Link of logs between terminals based on the information of inter-terminal connection
To link the logs between two terminals, the client (CT) must be installed on both the connection source and target terminals. If only one of them is installed with the client (CT), only the information of connection, disconnection and the log of terminal with the client (CT) installed can be collected.
When Collect information of connection between terminals has been set in the system settings of the server settings tool, the following logs will definitely be collected. "Do not collect" cannot be set as a policy.
Logon log
Logoff log
PC startup log
PC shutdown log
PC sleep log
PC recovery log
PC connection log
PC disconnection log
If the above logs are no need to be collected, set Do not collect information of connection between terminals in the system settings of the server settings tool. But in this case, the logs of the connection source and target terminals cannot be linked.
When the same user is allowed to log on a terminal for multiple times regardless of physical environment or virtual environment, even if one user logs in at separate times, it will be considered as the operation of a single user and operations at each logon will be bound and displayed in time sequence.
The logs of the connection source and target terminals can be searched by specifying the same. If the time on the terminals is different, a series of operation logs cannot be searched. Therefore, synchronize the time on the source and target terminals.
Since the terminal that performs log search and the connection source and target terminals are registered on different Management Servers, in the environment with a 3-level structure, the log searching terminal must be connected to the master management server before searching logs. When log searching is performed after connecting to a lower-level management server, log search for connection source and target terminals cannot be executed.
For the virtual OS on Hyper-V, when connection is performed through the Hyper-V manager, the connection will be regarded as a local connection rather than an inter-terminal connection. When remote desktop connection is performed for a virtual OS, the connection will be regarded as an inter-terminal connection and the logs can be collected.
