Session recording file RDP_CS

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

We see a few files on the session recording share ending in _RDP or _RDP_CS. These seem to be associated with a few active RDP sessions.

Environment

Release : 4.0

Component : PRIVILEGED ACCESS MANAGEMENT

Cause

PAM uses temporary files while writing RDP session recordings. Once the recording is finished, finalized and encrypted, those files should disappear.

Resolution

These files are expected to exist while an RDP session recording is in progress. They should go away eventually and only a .gsr (graphical session recording) file should remain. If you find that you have many old files on your session recording share ending with _RDP or _RDP_CS, please check on the status of these recordings on the Sessions > Session Recordings page. Part of the file name is a UNIX time stamp that you can convert into a readable date using tools like the Epoch Converter. This should allow you to find the corresponding session recording entries in the PAM UI. Check on the status column. Likely these recordings are not viewable. If you are not aware of an issue, such as a network problem, that could explain the unfinished recordings, open a case with PAM Support and provide information on the files, the session recording entries, and the PAM session and system logs (if they go back far enough, and from each node for cluster members writing to the same share).