ssh_sessions

{“what”:“Process ID of the sshd daemon handling this session; unique per session.”,“why”:“Without it, sessions cannot be uniquely identified or referenced by other tables.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:59:59.882038428+00:00”}

{“what”:“Process ID of the parent process that spawned this sshd.”,“why”:“Needed to trace session origin and group sessions by parent process.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:59:59.900058393+00:00”}

{“what”:“Login name of the authenticated user.”,“why”:“Without it, we cannot attribute sessions to users or enforce per-user policies.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:59:59.983693474+00:00”}

{“what”:“IPv4 or IPv6 address of the connecting client.”,“why”:“Needed for security audits, geolocation, and detecting multiple sessions from same source.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:00:00.007285495+00:00”}

{“what”:“TCP port number used by the client on its side.”,“why”:“Helps distinguish multiple connections from the same IP and aids in network troubleshooting.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:00:00.031295703+00:00”}

{“what”:“Pseudo-terminal device name (e.g., /dev/pts/3) allocated to the session.”,“why”:“Identifies the terminal device for the session, needed to associate with process I/O.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:00:00.051262629+00:00”}

{“what”:“Kind of SSH session such as interactive, sftp, or exec.”,“why”:“Without it, we cannot differentiate session behaviors or apply session-specific limits.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:00:00.084200262+00:00”}

{“what”:“Hostname or device identifier reported by the client.”,“why”:“Used to identify the client machine when IP is dynamic or shared.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:00:00.103010535+00:00”}

{“what”:“UTC timestamp when the session was established.”,“why”:“Needed to compute session duration and to order sessions chronologically.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:00:00.116504673+00:00”}

{“what”:“UTC timestamp of the most recent activity in the session.”,“why”:“Without it, we cannot determine if a session is stale or idle.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:00:00.214211897+00:00”}

{“what”:“Number of seconds since the last activity in the session.”,“why”:“Used to identify idle sessions for cleanup or monitoring.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:00:00.270304055+00:00”}

{“what”:“True if the session has spawned any child processes.”,“why”:“Indicates if the session is still actively running commands or just a shell.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:00:00.283637965+00:00”}

{“what”:“Count of child processes currently spawned by the session.”,“why”:“Provides a measure of session activity and helps detect resource usage.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:00:00.309792991+00:00”}