# Sessions and recordings > See who is connected to your machines right now, watch a session live, end it instantly and play back the recordings with their timeline. URL: https://docs.ironchip.com/en/pam/administracion/sesiones/ This page explains how to supervise privileged sessions: see who is connected, watch a session live, end it and play back what has already finished. It is for whoever administers or audits privileged access. ## Permissions | To | Permission | | ----------------------------------- | ----------------------------------------------------------------------------------- | | View **PAM > Sessions** | **PAM approvals and sessions** with Read | | End a session | **PAM approvals and sessions** with Delete | | Watch a session live or a recording | **PAM recordings and live view** with Read | | View **PAM > Recordings** | **PAM recordings and live view** and **PAM approvals and sessions**, both with Read | ## Active sessions Go to **PAM > Sessions**. It shows who is connected through the broker right now; what has already finished is in **Recordings**. The list updates on its own. [Image: Sessions page with a person connected over SSH and the Options menu open with Watch and Terminate] | Column | What it shows | | ------------ | ------------------------------------------------------------------------------------ | | **Who** | The person and when they started. | | **Where** | The resource and its protocol. | | **From** | The address they connect from, the one Ironchip checked before letting them through. | | **Duration** | How long they have been connected. | | **State** | **Connected**. | | **Manage** | **Options**, with **Watch** and **Terminate**. | ### Watch a session live 1. In the session's row, open **Options > Watch**. 2. The player opens live (**LIVE**). You can drag the bar back to what already happened; when you let go, it returns to live on its own. From the player you can also end the session with **Terminate**. ### End a session 1. In the session's row, open **Options > Terminate**. 2. The **Terminate session** window reminds you who is connected and to what. Click **Terminate**. [Image: Terminate session window with the person, the resource and the Terminate button] The person is disconnected at that moment and the recording of what they did is kept. If they were connected from the console, they see the **The session ended** notice; with their own client, the connection drops. :::caution[Ending a session does not close the access window] The person can connect again while their window is still open. Terminating ends the session, not the access. ::: ## Recordings Go to **PAM > Recordings** to see what was recorded from the company's sessions. [Image: Recordings page with each recording, the person, the resource, its length and its kind] | Column | What it shows | | ---------- | -------------------------------------------------------------------------------------------------- | | **Who** | The person and when they started. | | **Where** | The resource and its protocol. | | **State** | **LIVE** if the session is still open, **Ended** if it has finished. | | **Length** | How long it lasted. | | **Kind** | **Terminal** (SSH and `kubectl exec`), **Desktop** (RDP and VNC) or **Kubernetes** (API requests). | | **Watch** | Opens the player. | Search by person, resource or kind in the search box at the top. ### The player [Image: Player for an SSH session with the terminal on the left and the timeline on the right] - The **Recording**, **Recording + log** and **Log** tabs show the recording, the recording with its timeline, or only the timeline. - The terminal plays back exactly as the person saw it; the desktop, as screen images. Both play at real speed. - Use the play button, the bar to jump to any point, and **LIVE** to return to live. - Click a timeline entry to go to that moment in the recording. ### The timeline The timeline brings together in one place: - **What the broker records:** the connection, whether it was held waiting for an approval or a confirmation, and how and why it ended. - **The processes** the session's account started, if the machine has the [agent](https://docs.ironchip.com/en/pam/administracion/agente/) (osquery). - **The `sudo` commands**, if the machine has the enforcer: **Allowed** or **Refused**, with the reason (the rule that decided, who approved it or that nobody approved it in time). If the machine's agent is missing, disconnected or cannot see the processes, the player warns about it above the timeline: what was run may be missing. ## What is recorded | Resource | What is kept | | -------------------------- | ---------------------------------------------------------------------------- | | SSH | The full terminal, the timeline and, with the agent, processes and `sudo` | | RDP and VNC | The full screen, the timeline and, with the agent, processes | | Kubernetes | Each `kubectl exec` as a terminal, and each API request | | PostgreSQL, MySQL and HTTP | The session in **Sessions** and what the broker records about the connection | ## More information - [Recording and auditing](https://docs.ironchip.com/en/pam/conceptos/grabacion/): what evidence each access leaves. - [Approvals](https://docs.ironchip.com/en/pam/administracion/aprobadores/): the commands that wait for approval during the session.