Job Management Partner 1/Software Distribution Description and Planning Guide

[Contents][Glossary][Index][Back][Next]

2.5.8 Collecting operation history and suppression history

You can collect the operation history and suppression history of software programs used at clients.

To collect the operation history and suppression history, you must specify in an operation monitoring policy those events whose history you wish to collect. The follow table shows the event types that can be collected as operation history and suppression history.

Table 2-19 Event types that can be collected as operation history and suppression history

Event Operation target Description
Start process Software Program start event
Stop process Program stop event
Change caption#1, #2, #3 Window title change event
Change active window#1, #3 Active window change event
Start/Stop of machine PC start or stop event
Logons/logoffs#4 Logon or logoff event
Web access#3 Web page downloading completion event in Microsoft Internet Explorer
Software startup suppression Software startup suppression event
Print operation#3, #5 Print execution event from software
External media operation External media External media connection or disconnection event (can be collected from clients whose version is between 08-51 and 09-00)
Device operation Connection or disconnection event for various types of devices (can be collected from clients whose version is 09-50 or later)
USB media connection permission USB media connection permission event (can be collected from clients whose version is between 08-51 and 09-00)
USB media connection suppression USB media connection suppression event (can be collected from clients whose version is between 08-51 and 09-00)
Device connection permission Connection event for various types of devices (can be collected from clients whose version is 09-50 or later)
Device connection suppression Connection suppression event for various types of devices (can be collected from clients whose version is 09-50 or later)
File operations#3 File File manipulation event on Windows Explorer

#1
If a client's OS is Windows 8, Windows Server 2012, Windows 7, Windows Server 2008, or Windows Vista, change events in the active window cannot be collected, nor can the caption for a process for which user permissions have been upgraded.

#2
Caption change events might not be collectable for software created in Java or Visual Basic.

#3
Depending on the logon timing, the logon user name might be displayed as SYSTEM.

#4
To collect the logoff operation history when the client's OS is Windows 8, Windows Server 2012, Windows 7, Windows Server 2008, or Windows Vista, do not stop the Terminal Services service.

#5
In the case of a virtual printer, printing might not have been suppressed even if a print suppression event has been output to the log.

The details of the information to be collected are given below.

Organization of this subsection
(1) Information collected in the software operation log and suppression log
(2) Information collected in a Web access log
(3) Information collected in the print operation and print suppression logs
(4) Log data collected for operations to or from external media
(5) Information collected in the connection permission log and connection suppression logs for USB-connected media
(6) Information collected in the connection, disconnection, connection permission, and connection suppression logs for devices
(7) Data collected in a file operation log
(8) Specifying the software operation history storage directory

(1) Information collected in the software operation log and suppression log

This subsection explains the information that is collected in the software operation log and suppression log.

(a) Information collected in a software operation log

Information collected in a software operation log differs depending on the event that occurs. The following information is collected. For details about the information that is collected, see 6.5.3 Items displayed in an operation log in the manual Administrator's Guide Volume 1.

Table 2-20 Information collected in a software operation log

Event Time Type Logon user Window title Program name File version Account
Start process Y Y Y -- Y Y Y
Stop process Y Y Y -- Y Y Y
Change caption Y Y Y Y Y Y Y
Change active window Y Y Y Y Y Y Y
Start/Stop of machine Y Y -- -- -- -- --
Logons/Logoffs Y Y Y -- -- -- --

Legend:
Y: Collected.
--: Not collected.

(b) Information collected in the software startup suppression log

The types of data listed below are collected in the software startup suppression log. For details about the information that is collected, see 6.5.1 Viewing software startup suppression logs in the manual Administrator's Guide Volume 1.

(2) Information collected in a Web access log

The following Web access log information is collected:

Notes on collecting a Web access log

(3) Information collected in the print operation and print suppression logs

The information collected in the print operation and print suppression logs varies depending on the events that occur. The following table shows the information collected in the print operation and print suppression logs.

Table 2-21 Information collected in the print operation and print suppression logs

Event Execution date/time Type Document name Logon user Name of the printer used Result
Print Y Y Y Y Y --
Print suppression Y Y Y Y Y --
Print suppression released Y Y -- Y -- Y

Legend:
Y: Collected.
--: Not collected.

Prerequisites for shared network printers

Notes on collecting print operation and print suppression logs

(4) Log data collected for operations to or from external media

The following types of log data are collected for operations to or from external media:

Notes on collecting log data for operations to or from external media

(5) Information collected in the connection permission log and connection suppression logs for USB-connected media

The information collected in the connection permission log and connection suppression log for USB-connected media varies depending on the event that occurs. The following table shows the information that is collected.

Table 2-23 Information collected in the connection permission log and connection suppression log for USB-connected media

Event Type Op D/T Frndly name ID: DD ID: USB Cond User
USB media connection permission Y Y Y Y Y Y Y
USB media connection suppression Y Y Y Y Y N Y

Legend:
Op D/T: Operation date/time
Frndly name: Friendly name
ID: DD: Device instance name: CD/DVD drive
ID: USB: Device instance name: USB drive
Cond: Permission condition
User: Logon user
Y: Collected
N: Not collected

Notes on collecting the connection permission and connection suppression logs for USB-connected media

In the following cases, it might not be possible to collect the connection permission and connection suppression logs for USB-connected media:

(6) Information collected in the connection, disconnection, connection permission, and connection suppression logs for devices

The information collected in the connection, disconnection, connection permission, and connection suppression logs for various devices varies depending on the event that occurs. The following table shows the information that is collected.

Table 2-26 Information collected in the connection, disconnection, connection permission, and connection suppression logs for devices

Collected item Device connection Device disconnection Device connection permission Device connection suppression
Type Y Y Y Y
Execution date/time Y Y Y Y
Device type Y Y Y Y
Drive type Y Y Y N
Drive letter Y Y Y N
Friendly name Y Y Y Y
Device instance ID by type Y Y Y Y
Device instance ID of controller Y Y Y Y
Permission condition N N Y N
User name Y Y Y Y

Legend:
Y: Collected
N: Not collected

Notes on collecting the device operation log

(7) Data collected in a file operation log

A file operation event occurs when one of the operations listed below is performed on a file or folder. For details about the information to be collected, see 6.5.3 Items displayed in an operation log in the manual Administrator's Guide Volume 1.

Data collected in a file operation log differs depending on the operation that is performed. The following types of data are collected.

Table 2-30 Data collected in a file operation log

Operation Time Type Logon user Drive type File name Drive type after change File name after change Program name Account
Copying Y Y Y Y Y Y Y Y Y
Migration Y Y Y Y Y Y Y Y Y
Renaming Y Y Y Y Y -- Y Y Y
Deletion Y Y Y Y Y -- -- Y Y
Creation Y Y Y Y Y -- -- Y Y
File opening# Y Y Y Y Y -- -- Y Y

Legend:
Y: Collected.
--: Not collected.

#: If the OS of the client PC is one of the following, a log for file opening operation cannot be collected.
  • Windows 8
  • Windows Server 2012
  • Windows 7
  • Windows Server 2008
  • Windows Vista
(a) Notes on collecting file operation log data

Note the following when collecting file operation log data:

(b) Notes on collecting file operation log data from a client whose OS is Windows 8, Windows Server 2012, Windows 7, Windows Server 2008 or Windows Vista

When you collect file operation log data from a client whose OS is Windows 8, Windows Server 2012, Windows 7, Windows Server 2008 or Windows Vista, note the following points in addition to those described under (a):

Note the following points on each type of operation for which log data can be collected.

Notes on collecting copy operation log data

Notes on collecting move operation log data

Notes on collecting name change operation log data

Notes on collecting deletion operation log data

When you move a large number of files or folders, if you select Move and replace or Move, but keep both files during file replacement confirmation, file copy-and-deletion log data or file copy log data might be collected, instead of file move log data.

(8) Specifying the software operation history storage directory

Although a log's actual size is affected by the event data collected, operation logs tend to be large. Therefore, when you install JP1/Software Distribution Manager, you need to specify a drive with ample capacity for the directory that stores the operation history (software operation history storage directory).

When the size of the operation history stored in the software operation history storage directory exceeds a specified value, you can also save the operation history in another directory (operation history backup directory).

The drive containing the software operation history storage directory and operation history backup directory can be a local drive (including a shared disk in a cluster environment), but can also be a network drive, such as Windows Powered NAS. We recommend that you specify a local drive with ample capacity for the software operation history storage directory, which is frequently accessed, and a network drive for the operation history backup directory, which is accessed less frequently.

However, to specify a network drive, you need an environment in which a single piece of authentication information can be used to connect to the network drive. Provide authentication information (user ID and password) that has all of the following permissions:

We also recommend that, for the network drive, you specify a drive in the same domain or workgroup as the machine on which JP1/Software Distribution Manager is installed. If you specify any other drive, authentication might take a long time.