View logs
This department describes how to view logs in [CT Operation Log].
The procedure is as follows:
Start Log Viewer to display the [CT Operation Log] window.
Set the following items in [Select Section]
Select the Management Server that manages the client (CT) from [Target server].
Select “Display the client (CT) directly belongs to the selected group only”, or “Display all clients (CTs)” in the [Sub-level contained] check box under [Range of display].
Select “Display the client (CT) with violation logs only”, or “Display all clients (CTs)” in the [The violation CT is displayed only] check box in [Range settings].
Select the CT group to which the client (CT) for viewing logs belongs from the CT group tree of [Select Section].
Logs on the client (CT) can be searched and viewed with different ranges depending on the location selected in the group tree.
When selecting server name: Logs can be searched and viewed on all clients (CTs) belonging to the Management Server. (*)
When selecting domain name: Logs can be searched and viewed on all clients (CTs) belonging to the domain selected during Active Directory Linkage. (*)
When selecting Local group: Logs can be searched and viewed on all clients (CTs) belonging to local groups during Active Directory Linkage.
When selecting CT group: Logs can be searched and viewed on all clients (CTs) belonging to the CT group during Active Directory Linkage.
*) The [Sub-level contained] check box in [Range of display] must be selected.
→The clients (CTs) belonging to the CT group will be displayed in [List of searched CT(2Items)].
The client (CT) and CT groups with violation logs will be displayed in red. Please refer to “Display the group or client (CT) that has generated violation logs in red” for details.
Note
Please update information of CT group and CT list in following cases
When the Log Viewer performs the following operations, the information of the CT group and CT list of the Management Server displayed in the window will not be updated to the latest status.
When the CT group tree has been modified via the Management Console
When Active Directory Linkage is performed and the group tree is modified
When adding a new client (CT) to the CT group of the Management Console using the automatic allocation file during CT registration
When Log Viewer has been started one day before (violation information has been modified)
To update to the latest information, please click the [Refresh] button in the display area of [Select Section] window, and the latest information of the server selected in [Target server] can be displayed.
Perform any of the following operations according to the purpose of viewing CT Operation Logs:
[View logs by client (CT)]
Click [Name] of client (CT) for viewing logs in [List of searched CT(2Items)].
[View client (CT) logs within the selected range in CT group tree]
Click the [Group search] button in [List of searched CT(2Items)].
→The [CT Operation Log(Operation) - Log search] window is displayed.
[Search conditions], [Detailed conditions] and [Type of log (Multiple choices)] can be opened or closed.
After clicking [Search conditions], [Detailed conditions] and [Type of log (Multiple choices)] (rightward triangle symbol), the [Search conditions] window will be opened.
After clicking [▼Search conditions], [▼Detailed conditions] and [▼Type of log (Multiple choices)], the [Search conditions] window will be closed.
Note
In case of IE6, the scroll bar cannot be displayed when unfolding “Detailed Conditions”
In case of IE6, if the scroll bar cannot be displayed for conforming log list when unfolding “Detailed conditions”, please check if “Log Type (Multiple choices)” and “Detailed conditions” are in folded status.
Set [Search conditions]
Click [Detailed conditions] to set detailed conditions such as drive type and log collection time, etc.
Item Name | Description |
|---|---|
[Search target] | The name of client (CT) in which the search logs are collected or CT group name will be displayed. |
[Search range] | Search in the specified time range. If the start time and end time of [Search range] are not specified, search may be performed in all periods
If no end month or day is specified, search till the end of the specified year (Dec 31).
*If the specified year is omitted, the specified month and day should be omitted. As initial values, the start date and end date will be displayed as the date on the [CT Operation Log - Search Log] window. [When selecting the [The violation CT is displayed only] check box of [Range settings] and clicking the [Group search] button] |
[Call search conditions] | This item can invoke the saved search conditions. The methods for saving/deleting search conditions are as follows:
|
[Keyword] | Keywords of logs can be used for searching. In addition, when specifying multiple keywords, the single-byte or double-byte space should be entered between keywords. After specifying [OR condition] in [Search condition], the search condition will become [OR Search] with more than one keyword, the multiple specified ones. Alternatively, after specifying [AND condition], the search condition will become [And Search] with all of the specified keywords. Select OR or AND Condition if multiple keywords are specified. In the information displayed in the content column and notes column of logs, the content marked with [ ] can be set as the keyword |
[User ID] | Search according to user name. Only one user name can be entered. |
[Classification] | The operation sallowed or not allowed can be selected in policy setting. Select [Normal] to search the operations allowed and select [Violation] to search the operations not allowed. After [All] has been selected, both [Normal] and [Violation] will be selected. [When selecting the [The violation CT is displayed only] check box of [Range settings] and clicking the [Group Search] button] |
[Type of log] | Select the type of log to be displayed in [List of logs]. |
[Log Type (Multiple Selection)]
Item Name | Descriptions |
|---|---|
[Type of log] | Select the type of log to be displayed in [List of logs]. Please refer to “Type of logs can be viewed” for information about log types. [Select All] : Select all log types. |
[Detailed Conditions]
Item Name | Descriptions |
|---|---|
[Type of drive] | Search according to the type of drive.
The following four types can be specified and multiple specifications at the same time are allowed:
[Relationship between settings of [Type of log] and [Type of drive] and searched log]
|
[Time] |
If [Day of the Week] is specified at the same time, the search will become the “AND Search” including all of the multiple conditions. |
[Day of the Week] | [Select All] : Select all check boxes in [Day of a Week]. [Clear All] : Cancel all selected check boxes in the [Day of a Week] menu. [Day of a Week] check box: When the day of the week for log collection is set as a search condition, select the correspondent day. When multiple days of the week are selected, the search will become the “OR Search” including more than one day of the week. When none are selected, it means that all are selected. If [Time] is specified at the same time, the search will become the “AND Search” including all of the multiple conditions. |
Click the [Search] button.
If the number of cases in search result exceeds 10000, the following window will be displayed. Click the [OK] button to continue search, or click the [Cancel] button to switch to the search condition window. When this window is displayed, it is recommended to click the [Cancel] button, and search again after modifying the search condition.
Too many cases in the search result may cause timeout and the following message will be displayed. At this time, please search again after refining the search condition.
[Example of Refining Search Condition]
Reduce search time
Reduce the Number of sets as search target
Set to search keyword condition
Set to search user name
→The search result is displayed in [List of logs].
[View logs by CT]
The CT operation log corresponding to the client (CT) will be displayed in [List of logs] .
[View logs of client (CT) under the selected range in CT group tree]
CT operation logs of all clients (CTs) under the CT group will be displayed in [List of logs] .
Click the [Select CT] button.
→ The CT list under the group is displayed in [Select CT].
The client (CT) and CT group that have generated violation logs will be displayed in red. Please refer to “Display the group or client (CT) that has generated violation logs in red” for details.
When clicking [Name] of the client (CT) to view logs, only the CT operation log of the correspondent client (CT) will be displayed.
When clicking [Number of violation logs] the client (CT) to view logs, only the violation log of the correspondent client (CT) will be displayed.
Content displayed in [List of logs]
(1) The number of logs corresponding to the search condition.
(2) Click the“<” to go to the previous page. Click “>” to go to the next page. Click “<<” to return to the home page. Click “>>” to go to the last page.
(3) Select the number of logs to be displayed in Window 1.
(4) Display the page of logs being viewed currently.
(5) To view logs of other pages, enter the page number and then click the [Go] button.
The information will be sorted after clicking the name of following items (Name, Occurrence Date and Time, User Name, etc).
Item Name | Description |
|---|---|
[Name] | This is the name that can be attached to the client (CT). Its initial value is the computer name. When modifying, please refer to “Modify CT Policy”. |
[Date and time] | This is the date and time when logs are collected in the client. |
[User name] | This is the user name entered when logging on the client (CT). If nobody logs on (when executing a program according to the task scheduler), the user name will be displayed as “System” when the following operation logs are collected:
|
[Domain name] | This is the client domain name entered when logging on to a domain. It is also the computer name of the client (T) when logging on to the local computer. But it is blank when the system is Windows® 98 or Windows® ME (when connecting to the client (CT) of V12). If nobody logs on (when executing program according to task scheduler), the domain name will be displayed as the computer name of the client (CT) when the following operation logs are collected:
|
[variety] | This is the type of the log.
|
[Classification] | According to policy settings, the operation allowed will be displayed as [Normal], and the operation that is not allowed will be displayed as [Violation]. When [Violation] logs are collected, this line will be displayed in red (settings concerning display are not required). |
[Add] |
|
[Content] | This is the content of the log Please perform the following operations to confirm all contents:
Up to 519 bytes can be displayed as the path length of target file of file operation log. In the path name containing UNICODE characters, part of UNICODE characters will be displayed in escape format. UNICODE characters can be correctly displayed when all the following conditions are satisfied.
If the above conditions are not satisfied, UNICODE characters contained in the log will be displayed as “?” or in the escape format (e.g. In “ꪪ”, AAAA is a hexadecimal code with 4 or 5 digits. |
[Remarks] | This is the notes of the logs. |
Click [Occurrence Date and Time] of the displayed log.
→The [CT operation log(Operation) - Log search - Log details] window is displayed.
Item Name | Description |
|---|---|
[Name] | For the name that can be attached to the client (CT), the initial value is the computer name. When modifying, please refer to “Modify CT Policy”. |
[Occurrence date and time] | This is the date and time when logs are collected from the client. |
[User name] | This is the user name entered when logging on the client (CT). If nobody logs on (when executing program according to task scheduler), the user name will be displayed as “System” when the following operation logs are collected:
|
[Domain name] | This is the client domain name entered when logging on to a domain. It is also the computer name of client (T) when logging on to the local computer. But it is blank when the system is Windows® 98 or Windows® ME (when connecting to the client (CT) of V12). If nobody logs on (when executing program according to task scheduler), the domain name will be displayed as the computer name of client (CT) when the following operation logs are collected:
|
[Type] | This is the type of log. |
[Classification] | According to policy settings, the operation allowed will be displayed as [Normal], and the operation that is not allowed will be displayed as [Violation]. |
[Content] | This is the content of the log Up to 519 bytes can be displayed as the path length of target file of file operation log. In the path name containing UNICODE characters, part of UNICODE characters will be displayed in escape format. UNICODE characters can be correctly displayed when all the following conditions are satisfied.
For command log, the “・” may be displayed at the end of line as line feed. |
[Note] (Note 1) | This is the notes of the logs. |
[Additional] (Note 1) | The displayed information is as follows:
|
[Session ID] (Note 2) | This is the ID indicating the command execute in command prompt of client (CT) and the result of command execution |
[Download Content] (Note 2) | The message displayed in [Content] can be downloaded in text format. |
Note 1: This cannot be displayed in case of command log.
Note 2: This will be displayed in case of command log.
View attached data
When window title logs, file export log, clipboard operation logs and clipboard operation prohibition logs are being collected, the captured screen data, original file data of exported files and text and image data via clipboard can be saved simultaneously.
In addition, when collecting E-mail sending log, E-mails and attachments can also be saved.
By viewing these data, the actual content of displayed windows, exported files, sent E-mails and attachment can be known.
If the [View/save attached information] checkbox is selected in [Detail authority] of the [Administrator Information Settings] window of Server Settings Tool, the captured screen data, original file data of exported files, text and image data via clipboard can be viewed and saved.
If the [Save E-mail contents] checkbox is selected in [Detail authority] of the [Administrator Information Settings] window of the Server Settings Tool, the content of sent E-mails and attachments can be viewed.
If the file as attached data exists, it is possible to Save original file backup
In addition, if screen capture data exists, it is possible to View/Save screen capture data.
When screen capture data exists in window title logs and PrintScreen key prohibition log”, the captured screen can be viewed after clicking the link of the item value link of [Attachment] in the [CT operation Log(Operation) - Log Search - Log Details] window.
If two captured screens exist, there will be 2 links.
If one screen capture of window exists in the [Attachment] item of log list, the window title log with screen capture data existed will be displayed as [1]; when screen capture of two windows exists, the window title log will be displayed as [2].
If screen capture data exists in PrintScreen key prohibition log, [1] will be displayed in the [Attachment] item of the log list.
Click the link of item value of [Attachment]
→The image of screen capture is displayed.
Note
When screen capture data cannot be displayed
The following message will be displayed after clicking the [Display Image] button.
[LWSV-ERR007] screen data cannot be displayed because it has not been transferred to server.
It will be displayed when the screen capture data has not been sent from the client (CT) to the Management Server, or “Save screen capture data to CT” has been set. When screen capture data has not sent from the client (CT) to the Management Server, please view later after clicking the [OK] button. If “Save screen capture data to CT” has been set, the saving location must be modified. The location for saving and timing of sending screen capture data can be set in [Terminal Operation Settings] window of the Management Console. Please confirm the settings and modify them according to the execution situation. For the confirmation of [Terminal Operation Settings], please refer to “2.4.2 Perform Terminal Operation Settings”.
Click the [File Saving] button.
→ In the [Saved as] window that is displayed, select the location for saving, and click the [Save] button. The image will be saved to the specified location in the png format with default file name.
The file name of screen capture data: “CT name” + “-” + “Log occurrence date and time (yyymmdhhmnss)” + “-” + Page number (1or 2) + “-” + “Extension” (e.g. PC382686-20061215203412-1.png)
Click the [Close] button.
When the file export log, E-mail sending log, linkage application log, clipboard operation log and clipboard operation prohibition log contain original file backup s, after clicking the link of item value of [Attachment] in the [CT Operation Log - Log Search - Log Details] window, original file backup s can be saved to any location. The file export log and linkage application log that contain original file backup will be displayed as [1] in the [Add] item of [List of logs]. Clipboard operation log and clipboard operation prohibition log will be displayed as [Obtain] in the [Attachment] item of [List of logs].
Click the link of item value in [Attachment].
→In the [Saved as] window that is displayed, select the location for saving, and click the [File saving] button.
The file name when backing up original files is displayed as the default value. Please modify the file name and save it if necessary.
The original file backup name of file export log: Export source file name
The original file backup name of linkage application log: “CT name” + “-” + “Log occurrence date and time (yyyymmddhhmnss)” + “.” + “Extension” (e.g. PC382686-20061226132137.wmf)
The original file backup name of E-mail sending log: “CT name” + “-” + “Log occurrence date and time (yyyymmddhhmnss)” + “.” + “Extension” (e.g. PC382686-20061226132137.eml)
The original file backup name of clipboard operation log and clipboard operation prohibition log”: “CT name” + “-” + “Log occurrence date and time (yyyymmddhhmnss)” + “.” + “Extension” (e.g. in case of text or file: PC382686-20061226132137.txt; In case of image: PC382686-20061226132137.png)
Note
When original file backup cannot be saved
The following message will be displayed after clicking the [File saving] button.
[LWSV-ERR010] The original file backup cannot be displayed because it has not been transferred to server.
It will be displayed when the original file backup has not been sent from the client (CT) to the Management Server, or “Save Original File Backup in CT” has been set. When the original file backup has not sent from the client (CT) to the Management Server, please view later after clicking the [OK] button. If “Save Original File Backup to CT” has been set, the saving location must be modified. The location for saving and timing of sending original file backup can be set in [Terminal Operation Settings] window of the Management Console. Please confirm the settings and modify them according to the execution situation. For the confirmation of [Terminal Operation Settings], please refer to “2.4.2 Perform Terminal Operation Settings”.
Export contents displayed in [List of logs] to CSV file
After the [Save CSV file] check box is selected in [Detailed authority] in the [Administrator Information Settings] window of the Server Settings Tool, the content displayed in [List of logs] will be exported to a CSV file and saved.
In the status of displaying the logs to be exported to CSV file in [List of logs], click the [Output in CSV format] button.
In the file download window that is displayed, click the [Save] button.
After selecting the folder for saving and entering the file name, click the [Save] button.
When a file with same name exists in the export destination, the option window indicating whether to overwrite will be displayed. Please select the desired option.
For the item name and description of an exported CSV file, please refer to “Log List” of “Systemwalker Desktop Keeper Reference Manual”.
When file download is not successful
When the download of CSV file, original file backup and command operation file is not successful, please refer to “Preparation of Using Web Browser in PC” of “Systemwalker Desktop Keeper Installation Guide” to modify the settings of Internet Explorer®.
Link with Systemwalker Desktop Patrol
When linking with Systemwalker Desktop Patrol, assets management information (Systemwalker Desktop Patrol information) of the correspondent PC can be viewed.
Select the client (CT) that displays Systemwalker Desktop Patrol assets management information.
Select [Assets Management]
The asset information of Systemwalker Desktop Patrol will be displayed in other windows.
