Overview - Recording Events
Spector Client (Client) events are constantly being recorded whenever a user logs on to a computer that is being monitored by the Client. Each Snapshot, Instant Message, Chat, Email, Program, Web Site, P2P, and Keystroke event records:
The Windows user logged in
The Windows program that is running
The date/time the event occurred
Information specific to the event being recorded
Events are stored as individual records that can later be searched, sorted, summarized, reported, or individually viewed.
Client recording is designed so that all activity on a specific computer can be monitored. It starts with Snapshot recording, which takes a brute force method of monitoring: by periodically storing an image of what the computer's user was seeing. Though it is possible to take Snapshots as fast as each second, there are limitations on computer storage and the time required to review the Snapshots. Because Snapshots are simply a graphic representation of what the computer's user was seeing, there is no ability to search all Snapshots recorded for specific information, whereas all other events can be searched by keywords to find particular events. Snapshots are the most useful for reviewing what a computer's user was seeing in a specific time frame and to provide additional details in relation to other recorded events.
Other recorded events can provide much more detail in a summarized manner. For example, the IM recording can record both sides of an AOL Instant Message conversation as a single event. It can be viewed in its entirety, instead of having to piece together the conversation using Snapshots. Web site events can be tabulated for a day or for multiple days to show the Web sites visited most frequently and on which the user spent the most time on. This type of reporting can be more detailed and informative than Snapshot recording, though you could use the time frame of the Web site visit to see exactly what the user was seeing in the form of a Snapshot.
When configuring the Client, the events to be recorded must be chosen. By default, recording of all event types is enabled, though certain considerations should be made when deciding what events to record.
Recording of Snapshot events will provide a graphic detail of what the computer's user was seeing.
If you are only interested in obtaining an overview of how the computer is used by receiving an activity report on the time spent with the Programs run on the computer, you may not want to see a graphic representation
If you are only interested in obtaining overviews of how many Web sites are visited in a day and how much time is spent on those sites, then you may not be interested in the specific keystrokes typed by the user or a snapshot of each Web site
If you are only interested in how many keystrokes a user was typing in a specific program, you may not need to record email or instant message conversations
The Client provides the ability to monitor all details of the computer's activity, so you may need to reconcile the events recorded with your company's policy on employee computer usage, privacy, and Internet access.
Other recording issues for consideration are:
the storage space required for records
the number of events recorded
In general, this is only an issue with Snapshot recording, as a typical day of recording could involve 500 snapshots and storage space of 10Mb. However, the recording of email could require a substantial amount of storage if a large amount of email is received as spam or with accompanying file attachments.
If you were to monitor 100 computers with Snapshot recording set at every 30 seconds, you would need over a gigabyte per day (black and white storage format). Archiving all activity for one year would require a considerable amount of storage to record Snapshots.