When you have configured keystroke logging on an Access Rule, and a user calls up previously entered commands in the shell using the “Up arrow” key, this is not logged if you have set keystroke logging to only capture input.
Resolution / Workaround
If you want to capture when a user presses the “Up arrow” key to call up previously entered commands, you should set the keystroke logging to log at least some output as well as input. In this case the keystroke log will show when a user presses Up or Down arrow, but since keystroke logging is done on the tty and not the shell, it does not capture the actual command that is called up.
If the user makes any changes to the command that is called up, however, this is captured.
Still have questions? We can help. Submit a case to Technical Support.