Viewing Recorded Sessions
ObserveIT capturing and recording any human interaction with any server that the agent is installed on. To view recorded sessions, first log-on to the Web Management Console. Then, click either on the Server Diary, User Diary, or Search tabs. Type in the name of the required server or user, or type a textual string in the search box.
The Server Diary
The default view in the Web Management Console is the Server Diary tab. The primary use of the Server Diary is to answer the “who did what” question for any monitored server or computer. The Server Diary will automatically display the last server accessed with the default date filter, listing all user sessions in reverse chronological order. This means that new sessions are placed on top of the session lists, making it easy to identify the latest sessions.
Each line represents a user session. A user session begins at the time the user logs on, and ends when the user logs out or after 15 minutes of inactivity (which can be changed in the Configuration Policy). The last activity performed by the user in that session is reflected in the Session Duration. Each line has information about the date, time, the login name (which is the user account used in the Windows logon process), the actual user name (which is provided through ObserveIT's Identification Services) and name of the computer that the connection has been made from.
Clicking on the 
icon next to the user session will launch the ObserveIT Slide Viewer, and begin replaying the entire recorded session from beginning to end. The replay can be paused, resumed, fast forwarded or rewinded, and zoomed in or out. From the Slide Viewer you can also save sessions for offline viewing or for training purposes.
When a 
icon appears in the sessions list, that means that a user session is still live of that server, and that a user is still logged on to the server. Clicking on that icon will launch the Slide Viewer in real-time replay mode.
However, replaying entire sessions is a time consuming process and might prove to be irrelevant to the problem you’re trying to troubleshoot. To make this task easier, ObserveIT comes to the rescue and lets you expand sessions by clicking on the [+] sign and view a textual breakdown or transcript (similar to DVD chapters) of all applications, files and window titles that user accessed during the session. Each session can be replayed from any point in time (or from any "chapter"). In this manner, within seconds it's possible to determine what where the applications and actions that were performed by the user, and to determine the relevancy of that session to your troubleshooting process. Needless to say, this will save you a considerable amount of time.
If you need to begin replying it from a specific point in time click the 
icon on the right of the corresponding line.
The User Diary
The second tab view in the Web Management Console is the User Diary tab. The primary use of the User Diary is to answer the “what did the user do” question for any monitored server or computer. Each time a user logs into a monitored server, all actions performed by that user are captured as screenshots and Metadata about the applications, registry settings and files the user accessed. The User Diary is used to see all of this activity by a particular user across all servers. The User Diary will automatically display the last server accessed with the default date filter, listing all user sessions in reverse chronological order. This means that new sessions are placed on top of the session lists, making it easy to identify the latest sessions.
The user sessions are displayed in separate lines, and by clicking on the [+] sign you can expand the session and gain valuable information about the applications or actions performed by that user during that session.
Free-Text Search
The Free Text Search view further expands the searching capabilities, allowing you to perform “Google-like” searches based upon words that are important, such as "registry", "notepad", "delete" and so on. Results are displayed in a way that lets us see the context of the action and why they are returned as a result. For example, you can type an IP address of a server, and find all the instances where a Remote Desktop session has been opened to that server. Enter the string you are looking for and click the Search button to run the search.
The results will be displayed along with information regarding the user’s Login, the server and the date.
You can expand the session you're interested in by clicking the [+] sign on the left of the user session. Read through the textual transcript and find the corresponding line that has particular interest. In this example, editing the DWORD value looks like an interesting action we should watch, therefore we will investigate it further.
Clicking the button will launch the ObserveIT Slide Viewer and allow you to view the recorded session.
The Slide Viewer
ObserveIT allows you to reply recorded sessions by using a VCR-like Slide Viewer or player. The Slide-Viewer opens in a separate browser window.
ObserveIT's Slide Viewer can be used to play the recorded session starting from the first slide, and through the entire recording till it reaches the last slide. You can use the VCR-like buttons to quickly stop, resume, rewind or fast forward the playing of the slides.
Another major advantage of ObserveIT is that the Slide Viewer can also be used to begin playing the recorded session starting from a specific point in time. This feature saves time and allows the auditor or administrator to move to the exact point in time when the specific action that was performed by the user is of particular interest.
You can use the VCR-like buttons to quickly stop, resume, rewind or fast forward the playing of the slides.
