Empty session recordings stuck in "Recording in Progress"

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

You find old entries on the Sessions > Session Recordings page that are stuck in status "Recording in Progress". The size of these recordings shows as 0kB. Clicking on the "Recording in Progress" link results in a "Error: Request Failed" error and the recording disappears. The main concern is that these may refer to valid access sessions which PAM failed to record correctly.

Environment

Affects any PAM release up to 4.1.6

Cause

Review of the session logs show that these entries are associated with launches of a PuTTY service that are terminated within seconds. The sessions never got established and there was no user activity to be recorded. The problem typically occurs when the PuTTY client pops up a security alert concerning the host key and the user decides to cancel the connection. This is expected when the user launches the PuTTY session for the first time ever, or for the first time from a new session after having launched the service while connected to a different PAM server in the past.

Resolution

Old stale entries can be removed manually by a PAM administrator by clicking on the "Recording in Progress" link and ignoring the error. The problem is expected to be fixed in future releases starting with 4.1.7 and 4.2.

The PuTTY security alerts are out of the control of PAM. They are expected to keep coming specifically in PAM cluster implementations where PAM users access a VIP and are connected to different PAM nodes at different times. Inform PAM users that this is normal and not a problem.