For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt, and this page is available as Markdown at https://www.jumpserver.com/docs/features/audits/sessions/session-commands.md.
🎉 JumpServer v5.1.1 is available. See what's new →
  • v5

    • Session Commands

    Session Commands shows the commands that were captured while users worked in asset sessions. Use it to reconstruct what happened during a session, check whether a command matched a risky command rule, and jump back to the full session record.

    Open the page from Audits > Sessions > Session Commands.

    Overview

    The left panel is the Command storage tree. Each storage represents a command storage backend configured for the platform, such as the default server storage. Selecting a storage filters the list on the right. The list includes the command text, risk level, user, asset, account, session, and timestamp.

    Rows are expandable: open a row to read the stored command output without leaving the list.

    Prerequisites

    • Sign in with an account that has the terminal.view_command permission, such as a system administrator or auditor.
    • Command recording and command storage must be configured in Storage. Without a command storage, the page has nothing to list.
    • Asset sessions must have produced command records.

    Review commands

    1

    Select a command storage in the left tree.

    2

    Set the date range or enter a search term.

    3

    Expand a row to read the command output.

    4

    Click the value in the Session column to open the related session record.

    Figure 1: Session Commands with the command storage tree and command list.

    Risk level

    The Risk level column shows how command filter rules classified or handled the command, for example Accept, Warning, or Reject. Commands with a non-zero risk level, including warnings and rejected commands, are highlighted in red so they stand out in the list.

    Customize columns and export

    Open List preferences from the column settings icon, select the columns to display, and click Confirm. Available columns include ID, command, risk level, user, asset, account, session, and datetime. Restore defaults returns to the standard set.

    Figure 2: List preferences for session commands.

    Click Export, choose CSV or Excel, select Export all, Export selected, or Export search results, and click Confirm.

    Field reference

    FieldDescription
    CommandCommand text captured during the session.
    OutputStored command output. Expand the row to view it.
    Risk levelHow the command was classified or handled by command filter rules.
    UserUser who ran the command.
    AssetAsset on which the command ran.
    AccountAccount used for the connection.
    SessionRelated session record. Select it to open the session.
    DatetimeWhen the command was recorded.

    Notes

    Note

    Command records are read-only. If command storage is backed by Elasticsearch, search and retention follow that storage configuration, and older records may no longer be available.