Monopam session management: protocols, recording and live monitoring
What changed
Every content update is versioned. Select a version to compare it with the one before.
Version 8 → 9
UpdateNew module on recording storage, the forced recording of external sessions, and clipboard and terminal behaviour that is decided on the client. The module now has diagrams and a closing list of what to check first.
1 lesson updatedduration
Content update. Enrolled learners were notified.
Duration changed from 16 to 17 minutes.
A recording is produced on the gateway that carries the session. Where it ends up afterwards is a planning decision you make once, and it is better made before the first audit than during it.
### Plan the recording store
| Tenant setup | Where recordings end up | What you must size |
| --- | --- | --- |
| CDN settings configured (S3-compatible object storage such as MinIO or Amazon S3) | Uploaded to the object store | The bucket, for the number of sessions times your retention period |
| No CDN settings | They stay on the gateway host | The gateway's disk, on every gateway |
::diagram pam-recording-path
Object storage is the target to plan for: it is sized for retention, it survives the replacement of a gateway, and recordings from all gateways end up in one place. The SQL database and Redis never hold recordings.
The second row is not an error state, which is exactly why it is easy to miss. Sessions run and are recorded. The gateway log only warns that the session "will be recorded localy but will not uploaded to the CDN" because no CDN settings exist. If you see that line, either configure the CDN or accept that this gateway's disk is now your archive and monitor it accordingly.
### External users are recorded regardless
Recording can be switched off by the tenant setting `Disable Recording`, by a policy or on a resource. Those opt-outs do not apply to **external users**. Sessions of contractors and vendors on recordable connection types are always recorded.
So a resource with recording disabled can show recordings for the contractor and none for your own engineers, and both are correct. The only way to make external sessions follow the normal recording policy is the environment setting `MONOPAM_EXTERNAL_FORCE_RECORDING=false`, which is a deliberate installation-wide decision and not something to change to silence a question.
### Two support cases that are decided on the client
**Paste does nothing in the browser terminal.** `Ctrl+V` (or `Cmd+V`) reads the clipboard through the browser. Browsers allow that only on a page served over HTTPS and only after the user grants clipboard permission. If permission was denied, the key press does nothing and no message appears on screen. The error is visible only in the browser's developer console. Check the address bar and the site's clipboard permission before you look at Monopam.
**Colours are wrong through the SSH bastion.** When a user connects with their own SSH client, the bastion creates the terminal on the target with the terminal type the client announces, and passes the bytes through unchanged. The gateway has no setting for it. A client that announces `xterm` gets 8 or 16 colours in tools that could show 256. The fix is in the client: in PuTTY, set the terminal-type string to `xterm-256color`. The same logic applies to language settings: environment variables sent by the client are not forwarded, so the locale comes from the user's profile on the target.
> Tip: on a new gateway, check three things before the first real session. Are CDN settings configured for the tenant? Does the gateway log carry the warning about recording locally? If recordings stay local, is that disk monitored? A container gateway that keeps recordings locally also needs a volume for them, or they are lost when the container is replaced.