Server Settings

Server settings are global settings, as opposed to settings applied per user group. Administrators manage them in the Settings tab of the Administrative Web App.

Most global settings require a restart of some or all components before the change takes effect. The Services Need Restarted column in each table below names the components affected by a given setting. For the restart commands and script options, see the Administration how-to guides.

Authentication

Authentication settings govern session tokens, Single Sign-On (SSO), and local account lockout behavior.

Name	Description	Services Need Restarted
Anonymous User Expiration	Anonymous user accounts are deleted from the system after the defined number of hours. Set this value to 0 to disable automatic deletion.	None
Enable Kasm Authorization	Requires client requests to Kasm Workspaces for content such as downloads and uploads to be authenticated with the user's current session token.	None
Enable SAML	Enables Single Sign-On with Security Assertion Markup Language (SAML) 2.0 for users.	None
Kasm Authorization Domain	Overrides the domain used in the Kasm session cookie. The default value uses the domain name the user request came in on, which fits most use cases. Statically setting the domain name ensures the deployment cannot be proxied under different domain names.	None
Login Assistance	An optional link to display on the login page that directs users to another site for login assistance.	None
Max Login Attempts	The number of invalid login attempts before an account is locked out. The setting applies only to local accounts.	None
Notice Message	A login banner message to show to users at the login page.	None
Notice Title	The title of the login banner to show to users at the login page.	None
Component Registration Token	Used for multi-server deployments to register new components to the deployment.	None
Same Site Cookie Policy	Configures the SameSite attribute for the Set-Cookie HTTP response headers. Valid options are Lax, Strict, and None.	API
Session Lifetime	The number of seconds a session token is valid for.	API
Token Drift	How many minutes plus and minus to allow TOTP tokens to drift from the server's UTC time.	API
WebAuthn Request Lifetime	The number of seconds a WebAuthn Authenticator or Registration session is valid for.	API
API Token Lifespan (seconds)	Lifespan of the component authentication tokens used for back-end requests, in seconds.	None
API Token Refresh Leeway (seconds)	Additional refresh window for API tokens, in seconds.	None

CAPTCHA Settings

CAPTCHA settings select which type of CAPTCHA the deployment uses during session casting.

Name	Description	Services Need Restarted
CAPTCHA Selection	Choose which type of CAPTCHA to use. Selecting one automatically attempts to set the API URL.	None
CAPTCHA API URL	The API URL to use for verifying results. The correct URL is set automatically when a CAPTCHA type is selected.	None
CAPTCHA Private Key	The CAPTCHA private key used to verify results with the CAPTCHA provider.	None
CAPTCHA Site Key	The CAPTCHA site key.	None

Password Requirements

Password requirements control password complexity for local accounts.

Name	Description	Default
Minimum Password Length	Minimum number of characters required.	8
Require Lowercase Letter	Password must contain at least one lowercase letter (a–z).	Enabled
Require Numbers	Password must contain at least one digit (0–9).	Enabled
Require Special Characters	Password must contain at least one special character (! # $ % ^ & * @).	Enabled
Require Uppercase Letter	Password must contain at least one uppercase letter (A–Z).	Enabled

The Force Password Reset toggle appears at the bottom of this group. When saved, all local users must set a new password on next login.

Force Password Reset

The action affects only local accounts. Enable it after tightening policy to ensure existing passwords comply with the new rules. Changes may take up to 30 seconds to be reflected.

Connections

Connection settings define the default parameters and signing keys for RDP, SSH, and VNC sessions delivered through the Kasm Connection Proxy.

Name	Description	Services Need Restarted
Default VM RDP Connection Settings	See the detailed description below.	API
Default VM SSH Connection Settings	See the detailed description below.	API
Default VM VNC Connection Settings	See the detailed description below.	API
RDP config file expiration	How long the authentication token in the generated RDP file is valid.	API
RDP Private Key	The key generates the JWT tokens used for authenticating the RDP file by the RDP Gateway.	API
RDP Public Cert	The certificate validates the JWT tokens used for authenticating the RDP file by the RDP Gateway.	API
RDP File Signing Private Key	The private key that signs the RDP file.	API
RDP File Signing Cert	The certificate that verifies the signed RDP file has not been modified. The certificate also sets the trusted publishers setting in Microsoft group policy.	API

Default VM RDP Connection Settings

The Default VM RDP Connection Settings define a series of connection parameters for connecting to external RDP and KasmVNC endpoints. The value is a single JSON string. A default example follows:

{
  "guac": {
    "type": "rdp",
    "settings": {
      "security": "any",
      "ignore-cert": true,
      "enable-font-smoothing": true,
      "enable-wallpaper": true,
      "enable-theming": true,
      "enable-full-window-drag": false,
      "enable-menu-animations": false,
      "resize-method": "display-update",
      "server-layout": "en-us-qwerty",
      "printer-name": "Kasm"
    }
  },
  "kasm_svc": {
    "port": 4902
  }
}

The following table describes the Guacamole (guac/rdp) settings:

Name	Description
security	The security mode to use for the RDP connection. The mode dictates how data is encrypted and what type of authentication is performed, if any. Options: any, nla, nla-ext, tls, vmconnect, rdp.
ignore-cert	If set to "true", the certificate returned by the server is ignored, even if that certificate cannot be validated.
enable-font-smoothing	If set to "true", text is rendered with smooth edges. Text over RDP is rendered with rough edges by default.
enable-wallpaper	If set to "true", enables rendering of the desktop wallpaper. By default, wallpaper is disabled so unnecessary bandwidth is not spent redrawing the desktop.
enable-theming	If set to "true", enables theming of windows and controls. Theming within RDP sessions is disabled by default.
enable-full-window-drag	If set to "true", the contents of windows are displayed as windows are moved. By default, the RDP server draws only the window border while windows are being dragged.
enable-menu-animations	If set to "true", menu open and close animations are allowed. Menu animations are disabled by default.
resize-method	The method to update the RDP server when the width or height of the client display changes. Options: display-update, reconnect.
fixed-display-size	If set to "true", the resolution of the RDP session is fixed to the resolution specified by the provided width and height settings.
server-layout	The server-side keyboard layout. Options: da-dk-qwerty, de-ch-qwertz, de-de-qwertz, en-gb-qwerty, en-us-qwerty, es-es-qwerty, fr-ch-qwertz, fr-fr-azerty, it-it-qwerty, ja-jp-qwerty, pt-br-qwerty, sv-se-qwerty, tr-tr-qwerty. For an RDP session, set server-layout to the layout expected by the remote server. For example, a Windows VM with a German layout uses de-de-qwertz regardless of the client keyboard.
keyboard-layout	The client-side keyboard layout that Guacamole uses to interpret key presses for a VNC connection. Set this when the remote environment does not dictate the mapping. For example, sv-se-qwerty interprets input as a Swedish keyboard.
timezone	The parameter controls the timezone sent to the server over the RDP connection, which changes the way local time is displayed on the server when that server is part of a RDS cluster. Kasm Workspaces auto-fills this parameter based on the Kasm Session Timezone user profile setting when not overridden in the server configuration or this global setting.
printer-name	The name of the redirected printer device passed through to the RDP session. The final name displayed in printing settings is in the format printer_name (redirected session_id). The naming convention is imposed by Windows to indicate a redirected printer, with session_id denoting the specific session the printer is associated with.

For additional connection parameters, see the Guacamole RDP configuration reference.

note

Administrators can explicitly define display-related settings such as dpi, width, and height in the rdp_thick_client_properties. When these values are not provided, the system populates them based on the user's display scaling preferences in the browser at session launch time. Many RDP client applications ignore the specific scaling in favor of dynamic DPI and resolution sync.

RDP Session Watermarking

Kasm Workspaces watermarks RDP sessions with customizable text overlays and images. Watermark settings are configured within the kasm_svc section of the VM RDP connection settings JSON. The connection settings can be overridden at the Server level or in AutoScale Configs for AutoScaled servers.

note

The watermark feature is limited to configurations where the username is known at session creation time. Supported modes include Static Credentials, Single Sign-On with Static Local Accounts, Single Sign-On with Dynamic Local Accounts, and Single Sign-On with Active Directory.

warning

A limited set of UI elements may appear over the watermark. At this time, the only known UI elements that appear over the watermark are the start menu and the Task Manager.

The following example shows a valid watermark configuration:

{
  "guac": {
    "type": "rdp",
    "settings": {
      "security": "any",
      "ignore-cert": true,
      "enable-font-smoothing": true,
      "enable-wallpaper": true,
      "enable-theming": true,
      "enable-full-window-drag": false,
      "enable-menu-animations": false,
      "resize-method": "display-update",
      "server-layout": "en-us-qwerty",
      "printer-name": "Kasm"
    }
  },
  "kasm_svc": {
    "port": 4902,
    "watermark": {
      "text": "${KASM_USER} at %H:%M on %d/%m/%Y",
      "tint": "255,0,255,255",
      "repeat-spacing": 100
    }
  }
}

The following table describes the allowed watermark settings:

Setting	Default	Description
text		The text content of the watermark. The text can include the following session variables: ${KASM_USER}, ${KASM_USER_ID}, ${KASM_ID}, ${WINDOWS_USER}, as well as time formatting using the format %H:%M:%S.
timezone		The timezone used for time formatting, for example "America/New_York".
font	Arial	The font family to use for the watermark text.
font-size	20	The font size in points for the watermark text.
tint	"255,255,255,255"	The color value for the watermark in "r,g,b,a" format, where each value is between 0 and 255.
opacity	1.0	The opacity of the watermark image in range 0.0 to 1.0.
location	center	The x,y coordinate location for the watermark in "x,y" format. The default value is "center". Defining repeat-spacing overwrites this default and changes the placement of the watermark accordingly.
rotation		The rotation in degrees for the watermark text in range -180 to 180.
repeat-spacing		The spacing in pixels to repeat the watermark text across the session both horizontally and vertically.
image		The absolute path to the image file displayed as the watermark.

Setting RDP Thick Client Properties

All supported RDP file parameters are documented in Microsoft's RDP file reference. The following example shows a valid connection_info JSON object that sets RDP client fields:

{
  "guac": {
    "type": "rdp",
    "settings": {
      "security": "any",
      "ignore-cert": true,
      "enable-font-smoothing": true,
      "enable-wallpaper": true,
      "enable-theming": true,
      "enable-full-window-drag": false,
      "enable-menu-animations": false,
      "resize-method": "display-update",
      "server-layout": "en-us-qwerty",
      "printer-name": "Kasm",
      "remote-app": "||KasmLauncher",
      "remote-app-args": "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE\" C:\\Users\\Public\\Documents\\example.xlsx"
    }
  },
  "rdp_thick_client_properties": {
    "connection type": 6,
    "networkautodetect": 1,
    "bandwidthautodetect": 1,
    "screen mode id": 2,
    "singlemoninwindowedmode": 1,
    "keyboardhook": 2,
    "disable full window drag": 1,
    "disable menu anims": 1,
    "bitmapcachepersistenable": 1,
    "session bpp": 32,
    "dynamic resolution": 1,
    "autoreconnection enabled": 1,
    "videoplaybackmode": 1,
    "allow desktop composition": 1,
    "disable themes": 0,
    "allow font smoothing": 1,
    "smart sizing": 1,
    "desktopscalefactor": 100
  },
  "kasm_svc": {
    "port": 4902
  }
}

The rdp_thick_client_properties section within connection_info customizes low-level RDP client parameters to fine-tune performance, display, and user experience.

Field Name	Default	Description
connection type	6	The type of connection (for example, 6 for RDP).
networkautodetect	1	Enables automatic network detection.
bandwidthautodetect	1	Enables automatic bandwidth detection.
screen mode id	2	Screen mode setting (1 = windowed, 2 = full screen).
singlemoninwindowedmode	1	Enables single monitor when in windowed mode.
keyboardhook	2	Controls keyboard shortcut handling behavior.
disable full window drag	1	Disables full window drag visuals to improve performance.
disable menu anims	1	Disables menu animations to reduce resource usage.
bitmapcachepersistenable	1	Enables persistent bitmap caching between sessions.
session bpp	32	Bits-per-pixel for session color depth (for example, 16, 24, 32).
dynamic resolution	1	Enables dynamic adjustment of session resolution.
autoreconnection enabled	1	Automatically reconnects the session if the connection drops.
videoplaybackmode	1	Enables optimized video playback mode.
allow desktop composition	1	Enables desktop composition (Aero effects) if supported.
disable themes	0	If set to 1, disables themes. 0 leaves themes enabled.
allow font smoothing	1	Enables font smoothing for better text rendering.
smart sizing	1	Enables the local device to scale the content of the remote session to fit the window size.
desktopscalefactor	100	Specifies the scale factor of the remote session to make the content appear larger.

note

The desktopscalefactor property is being deprecated and will soon be unavailable, as informed by Microsoft Support.

Fields overridden by Kasm group settings

Some RDP parameters are automatically overridden by Kasm group settings and cannot be set manually in the connection_info object. The parameters ensure consistent security and policy enforcement across sessions:

Setting	Description	Kasm Group Setting Key
full address	Target server address	connection_proxy_address
username	RDP username	Derived from authenticationtoken
domain	RDP domain	Derived from authenticationtoken
use multimon	Multi-monitor support	control_panel.show_display_manager
drivestoredirect	Local drive redirection	allow_kasm_rdp_map_local_drives
redirectsmartcards	Smart card redirection	allow_kasm_smart_card_passthrough
audiocapturemode	Microphone support	allow_kasm_microphone
camerastoredirect	Webcam support	allow_kasm_webcam
redirectclipboard	Clipboard redirection	allow_kasm_clipboard_up/down
redirectprinters	Printer redirection	allow_kasm_printing
redirectwebauthn	WebAuthn redirection	allow_kasm_rdp_webauthn_passthrough

Default VM VNC Connection Settings

The Default VM VNC Connection Settings define a series of connection parameters for connecting to external VNC endpoints. The value is a single JSON string. A default example follows:

{
  "guac": {
    "type": "vnc",
    "settings": {
      "autoretry": 5,
      "color_depth": 32
    }
  }
}

The following table describes the Guacamole (guac/vnc) settings:

Name	Description
hostname	The hostname or IP address of the VNC server.
port	The port the VNC server is listening on.
autoretry	The number of times to retry connecting before returning an error.
swap-red-blue	Boolean that swaps red and blue colors to correct display colors being swapped.
cursor	Set to "remote" to have the mouse pointer rendered on the remote server.
encodings	A space-delimited list of VNC encodings to use.
read-only	If set to "true", the VNC connection made is read-only and input is not accepted.

For additional connection parameters, see the Guacamole VNC configuration reference.

Default VM SSH Connection Settings

The Default VM SSH Connection Settings define a series of connection parameters for connecting to external SSH endpoints. The value is a single JSON string. A default example follows:

{
  "guac": {
    "type": "ssh",
    "settings": {
      "font-size": "11",
      "color-scheme": "gray-black",
      "font-name": "monospace",
      "scrollback": "1000"
    }
  }
}

The following table describes the Guacamole (guac/ssh) settings:

Name	Description
hostname	The hostname or IP address of the SSH server.
port	The port the SSH server is listening on.
host-key	The known hosts entry for the SSH server. The parameter is optional. When not provided, no verification of host identity is done.
server-alive-interval	By default the SSH client does not send keepalive requests to the server. The parameter configures the interval in seconds at which the client connection sends keepalive packets to the server.
color-scheme	The color scheme for the terminal emulator used by SSH connections. For details on each option, see the Guacamole documentation linked below.
font-name	The name of the font to use.
font-size	The font size to use in points.
scrollback	The maximum number of rows to allow within the terminal scrollback buffer.
command	The command to execute over the SSH session, if any. The parameter is optional. When not specified, the SSH session uses the user's default shell.
locale	The parameter controls the specific locale to request for the SSH session. The parameter is optional and may be any value accepted by the LANG environment variable of the SSH server. Kasm Workspaces auto-fills this parameter based on the Kasm Session Language user profile setting when not overridden in the server configuration or this global setting.
timezone	The parameter controls the timezone sent to the server over the SSH connection, which changes the way local time is displayed on the server. Kasm Workspaces auto-fills this parameter based on the Kasm Session Timezone user profile setting when not overridden in the server configuration or this global setting.

For additional connection parameters, see the Guacamole SSH configuration reference.

Egress Plugin

Egress Plugin settings apply only when a license that includes seats for an Egress Plugin has been applied to Kasm Workspaces.

Name	Description	Services Need Restarted
Egress Plugin Update Check	Allows Egress Plugins to check in to update Egress Gateways and Egress Accounts.	None
Egress Plugin Update URL	The URL used to update Egress Gateways and Egress Accounts associated with an Egress Plugin.	None

Experimental Features

Experimental Features settings enable Kasm Workspaces features that have been developed but may not be fully productized at the time of addition. When an experimental feature has a configuration, turning off the experimental features flag disables those configurations. After re-enabling experimental features, re-enable the configuration as well.

Name	Description	Services Need Restarted
Enable Experimental Features	Whether to enable experimental features.	None

Workspaces

Workspaces settings control default group membership and CPU allocation for container workspaces.

Name	Description	Services Need Restarted
Add Workspaces To Default Group	Automatically adds workspaces to the default group when new images are added.	API
Default CPU Allocation Method	Sets the default CPU allocation strategy for container images. Valid options are Quotas or Shares. See Remote Browser Isolation for more details.	None

Knowledgebase

The Knowledgebase setting defines the base URL for product documentation.

Name	Description	Services Need Restarted
Knowledgebase URL	The base URL for the documentation.	None

Licensing

The Licensing setting defines the URL for the Kasm licensing service.

Name	Description	Services Need Restarted
License Server URL	The URL to the Kasm Licensing Server.	None

Logging

Kasm Workspaces provides centralized logging out of the box. Whether the deployment runs on a single server or as a distributed system with redundant API servers and multiple Kasm Agents, all logs are collected and aggregated. The platform provides log aggregation, analysis, and storage. The system also supports logging directly to Splunk, or File Based Logs that a Security Information and Event Management (SIEM) solution can ingest for a centralized audit trail.

Name	Description	Services Need Restarted
Debug Log Retention	Number of debug logs to retain. The default is 300,000 logs. Setting this to 0 disables central database storage of debug logs. See the section on log retention for more details.	None
Splunk HEC Token	For Splunk logging, this token provides authentication.	Manager, API
HTTP Method	The HTTP method to use. POST and PUT are supported.	Manager, API
Disable Log Certificate Validation	If set to true, the remote logging server's certificate is ignored. Ignoring the certificate is required when using self-signed certificates. Properly signed certificates do not require this setting.	Manager, API
Log Host	The hostname or IP address of the remote logging system.	Manager, API
Log Port	The port number for the remote logging system. The Splunk default is 8088. Other systems may use 443.	Manager, API
Log Protocol	Remote logging protocol. Valid values are https and splunk.	Manager, API
Log Retention	Number of local logs to retain, excluding debug logs. The default is 400,000 logs. Setting this to 0 disables central database storage of non-debug logs. See the section on log retention for more details.	None
URL Endpoint	The URI path for the logging system. See the sections below for specific logging solutions such as Splunk.	Manager, API

Native Kasm logging

By default, logs are stored in the Kasm database. Kasm Managers and Kasm API servers write their logs directly to the database. Kasm Agent nodes send logs over HTTPS to their respective Kasm Manager. The Kasm Dashboard relies on native logging to provide visual statistics. When remote logging is enabled, native logging continues. See the logging settings table for adjustments to default log settings.

Logging retention

Logging retention settings apply only to native Kasm logs stored in the Kasm database. They do not apply to file-based logs or to logs forwarded to Splunk. The default retention is 400,000 local logs and 300,000 debug logs, as listed in the logging settings table. Before increasing these values, confirm the database system has adequate storage and processing power for the increased logging. When retention beyond 700,000 logs is required, use a dedicated external logging solution. A Kasm Workspaces system can produce over 10,000 debug logs per hour, so consider debug log retention carefully.

Setting Log Retention or Debug Log Retention to 0 disables central database storage for that log category entirely, rather than setting an unlimited retention. This is useful for deployments that rely solely on remote logging or file-based logs.

Splunk logging

Kasm Workspaces supports Splunk HTTP Event Collector (HEC) logging over HTTPS. See the Splunk Event Collector documentation for details on configuring a HEC input. The URI path differs between a Splunk Cloud instance and a self-hosted Splunk instance. A Splunk Cloud SaaS instance has two domain names: one for the UI and one for inputs. Per the linked documentation, the Splunk Cloud SaaS domain name for data input is the same as the UI but with input- at the front.

The following field values configure logging for a Splunk Cloud SaaS instance:

Field	Value
Log Protocol	splunk
Log Host	input-your_cloud_splunk_hostname
Log Port	8088
URL Endpoint	/services/collector/event
HTTP Method	POST
Disable Log Certificate Validation	false
Splunk HEC Token	Splunk 12345678-1234-1234-1234-1234567890AB

note

Include the "Splunk" prefix manually in the Splunk HEC Token field when required by your HEC endpoint.

Manager

Manager settings govern Kasm Manager failover, agent version control, and the authentication token shared with Kasm Agents.

Name	Description	Services Need Restarted
Agent Version	Restricts which versions of the Kasm Agent are allowed to communicate with the Manager.	Manager
Primary Manager Timeout	The number of seconds until the primary manager is considered unavailable. When other managers are alive, one takes over the primary role.	None
Same Zone Reply	If set to true, a manager replies to agent heartbeats only with a list of managers in the same zone as itself. Otherwise a list of all managers is given. The reply allows agents to fail over to managers in other zones.	Manager
Token	An authentication token used in the communication between Kasm Agents and the Manager API server.	Manager
Update Check	Enables or disables the manager checking for Kasm system updates.	None

Web Filter

Web Filter settings control the URL category service and how long categorization results are cached.

Name	Description	Services Need Restarted
Web Filter Update URL	URL used to interface with Kasm's URL category service.	API
Web Filter Default Category Expiration (Hours)	URL categorization results are cached for the specified time, defined in hours. The setting applies to domains that have a category other than Uncategorized.	API
Web Filter Uncategorized Expiration (Hours)	URL categorization results are cached for the specified time, defined in hours. The setting applies only to domains currently categorized as Uncategorized.	API

Scale

Scale settings govern the guardian process, agent lifecycle expiration, and AutoScale provisioning timeouts.

Name	Description	Services Need Restarted
Automatically Enable Agents	Automatically enables agents if disabled every time they check in.	None
Guardian Interval	How often to run the guardian. The guardian handles cleanup of agents and Kasms, as well as provisioning of AutoScale agents.	Manager
Guardian Provision Threads	Number of threads to use for teardown and provision tasks.	Manager
Host Dead Expiration	How long to wait after an agent stops checking in before marking it dead. When the agent was auto-provisioned, it is cleaned up once marked dead.	Manager
Host Missing Expiration	How long to wait after an agent stops checking in before marking it missing. The value should always be less than the Host Dead Expiration.	Manager
Keep Alive Expiration	How long the session stays alive when no client is connected. The global setting can be overridden at the group level.	API
Provision Timeout	How long to wait for an AutoScale VM to finish provisioning.	API, Manager
Component Missing Expiration	Changes components to a Missing status after they fail to check in within this timeframe. The setting applies to components such as connection proxies.	None
Component Dead Expiration	Automatically deletes components that fail to check in within this timeframe. A value of 0 disables this feature. The setting applies to components such as connection proxies.	None

Theme

The Theme setting controls the background image on the Workspaces launcher.

Name	Description	Services Need Restarted
Launcher Background URL	The location of a background image to use on the Workspaces launcher. Kasm Workspaces provides several built-in background options listed in the "Default Backgrounds" section of Custom Branding. After changing the setting, log out and log back in for the setting to take effect.	None

Storage

Storage settings provide the S3 credentials used for persistent profiles.

Name	Description	Services Need Restarted
Object Storage Key	AWS Access Key ID used to access S3, used for S3 based persistent profiles.	API
Object Storage Secret	AWS Access Key Secret used to access S3, used for S3 based persistent profiles.	API

Recording

Recording settings control session recording quality, upload location, and retention. Session recordings provide a tamper-evident audit trail of RDP, VNC, and SSH sessions.

Name	Description	Services Need Restarted
Session Recording Framerate	The framerate for session recordings. A minimum of 2 frames per second is supported for RDP, VNC, and SSH sessions. More frames per second result in smoother video but higher storage and bandwidth usage.	None
Session Recording Bitrate	The bitrate for session recordings, measured in Mbps. A higher bitrate results in higher quality recordings but also higher storage and bandwidth usage.	None
Session Recording Width	The width for session recordings in pixels. A higher number gives higher quality recordings while increasing storage and bandwidth usage.	None
Session Recording Height	The height for session recordings in pixels. A higher number gives higher quality recordings while increasing storage and bandwidth usage.	None
Session Recording Upload Location	A dynamic URL pointing to an AWS S3 bucket where the session recording is stored. The value must be the full video path including the filename ending in .mp4. Each file has the epoch added to allow uploading multiple clips per session. The URL can include templated variables to tailor the storage path. See Session Recording for more details. An example of a valid URL is s3://session-recordings/{username}/{kasm_id}.mp4.	None
Session Recording Queue Length	For RDP, VNC, and SSH sessions, the number of recording clips processed and uploaded at once on each connection proxy server. Increase this number for higher concurrent session counts. The setting affects the CPU cores and memory available to proxy connections. Adjust connection proxy resources accordingly. Session recording encoding is CPU intensive. See the Kasm sizing guide for more information.	None
Session Recording Retention Period	How long the connection proxy continues to retry uploading recorded clips that failed to upload, measured in hours. The setting applies to RDP, VNC, and SSH sessions only. Clips that failed to upload and have not exceeded the retention period can be copied from the folder /opt/kasm/current/tmp/guac/recordings on the connection proxy.	None
Object Storage Access Key ID	Object storage (S3) access key ID specific to session recording.	None
Object Storage Access Key Secret	Object storage access key secret specific to session recording.	None
Disk Usage Limit for Session Recordings	The percentage of disk space allowed to be consumed on the connection proxy before session recording stops and session creation with recording enabled fails. The default value is 0.90, meaning session recording stops when the disk is 90% full.	None

Setting Properties

The following table lists the properties of each setting.

Name	Setting name
Category	Setting Category
Services Restart	What services need to be restarted on setting change
Value	Settings Actual Value
Value Type	Data Type
Description	Setting Description

System Metrics

The System Metrics module periodically collects snapshot logs for essential system components, evaluates their health, and displays the results on the System Metrics dashboard. The settings control whether System Metrics is enabled, how often metrics are collected, and how many metric records are retained for each component.

Name	Description	Services Need Restarted
Enable System Metrics	When enabled, the backend System Metrics Module periodically collects snapshot logs for all essential components, checks their health, and displays the data on the System Metrics page.	None
System Metrics Poll Interval	The time interval, in minutes, at which the system collects and evaluates system metrics. A lower value collects metrics more frequently. A higher value reduces how often checks are performed.	None
System Metrics Retention	Number of system metrics records to retain per component. Increasing this value allows more historical metric snapshots to be reviewed but may increase the amount of stored metric data. Review Kasm Workspaces documentation before adjusting this value.	None