A search of the user operation log is performed on the Log Viewing Database. Therefore, restore management information and log information to the Log Viewing Database before performing the search.
The user operation log is easier to search if you create a user policy definition and user layer configuration. Another approach is to use the Link with Active Directory feature and Link with Systemwalker Desktop Patrol feature to define a user policy and user layer configuration.
When Management Servers are in a 3-level structure, centrally manage user information on the Master Management Server. In addition, restore Master Management Server management information in the Log Viewing Database.
Assume that you have an environment where Management Servers are in a 3-level structure and a user policy is created on each Management Server. In this case, even if you restore the Master Management Server management information, a large volume of user information that has been logged by downstream Management Servers will be displayed for the Other users group in the user operation log search window.
If you delete client (CT) information from management information, you cannot search for operation logs for that client (CT) even in the user operation log. But you can search for clients (CTs) in the Deleted CT group, even if the settings are configured to not display deleted clients (CTs).
If you select a user to be searched for and no user name or domain name has been recorded for that user in the log, a halfwidth single-byte space will be displayed as the user name. In this case, clicking that space will enable you to search the logs of a user for whom no user name has been recorded.
If you perform a file trace when searching the user operation log, you can search only the operation logs in clients (CTs) that have recorded the trace source logs. You cannot perform a file trace across multiple clients (CTs).
There is no feature for searching or displaying the operation logs for such operations as setting the policy in the User Policy Settings window on Management Console or performing searches in the Log Viewing Database in Log Viewer.
Even if the department tree pane in the user operation log search window shows violation logs for that department and client (CT), the department name and client (CT) name are not displayed in red.
