitoring \[Linux]** tab, select **Enable user input monitoring**, then click **Finish**. User Input Monitoring detects keystroke events as user actions separated by **Enter** key presses — the system groups all keystrokes between two Enter presses into one record. #### Switch between linked SSH sessions SSH sessions that restart automatically at midnight are linked to each other in the Session Player. Use the **Previous Session** and **Next Session** buttons in the player to switch between adjacent linked sessions. These buttons are different from the adjacent **Previous** and **Next** record buttons — see [Navigate records with the keyboard](/docs/session-monitoring/player/metadata-grid#navigate-records-with-the-keyboard) for the record-level navigation. ### Remote X-forwarded sessions **X-forwarding** is used to monitor GUI applications (in X11 sessions) opened by users in remote Linux SSH sessions. These GUI applications can't otherwise be monitored directly inside the SSH session — they need the X-forwarding pattern. Common use cases: * An application can't be installed locally. * A user wants to launch a Linux application on a macOS or Windows desktop. * An application needs to be physically located on a remote server, but launched on a local workstation. When X-forwarding is used, the applications opened are monitored as **separate X-forwarded "child" sessions of the SSH "parent" session**. #### In the Sessions List For X-forwarded sessions, the Sessions List on the Activity Monitoring page is slightly different: * A separate row appears in the grid for each application the user opens in the SSH session (the child) — in addition to the usual row for the SSH session itself (the parent). * An X-forwarding icon marks the child rows. * The **User's Comments** column displays the name of the X-forwarded application opened. * The **OS** filter has a **Linux X forwarded** option to display only X-forwarded sessions. The **User's Comments** and **OS** filter aren't displayed by default. Add User's Comments via the **Columns Display** button on the [Sessions List](/docs/session-monitoring/sessions-list#add-or-hide-columns), and add the OS filter via **More criteria**. #### In the Session Viewer (child session) When you play an X-forwarded child session: * The Session Player shows a **To Parent Session** button in the top right (in place of the usual Tools button) — click it to jump to the SSH parent session. * The Metadata grid shows only **Activity Time**, **Activity Title**, and **Application Name**. Use the Search box on the Activity Monitoring page to find X-forwarded sessions for a specific application — e.g. enter `xterm` to find all sessions for that application. #### In the Session Viewer (parent session) When you play the SSH parent session: * For each X-forwarded child session that ran inside this parent, the Metadata grid has: * `xwindow` in the **Command** column (indicating an X-forwarded child). * The application name in the **Action** column as a clickable blue link, alongside the user and host names. Click the link to jump to the corresponding X-forwarded child session. This bidirectional linking makes it straightforward to investigate "the user opened this GUI app inside an SSH session — show me what they did in the GUI" without losing the parent SSH session context. ### Linux GUI (local X Window System) sessions Local GUI sessions on Linux Clients are played like Windows or macOS sessions — screen captures in the Session Player, metadata in the grid. The grid columns for local X Window System sessions are: * **Activity Time** * **Activity Title** * **Application Name** (or command input by the user) * **Action** (the user action or system function call executed) * **Parameters** (input by the user) Idle behavior, alert bar indicators, and search/filter all work the same way as the other Linux variants. ## Related The three-pane layout, playback controls, magnifier, live mode, and bookmarking. Column reference per OS, search/filter/sort, and Synced vs Filtered modes. USB monitoring rules and the events that appear in the Metadata grid. The PAM secrets that get highlighted in the grid when used during a session.