Tracking application change in a session

[torm]

Does anyone know if it's somehow possible to track application changes in a session?

Let's say an application in a session first is identified as web-browsing, then facebook, and finally facebook-chat. Maybe not a realistic example, but you get the point

Is there any way I can see that in the traffic logs, or through any other cli commands?

[rmonvon]

Hi...The app change occurs during an active session so you cannot view it in the traffic log.  Traffic log is for session start and/or session end only.  You can use the session browser in the web GUI or via the CLI using command 'show session id <value>' to view the active session of interest.  You simply refresh the command to get update to see if the application changes.  Thanks.

[torm]

Thanks for your answer!

So there is no way to get historical data on this? To somehow view which application changes a closed session has gone through?

[rmonvon · Accepted solution]

To watch how an app can change, you can initiate the app and view its session(s) info while it is active.  Once the session ends, we will create only 1 log entry & log the app for the session.

You could turn on logging at start and end of session.  Then the traffic log will create 1 log at the start with the start app, and 1 log at the end with the ending app.  Thanks.