Snapshots

Spector Client (Client) is configured to record Snapshot events by selecting options within the Snapshots configuration tab. The Snapshots configuration tab can be found when:

Pre-configuring the Client installation file using the Spector CNE Deployment Utility

Figure 1: Snapshot Settings within Deployment Utility

Selecting a computer within the Configure Computers view of the Control Center

Figure 2: Settings within Configure Computers View

Selecting the Settings button within the Spector Viewer when viewing the recordings of a monitored computer from the Monitor Computers view of the Control Center

Figure 3: Snapshot Settings within Viewer

Selecting the Settings button within the Spector Viewer if the Viewer was installed as part of the Client installation (only recommended for troubleshooting)

Capture Screen Snapshots

The Client provides the ability to record a Snapshot of the monitored computer's screen on a periodic basis. A Snapshot is a graphic representation of exactly what the user is seeing on the computer display at a particular time. The Snapshots can then be individually reviewed or replayed like a VCR.

For each Snapshot event, the Client will record:

The date and time the Snapshot was taken
The name of the program that had Windows focus
The Windows user logged in when the Snapshot was taken

To record Snapshots on the computer, select Capture Screen Snapshots to put a checkmark in the option box. To disable Snapshot recording, clear the checkbox from the Capture Screen Snapshots box.

Note: Snapshot recording can be disabled, but Snapshots can still be taken in response to Keyword events. In addition, a Snapshot Hotkey can be configured which will force a Snapshot of the computer's display to be taken anytime the Hotkey sequence is typed. This Snapshot will be taken even if Capture Screen Snapshots is disabled.

Snapshot Capture Format

When a Snapshot is taken:

Only the parts of the display that have changed since the previous Snapshot are necessary to be stored
Compression is applied to the graphic representation in order to keep the size of the stored data as small as possible
Another option to reduce the amount of storage for Snapshots is to reduce the number of colors required to represent the Snapshot. Most screen configurations display graphics in 256 (8-bit) or 65536 (16-bit) colors. If a Snapshot is taken of an 8-bit or 16-bit display, the Snapshot can be stored in 50% or 25% less space if it is stored in 4-bit gray scale. It can even be stored in 2-bit monochrome, which is 25% and 12% of its original size, respectively

Note: SpectorSoft recommends Snapshot capture in 4-bit gray scale. This setting provides the best compromise between reduced storage space and quality of Snapshot representation. A 4-bit gray scale representation of a 16-bit display is as good as watching a color TV show in black and white. Do not capture in color format unless necessary.

Note: If the Snapshot capture format is changed to capture more bits, it may be necessary to increase the Maximum Data Size configuration to allow more Snapshots to be stored on the computer. This is not a concern if the Data Vault is configured to receive recorded events.

Take Snapshot Every … Seconds

Another method employed to reduce storage space required for Snapshot capture and playback, is to reduce the number of Snapshots taken. If Snapshots are taken less frequently, there is less storage space required to save them. However, fewer Snapshots also means you may not get an accurate playback of the activity on a computers because you cannot see what happened between recorded Snapshots. As a result, you must determine how much detail to record about the Snapshot activity, and weigh it against the required storage space required for same, as well as the potential for slowing down the computers.

The default frequency for taking a Snapshot is every 30 seconds. SpectorSoft has found this to be an adequate compromise between detail and storage requirements. If your implementation requires more detail, the Snapshot frequency can be modified to 15 seconds or even every 5 seconds. Remember, a setting of every 5 seconds may require as much as 6 times as much required for every 30 seconds, while a setting of 15 seconds only requires two times as much storage for every 30 seconds.

WARNING: The Snapshot frequency can be reduced to as low as each (one) second, but this is not recommended by SpectorSoft. Computers with slower CPUs and hard drives may not be able to handle Snapshot recording at a frequency of one every second (especially with a color capture format) and will cause an unacceptable slowing down (reduced performance) of the computers.

Note: If the Snapshot frequency is increased, you may need to increase the Maximum Data Size configuration as well. This allows more Snapshots to be stored on the computer. This is not a concern if the Data Vault is configured to receive recorded events.

Inactivity Timeout

Another method employed to reduce required storage space for Snapshot capture and playback, is to reduce the number of Snapshots taken when a user is not moving the mouse, clicking the mouse, or typing keystrokes. For this purpose, it is assumed that if the mouse is not being moved or clicked and keystrokes are not being typed, the user of the computer is inactive, and there is no reason to take a Snapshot of the display.

Though it might be assumed that there is no display activity to record, if the computer's user is inactive, there is often display activity in the form of clocks changing, or some other application running that changes the display. These are unnecessarily recorded if an Inactivity Timeout is not implemented.

When Inactivity Timeout is reached, recording of Snapshots will be suspended until mouse or keyboard activity is detected.

The default Inactivity Timeout is three minutes. Setting the Inactivity Timeout to zero would indicate that Snapshot recording should never stop in response to a computer user's inactivity. Setting the Inactivity Timeout to zero will require significantly more storage space for Snapshots, as the Client will record as long as the user is logged in, even if the computer is not in use.

Playback Delay Rate

The Playback Delay Rate is a setting that controls how fast the Viewer plays back the recorded Snapshots and is NOT a setting that needs to be established during configuration.

Snapshot Data Files

When Snapshots are recorded on the computer, the Client stores them in a data file that resides in the Data File Folder. If the Client is configured to upload recorded events to the Data Vault, this information will frequently move from the Snapshots data file to the Data Vault. If the Client is configured to keep the recorded events on the computer or the Data Vault is unavailable for uploading of events, then the size of the Snapshot data files is a consideration. The following settings control the amount of storage space needed on the computer's hard drive to record Snapshots.

Delete Data After … Days

Select the number of days the Client should keep recorded Snapshots on the computer. If Snapshots have been recorded before this number of days, then the Snapshots will be deleted. For example, if this setting is for ten days and today is August 11, the Client keeps all Snapshots recorded on August 1 and later. This setting is not a concern if the Client is configured to move recorded events to the Data Vault. They would be moved frequently and not reside for ten days on the computer.

The Default number of days is five. Set this option to zero if you do NOT want the Client to delete Snapshots after a certain number of days and should instead only delete older Snapshots if the Maximum Data Size configuration is exceeded.

Maximum Data Size … Megabytes

Select the maximum number of megabytes that the Snapshot data files should be allowed to grow. When the Snapshot data files have reached this size, the oldest recorded Snapshot data files will be deleted to allow newer Snapshots to be recorded and to keep the data files under the maximum size. This setting should not be a concern if the Client is configured to upload recorded events to the Data Vault.

The default Program Data File size is 50 megabytes.

Note: A rule of thumb for space required for Snapshot recording is that 10 to 20 megabytes per day (eight hours of recording) will be required for normal user activity, if configured to take a Snapshot every 30 seconds with a 4-bit gray scale capture format.