A system includes multiple KVM switches, multiple user consoles and a recording system connected via a network. Each KVM switch facilitates interactions between user consoles and selected servers connected its server ports. The KVM switch transmits keyboard, mouse and video data exchanged between user consoles and servers, and administrative data, to the recording system. The recording system records the keyboard, mouse, video and administrative data, and detects trigger events based on such data. Trigger events include predefined keywords, mouse operations, video images, user IDs and server IDs, or combinations thereof. When a trigger event is detected, the recording system automatically transmits monitoring information to an administrative console via the network. The monitoring information may include combined video data containing information about keyboard and mouse actions superimposed on desktop images. The administrative console may also request specific recorded data for review. The recording system may employ a master-slave configuration.