Connection and session recording start after 5 minutes in CA PAM

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

In a system with several servers configured to have access recorded by means of an operationally safe session recording access policy, it takes more than 5 minutes for the connection to complete. Besides that session recording files are missing.

Cause

Session recording policy may be configured to be operationally safe (in case of session recording share unavailability or problems with the session recording process itself that prevent recording from taking place, the connection will take place anyway) or security safe (no session is allowed if session recording does not work)

This means that for a system which has been configured to run in an operationally safe way, session recording and therefore connection will not start until the timeout for starting the session recording process is reached.

There is a parameter in CA PAM which allows to specify the Initial Failure Timeout value: namely how long PAM will wait to initialize session recording before it calls it a failure or goes ahead in case it is in operationally safe mode

The default value is 300 seconds, so 5  minutes, so if anything has disabled session recording unbeknownst of the PAM administrator, any access with session recording will wait for the 5 minutes to elapse and then it will continue with the connection process, giving the symptom described 

 

Resolution

On general terms the Failure Timeout period may be decreased (to- say- 120 seconds), but if this problem is observed it is necessary to review the session recording configuration and take the necessary action