Search and replay

You can search for and replay an event using the Search and Replay page.

Review an event log

1. Click > Endpoint Privilege Management for Linux > Search and Replay.
   The Search and Replay page displays.
2. Optionally, set one or more filters.
   • Date Range: Select one of the pre-set date ranges, or set your own customized date range.
   • Run Command: Filter by command name(s).
   • Submit User: Filter by users who submitted the events by searching for their user name(s).
   • Run Host: Filter by specific hosts.
   • Submit Host: Filter by hosts that submitted commands.
   • Run User: Filter by specific users who ran commands.
     A list of event log records displays as you select the various filters.
3. Locate the event you want to replay.
4. Click the Play icon.
   The Sessions page displays.
5. Click the Playback icon to start the player.
6. On the Session Replay page, select Interactive Playback to replay the event log to watch as the events occurred. As an administrator, you can view what the user entered.

Download an event log

You can download the event log data as a JSON or CSV file.

To download an event log file:

1. Click > Endpoint Privilege Management for Linux > Search and Replay.
   The Search and Replay page displays.
2. Click the Download icon.
3. Select JSON File or CSV File.
   The file downloads to your Downloads folder.