"Remote console connected" vs "Ticket for xxx of type MKS" what's the difference?

[mchunger]

I'm looking through the logs (ESXi.4.1) to see who might have opened a console and come across the two fairly frequently.  I've found out the MKS mean "mouse, keyboard, screen", so that sounds a lot like a user opening a console, but then so does "remote console connected"

Does anyone know the difference between the two?  Or is there another string i should be looking for when investigating console logons?

[kjb007]

I see those two occur in pairs, are you seeing differently?

-KjB

[mchunger]

I actually see about twice as many MKS log events then the remote console for the same time period\duration.

[kjb007]

Haven't been able to replicate it in this timeframe.  I can only assume the ticket is only good for x amount of time, and if you leave your console connection active, then another ticket will be required after that ticket expires.  I'll check my connection in some time to see if this is the case.

-KjB