Children's patterns of behavior during distance learning.

In this article we will examine how children behave during distance learning, and how this can be determined using KidLogger for Windows.

We will look at six basic patterns of behavior:

  1.     The child is listening to the conference. He or she does not touch the computer;
  2.     The child is talking over Zoom with a teacher;
  3.     The child is chatting with friends using an extraneous chat client (Skype, Discord);
  4.     The child is reading some extraneous material in Word;
  5.     The child is looking at an extraneous website (Facebook);
  6.     The child is watching an extraneous video (YouTube).

Pattern of behavior 1: The child is listening to the lesson. He or she is not touching the computer.

On the screenshots we see only the Zoom window with educational material.  In this case it is Physics, grade 7.


In the event log:

- First we see that the child was working in Skype or Viber. Though them the child received an invitation to a teleconference.

- After this, the Zoom application was launched.

During the process of working, we see the following entries:

  • Desktop has been switched or locked
  • Desktop has been unlocked
  • Zoom meeting start: 00:00:00
  • Zoom Meeting
  • Computer was idle for: 00 hours 06 mins

This is the normal course of events for working with Zoom. If the child does not touch the keyboard or mouse, the computer might assume there is no one working on it, and it will go to sleep.

By moving, the child will bring the computer out of sleep.  At the same time it is as if a new teleconference is logged.

Even a pause might be noted down, as the last entry suggests, though all this time the teleconference has been going on and the child is listening to the lesson with attention. For the operating system there is no difference, however; someone is either sitting at the computer or not. If there is no keyboard or mouse activity, then the computer might go to sleep.

Theoretically the child could leave or fall asleep, but the webcam shots and screenshots will help us see what is really going on.

By the way, the screenshots are named according to the program that is currently active. If the names end with Zoom, then that means that Zoom was active, and we don't have anything to worry about.

Pattern of behavior 2: The child is talking over Zoom with the teacher.

On the screenshots we see the main Zoom window and next to it the window for Zoom's chat.

In the event log:

First we see connecting to the teleconference as in Pattern 1.

Then we see the chat program, which lasts up to a minute. This is then followed by the text the child has entered. The text on the KidLogger website is highlighted in orange. The first line contains the name of the program in which the user entered text, and the second line shows the text itself.

The screenshots also have the word Zoom at the end of their names. When switching from the conference window to the chat window, Program Manager may be invoked and also shown in the log.

In addition, the screenshots might have "Explorer" in their names, which means that the desktop or some other folder on the computer was active for some period of time. This should not scare parents, and in no way does it mean that the child was getting distracted during class time.

Pattern of behavior 3: The child is chatting with friends using an extraneous chat client (Skype, Discord)

On the screenshots we see the main Zoom window and to the right the window for Skype or Discord chat. These are chat programs that teachers virtually never use, but they are loved by gamers. For example, Discord. If you see a program like this open during class time, rest assured that the child sees and hears nothing of the lesson, he or she is completely immersed in talking with friends.   

The Zoom window is partially covered by Skype.


The Zoom window is in the background and Discord is in the foreground

In the event log:

First we see connecting to the conference as in Pattern 1.

However, besides the Zoom application we see more discussion going on in Skype (or another messenger) which is hardly directly at the teacher.



What has the child been up to more, learning or chatting?

We can find this out from the analytics on the applications used over this day.

In this slide we see that in Zoom the child spent 1 hour 1 minute,

in Discord 36 minutes,

in Opera 37 minutes,

and in Viber 1 hour 14 minutes.

You can decide for yourselves how productive this kind of behavior was. One would prefer that the child be engaged in learning during class time, and save the fun for breaks.

Pattern of behavior 4. During the lesson the child is reading some extraneous material in Word.

In the screenshot we see the main Zoom window and next to it a Word window with a document unrelated to the learning process. It is great that the child is reading, but as parents it would not hurt to see what exactly the child is reading.

In the log, besides Zoom we find screenshots labeled Word (Winword.exe) and we also find the name of the document that the child was distracted by.

The analytics on applications show how much time during the learning process the child spent on extraneous literature.

Though in our slide Word was used for just 7 minutes, the child could easily read this extraneous book while Zoom was active. After all, there was enough space on the screen for both Zoom and Word.


Pattern of behavior 5. During the lesson the child is looking at social media, e.g. Facebook.

On the screenshots, besides the main Zoom window we see a web browser with news, photos, and memes.

In the log we find, besides Zoom, screenshots named after the browser (Chrome) as well as the URL of the social-media website (…).

Web analytics show how much time the child was hanging out on social media during class time.

Pattern of behavior 6. During the lesson the child is watching an extraneous video on the internet.

On the screenshots we see, besides the main Zoom window, a browser window with the video website the child is viewing and which is unrelated to the lesson.

In the log, besides Zoom we find screenshots named after the browser(Chrome),  as well as the URL of the video website.

In this illustration there is also a description of the video from YouTube.

In this case, the most information is provided by Web analytics, which show how much time the child spent on the website containing the video.

Applications analytics show for how much time the browser had been launched without any further information, and how much time Zoom was active.


Let's draw a few conclusions:

1. Using the KidLogger service, we can find out what our child is really doing during distance learning.
2. The main information is provided by screenshots. Here we can see which applications and documents, besides those related to learning, our child has been using.
3. The log documents the use of programs and documents during the lesson time. If a pause is detected, that does not mean that the child has fallen asleep or walked away, only that the child has not touched the computer for a long time. The webcam shots can confirm this.
4. Application-use analytics help understand how much time the child has spent on learning and how much on extraneous programs.  
5. Web analytics allow one to track visits to social media and videos unrelated to the learning process.
6. If the child has launched Word, it makes sense to read at least part of the document that your child is reading. It might not be learning-related at all.
7. The first two patterns of behavior are ideal for the learning process. When you see patterns 3–6, you can assume that your child has got distracted, and that measures should be taken to ensure the child does not completely lose interest in learning.

Here you can find tutorials, articles and announcements about KidLogger SAS: what new features we’ve implemented, how to install Kidlogger, and how to set up user monitoring for different platforms like Windows, Mac, Android.

We’re happy to hear any suggestions you might have about improving KidLogger.

Compare Parental Controls in Windows 7, Mac and

“Never leave kids and employees unsupervised.”