topic Tracking application change in a session in General Topics

Tracking application change in a session

torm — Wed, 06 Mar 2013 22:44:45 GMT

Does anyone know if it's somehow possible to track application changes in a session?

Let's say an application in a session first is identified as web-browsing, then facebook, and finally facebook-chat. Maybe not a realistic example, but you get the point

Is there any way I can see that in the traffic logs, or through any other cli commands?

Re: Tracking application change in a session

rmonvon — Thu, 07 Mar 2013 00:24:05 GMT

Hi...The app change occurs during an active session so you cannot view it in the traffic log. Traffic log is for session start and/or session end only. You can use the session browser in the web GUI or via the CLI using command 'show session id <value>' to view the active session of interest. You simply refresh the command to get update to see if the application changes. Thanks.

Re: Tracking application change in a session

torm — Thu, 07 Mar 2013 07:16:08 GMT

Thanks for your answer!

So there is no way to get historical data on this? To somehow view which application changes a closed session has gone through?

Re: Tracking application change in a session

rmonvon — Thu, 07 Mar 2013 14:56:17 GMT

To watch how an app can change, you can initiate the app and view its session(s) info while it is active. Once the session ends, we will create only 1 log entry & log the app for the session.

You could turn on logging at start and end of session. Then the traffic log will create 1 log at the start with the start app, and 1 log at the end with the ending app. Thanks.