> ## Documentation Index > Fetch the complete documentation index at: https://syteca.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Filtering Parameters > Reduce the volume of monitored data by filtering Client activity by application, keystroke context, time window, remote IP address, or user. Syteca can reduce the volume of monitored data a Client sends by filtering out activity that doesn't need to be recorded — by application, by time window, by remote IP address, by user, or by which applications keystrokes are logged in. Every filter on this page shares the same **Filter State** model, set on the corresponding tab of the **Editing Client** / **Editing Client Group** page: * **Disabled** — no filtering; everything in scope is monitored. * **Monitor only \[scope matching the defined values]** — only the specified items are monitored; everything else is skipped. * **Monitor all \[scope] except** — everything is monitored except the specified items. Filtering reduces data volume and noise, not just storage cost. Combining **Application Filtering** with the [Capture active window only](/docs/session-monitoring/recording/user-activity-recording) recording parameter is the recommended way to fully exclude sensitive applications from being monitored at all. ## Application filtering Applies to Windows and macOS Clients. Application filtering reduces the amount of information received from a Client by defining applications, active window titles, or URLs for which data is skipped during monitoring. It affects screen captures and keystroke logging together. Configure it on the **Editing Client** / **Editing Client Group** page, **Application Filtering** tab, **Application Filtering** section: | Filter State | Effect | | --------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | **Disabled** | All applications, window titles, and URLs are monitored, including screen captures and keystrokes. | | **Monitor only activity matching the defined parameters** | Only the specified applications, window titles, or URLs are monitored. | | **Monitor all activity except** | Everything is monitored except the specified applications, window titles, or URLs. | Applications are identified by **Application name contains** or **Active window title or URL contains**. The two fields combine with OR logic — an activity matching either condition is included (or excluded, in exclude mode). | Intent | `.ini` parameters | | ----------------------------------------------------------- | ----------------------------------------------------------------------------------- | | Monitor everything, no filter | `FilterState=disable` | | Monitor only titles containing "facebook" or "gmail" | `FilterState=include`
`FilterAppTitle=Facebook,Gmail` | | Monitor only apps named "firefox" or "chrome" | `FilterState=include`
`FilterAppName=Firefox,Chrome` | | Monitor apps named "firefox"/"chrome" OR titled "doc" | `FilterState=include`
`FilterAppTitle=doc`
`FilterAppName=Firefox,Chrome` | | Monitor everything except titles containing "work" or "doc" | `FilterState=exclude`
`FilterAppTitle=work,doc` | | Monitor everything except apps named "word" or "excel" | `FilterState=exclude`
`FilterAppName=word,excel` | ## Keystroke filtering Applies to Windows Clients. Keystroke filtering reduces the amount of keystroke data received from a Client by defining which applications keystrokes are monitored in — independent of whether keystroke logging itself is enabled. Configure it on the **Editing Client** / **Editing Client Group** page, **Keystroke Monitoring** tab, **Keystroke Filtering** section. | Filter State | Effect | | --------------------------------------------------- | ----------------------------------------------------------------------- | | **Disabled** | Keystrokes are monitored in all applications. | | **Monitor keystrokes only in defined applications** | Keystrokes are monitored only in the specified applications. | | **Monitor keystrokes in all applications except** | Keystrokes are monitored in all applications except the specified ones. | Applications are identified the same way as Application Filtering: **Application name contains** or **Active window title or URL**, combined with OR logic. ## Monitoring time filtering Applies to Windows Clients. Monitoring time filtering reduces the amount of information received from a Client by defining the days of the week and hours during which it records activity. Configure it on the **Editing Client** / **Editing Client Group** page, **Monitoring Time Filtering** tab. | Filter State | Effect | | ----------------------------------------- | ------------------------------------------------------------- | | **Disabled** | Activity is recorded 24/7. | | **Monitor only during defined hours** | Activity is recorded only during the defined days and hours. | | **Monitor only outside of defined hours** | Activity is recorded only outside the defined days and hours. | In the `.ini` file, monitoring hours must be defined in 24-hour format. | Intent | `.ini` parameters | | -------------------------------- | ------------------------------------------------------------------------------------------------------------ | | Record everything, no filter | `MonitorTimeFilterState=disable` | | Record only Mon–Fri, 8 AM–6 PM | `MonitorTimeFilterState=include`
`MonitoringDays=Mon,Tue,Wed,Thu,Fri`
`MonitoringHours=8:00-18:00` | | Don't record Friday and Saturday | `MonitorTimeFilterState=exclude`
`MonitoringDays=Fri,Sat`
`MonitoringHours=00:00-23:59` | ## Remote host IP filtering Applies to Windows Clients. Remote host IP filtering reduces the amount of information received from a Client by defining IP addresses for which remote sessions aren't monitored. Configure it on the **Editing Client** / **Editing Client Group** page, **Remote Host IP Filtering** tab. | Filter State | Effect | | ------------------------------------------------------------------- | ----------------------------------------------------------------- | | **Disabled** | Remote sessions from all IP addresses are monitored. | | **Monitor only activity from selected remote public IP addresses** | Only the specified public IP addresses are monitored. | | **Monitor activity from all remote public IP addresses except** | All public IP addresses are monitored except the specified ones. | | **Monitor only activity from selected remote private IP addresses** | Only the specified private IP addresses are monitored. | | **Monitor activity from all remote private IP addresses except** | All private IP addresses are monitored except the specified ones. | IP addresses accept IPv4 or IPv6 format, ranges, and an asterisk mask (for example `10.200.*.*`), separated by commas, semicolons, or new lines. The **Exclude local sessions** checkbox additionally excludes local (non-remote) sessions from monitoring. ## User filtering Applies to Windows and Linux Clients. User filtering reduces the amount of information received from a Client by defining which computer users are skipped during monitoring. It affects both primary and secondary users. Configure it on the **Editing Client** / **Editing Client Group** page, **User Filtering** tab. | Filter State | Effect | | ----------------------------------------------- | ---------------------------------------------------------------------------------------------------- | | **Disabled** | All users' activity is monitored. | | **Monitor only the activity of selected users** | Only the specified users are monitored. | | **Monitor the activity of all users except** | All users are monitored except the specified ones (for example, excluding an administrator account). | Enter user names manually as `\`, or click **Add Users** to select from users already seen by monitoring. Specify an entire domain group with `$\`. An asterisk works as a mask for any of these fields (for example `*\admin`). Values are separated by commas, semicolons, or new lines. When adding a user with secondary user authentication from the **Add Users** list (shown as, for example, `WORK\janet (jan)`), delete the parentheses in the resulting field and add a semicolon instead: `WORK\janet;jan`. | Intent | `.ini` parameters | | ------------------------------------------------------- | -------------------------------------------------------------------- | | Monitor everyone, no filter | `UserFilterState=disable` | | Monitor only "janet" and "joe" in the WORK domain | `UserFilterState=include`
`UserFilterNames=WORK\janet;WORK\joe` | | Monitor everyone except any "administrator" login | `UserFilterState=exclude`
`UserFilterNames=*\administrator` | | Monitor only "janet" with secondary user authentication | `UserFilterState=include`
`UserFilterNames=WORK\janet;janet` | | Monitor only the "work" group in the "company" domain | `UserFilterState=include`
`UserFilterNames=$company\work` | ## Related Configure whether and how keystrokes are logged. Windows Client installation and configuration. Linux Client installation and configuration. macOS Client installation and configuration.