Session-Recording Setup

This section describes the procedures for setting up session recording.
​
When session recording is enabled, connection-specific audit events also provide:

• Video playback. With SSH sessions you can search for keyword occurences.

• Transferred files.

• Clipboard (RDP only).

• Channel logs (SSH only).

To enable session recording for connections to a host:

1. On the ​Administration→Hosts​ page, ​Edit​​ the host.

2. Under Options​​, enable the setting ​Session Recording*​​. Click ​Save**​​ to apply your changes.

   Subsequent sessions to the host are recorded. You can view the playback and transferred files from the connection-specific audit events, available from ​Monitor→Connections​​.

Session recordings should not be stored on PrivX servers as they may consume lots of disk space; you should configure PrivX to store session recordings on an external share instead (such as NFS or EFS). To set up external storage share for PrivX session recordings:

1. On your external storage server, create a share for storing PrivX session recordings. The share must be a directory that satisifies the following:

• The share must be mountable by all PrivX servers.

• The share must be readable and writable by the ​privx​​ system user of every PrivX server.

2. On each PrivX server, install any extensions required for mounting the external-storage share. For example, to mount NFS shares you will likely need to install ​nfs-utils​​; for SMB shares you will likely need ​cifs-utils​​. These extension packages are available from the RHEL/CentOS public repositories.

3. On each PrivX server, mount the external share to a local directory. To enable mounting the share on system startup, we recommend adding the mount directive to ​/etc/fstab​​.

   To allow the GUI to display other connection logs when the NFS server is unavailable, mount the share with options like the following:

   soft
   timeo=10
   retry=1

4. On each PrivX server, configure PrivX to store session recordings to the mounted share. To do this, edit the ​data_folder​ setting in ​/opt/privx/etc/shared-config.toml​ (replace ​/path/to/privx-trails​​ with the local directory to which the external share is mounted):

   data_folder="/path/to/privx-trails"
   

   Save your changes, then restart PrivX services to apply the changes:

   # systemctl restart privx
   

By default PrivX retains session recordings for 180 days. You can change this using the following settings:

• ​​trail_expiry* in ​/opt/privx/etc/shared-config.toml​ - Delete recordings older than the specified number of days. Set to ​-1​​ to disable automatic deletion.

• ​​housekeeping_interval_for_trails​ in ​/opt/privx/etc/connectionmanager.toml​​ - The interval at which PrivX checks for and deletes expired recordings. Specified in hours.

To apply new configurations, restart the PrivX services:

# systemctl restart privx

📘

Note

PrivX generates keyframe data when opening RDP session recordings for the first time. Note that this may take up to several minutes for large RDP and web-connection trails.

PrivX indexes session recordings when they are searched for the first time. Depending on the duration of the recording, the first search may take some time. SSH transcripts require roughly ten times the storage space compared to the original video recording.