> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Keystroke Logging Parameter

> Enable keystroke logging on Windows and macOS Clients, including keyword-triggered recording and searchable keystroke metadata.

<Note>
  Applies to Windows and macOS Clients. The Linux equivalent is a separate parameter.
</Note>

Keystroke logging lets Syteca monitor the keystrokes users enter on Client computers. Configure it on the **Editing Client** / **Editing Client Group** page, **Keystroke Monitoring** tab, **Monitoring Parameters** section, by selecting **Enable keystroke logging**.

<Tip>
  Use [Keystroke filtering](/docs/session-monitoring/recording/filtering#keystroke-filtering) alongside this parameter to limit logging to specific applications instead of all of them.
</Tip>

## Windows Clients

With **Enable keystroke logging** selected, two additional options are available:

* **Enable keystroke logging if the Korean keyboard language is used** — extends logging to the Korean input language, in addition to other supported languages.
* **Start monitoring after detecting one of the following keywords** — delays recording until the user types one of the specified keywords or phrases, then continues recording for the rest of the session. Enter multiple words or phrases separated by commas, semicolons, or new lines; words within a phrase are separated by spaces.

Windows Clients log these keystroke categories:

| Category                        | Keys                                                                                                                            |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| **Character keys**              | Alphabetic (upper/lower case), numeric (0–9), all special characters, and Space.                                                |
| **Modifiers**                   | Control, Shift, Alt, and the Windows key.                                                                                       |
| **Navigation and typing modes** | Arrow keys, Home/End, Page Up/Page Down, Insert, Delete/Backspace, Enter, and the Lock keys (Num Lock, Scroll Lock, Caps Lock). |
| **System commands**             | Print Screen, Menu/Application (context menu), and Pause/Break.                                                                 |
| **Function keys**               | F1–F12.                                                                                                                         |

<Note>
  Keystrokes aren't displayed directly in the Session Viewer, but they're searchable — both in the **Metadata** grid in the Session Viewer, and on the **Client Sessions** tab of the Activity Monitoring page. Displaying keystrokes directly in the Session Viewer and in reports requires contacting your Syteca vendor or the Syteca Support team.
</Note>

Keystroke [alert rules](/docs/session-monitoring/alerts) can be defined to trigger an alert whenever a user enters a specified keyword.

<Frame caption="The Keystroke Monitoring tab with keystroke logging and keyword-triggered monitoring options.">
  <img src="https://mintcdn.com/syteca/FKrkO8bEqEQ6WSgs/images/session-monitoring/recording/keystroke-logging-windows.png?fit=max&auto=format&n=FKrkO8bEqEQ6WSgs&q=85&s=bf498a0f5e74626414f5d2ee330240bc" alt="Keystroke Monitoring tab showing Enable keystroke logging and related options" width="1913" height="1065" data-path="images/session-monitoring/recording/keystroke-logging-windows.png" />
</Frame>

## macOS Clients

macOS Clients support the same **Enable keystroke logging** parameter on the equivalent **Keystroke Monitoring** tab.

## Linux Clients

<Note>
  On Linux, this is called **user input monitoring** rather than keystroke logging, but it's the same underlying capability: it captures the keystrokes a user enters in remote SSH sessions and local terminal sessions on a Linux Client.
</Note>

Keystroke input is detected as discrete user actions, separated by the user pressing **Enter** after any number of keystrokes.

### Enable it

<Steps>
  <Step title="Add the key to the Application Server settings">
    On the Application Server computer, open `EkranServer.Settings.config` (by default in `C:\Program Files\Ekran System\Ekran System\Server`) and add:

    ```xml theme={"system"}
    <add key="EnableUserInputMonitoring" value="1" />
    ```
  </Step>

  <Step title="Restart the Application Server">
    Restart the **EkranServer** service.
  </Step>

  <Step title="Enable it on the Client or Client Group">
    On the **Editing Client** (or **Editing Client Group**) page, select the **Monitoring \[Linux]** tab, and under **User input monitoring** at the bottom, select **Enable user input monitoring**.
  </Step>
</Steps>

<Frame caption="The User input monitoring section on a Linux Client's Monitoring tab.">
  <img src="https://mintcdn.com/syteca/0FlD-vkHsBA1azVX/images/administration/clients/parameters/user-input-monitoring-linux.png?fit=max&auto=format&n=0FlD-vkHsBA1azVX&q=85&s=f6413ae681060dfc03577cb6931a5681" alt="Monitoring Linux tab with Enable user input monitoring selected" width="1900" height="1070" data-path="images/administration/clients/parameters/user-input-monitoring-linux.png" />
</Frame>

### View captured keystrokes

Keystrokes aren't shown directly in the Session Player, but they're searchable in the **Metadata** grid while [playing remote SSH and local terminal sessions](/docs/session-monitoring/player/per-os-playback#linux-ssh-and-local-terminal-sessions).

Linux Clients log these keystroke categories:

| Category                        | Keys                                                                                              |
| ------------------------------- | ------------------------------------------------------------------------------------------------- |
| **Character keys**              | Alphabetic (upper/lower case), numeric (0–9), all special characters, and Space.                  |
| **Navigation and typing modes** | Arrow keys, Home/End, Page Up/Page Down, Tab, Insert, Delete/Backspace, Enter, and the Lock keys. |
| **Non-printing characters**     | Control key combinations (`Ctrl+@`, `Ctrl+A`, `Ctrl+C`).                                          |
| **Cursor controls**             | ESC code sequences (`ESC[#A`, `ESC[#B`).                                                          |
| **Function keys**               | F1–F12.                                                                                           |

## Related

<CardGroup cols={2}>
  <Card title="Filtering parameters" icon="sliders-horizontal" href="/docs/session-monitoring/recording/filtering">
    Limit which applications keystrokes are monitored in.
  </Card>

  <Card title="Sensitive data masking" icon="eye-off" href="/docs/session-monitoring/masking/sensitive-data">
    Mask specific sensitive values within recorded keystrokes.
  </Card>

  <Card title="Windows Clients" icon="windows" href="/docs/administration/clients/windows">
    Windows Client installation and configuration.
  </Card>

  <Card title="macOS Clients" icon="apple" href="/docs/administration/clients/macos">
    macOS Client installation and configuration.
  </Card>
</CardGroup>