You can retrieve operation logs by specifying a search condition. Depending on the search condition content, a massive volume of search results may be displayed. Therefore, specify an appropriate search condition to narrow the target information.

You can also retrieve operation logs by using a search pattern that has been created in advance. For details about how to use a search pattern for retrieving operation logs, see 6.6.3 Using a search pattern to check operation logs.

To retrieve operation logs:

1. Specify a search condition.
   In Logs to display, select the check box for the operation logs to be retrieved. For details about how to specify items in Logs to display, see (2) Specifying items in Logs to display.
   To reset the condition to its initial state, click the Clear button.
   
2. Click the Search button.
   Operation logs that match the search condition are displayed. The default is that a maximum of 5000 operation log items are displayed in the search results.
   You can also register the condition you specified in step 1 as a search pattern. For details about how to register search patterns, see 6.6.3(2) Registering and updating search patterns.
   

You can trace user operations from the File Operation Trace dialog box, which you display by clicking a File name link. For details about how to trace user operations, see 6.6.4 Tracing operation logs.

In Logs to display, select the check boxes for the operation log information to be displayed, and specify conditions for the displayed search items. The following table shows the check boxes that correspond to the operation log information that can be displayed for checking purposes.

Table 6-4 Check boxes corresponding to operation log information to be displayed for checking

Operation log information	Corresponding check box
Dates/times of start, stop, or suppression of programs used	Program start log
Changes made to window titles	Window title change log
Start, stop, logon, or log-off operations for PCs	PC startup log
Titles or URLs of accessed Web pages	Web access log
Connections to or disconnections from external media Operations for which connections to external media were permitted or prohibited	External media log

The following describes how to specify Logs to display:

• Make sure that you select the appropriate Type check boxes regardless of the type of operation log to be displayed for checking.
• If you specify a path name in File name and select match beginning of the words, the folders and files under the specified path are retrieved.
  For example, if you specify C:\ABC\, the folders and files under the C:\ABC\ path are retrieved. If you specify C:\ABC, the folders and files under paths such as C:\ABCD and C:\ABCE are also retrieved in addition to those under the C:\ABC\ path.
  

The following notes apply to searching JP1/Software Distribution file operation logs when File operation log is selected in Logs to display:

• If Created, Opened, Deleted, Copied, or Renamed/Moved is specified in Type, the search conditions that can be specified together are File name, Drive type, Program name, and Login user.
• If Printed, Printing suppression, or Print suppression released is specified in Type, the search conditions that can be specified together are Login user and Document name.
• If at least one of Created, Opened, Deleted, Copied, and Renamed/Moved is specified in Type, and at least one of Printed, Printing suppression, and Print suppression released is specified, the search conditions that can be specified together are Drive type and Login user.
• If a value is specified in both File name (or Program name) and Document name in the search condition, the search result will be 0 (no hits).

Type, which must be specified when File operation log is selected in the Logs to display search condition, may be applicable to multiple types.

The following table shows the correspondence between file operation Type in File operation log and operation log types.

Table 6-5 Types of operation logs corresponding to Type

Type item	JP1/Software Distribution operation log type
Created	File created Folder created
Opened	File opened
Deleted	File deleted Folder deletion
Copied	File copied Folder copied
Renamed/Moved	File moved Folder moved File renamed Folder renamed
Printed	Printed
Printing suppression	Print suppressed
Print suppression released	Print suppression released (the result is either Successful or Failed)

Clicking the time for a search result opens the Operation Log Details window. In this window, you can check the operation logs for each host within the specified time.

The Operation Log Details window is shown below.

Figure 6-34 Operation Log Details window

When you enter values in Display start and Display end to specify the period (in minutes) for which you wish to check the operation logs and click the Refresh button, you can check all types of operation logs collected within the specified timeframe, starting with the reference log collected at the selected time. The reference log is displayed with a purple frame. You can specify between 0 and 30 minutes for the time. In the default, the logs collected during the 5 minutes before and after the specified operation log are displayed.

You can export a list of search results to a CSV file. When you specify the search condition for the operation logs to be exported to a CSV file and click the CSV button, the search results are exported to a CSV file.

The maximum number of operation logs that can be exported to a CSV file is 5,000, which is the same as the limit for the number of search results that can be collected. If there are more than 5,000 search results and you want to output all search results, execute the jamTakeOperationLog.bat command as a user with Administrator permissions. For details about executing the jamTakeOperationLog.bat command, see (6) Outputting all search results (jamTakeOperationLog.bat command).

In Microsoft SQL Server, you can also use the Microsoft SQL Server functions to output CSV files.

This section explains the jamTakeOperationLog.bat command, which exports the search results in the Operation Log List window to a CSV file. This command is stored in the JP1/Software Distribution Manager installation directory \jp1asset\exe.

Function

Exports the operation log search results that satisfy the specified search pattern to a CSV file. If the number of search results exceeds 5,000, all search results, including those not being displayed in the Operation Log List window, are exported.

Note that you can execute the jamTakeOperationLog.bat command periodically by registering it in Windows Scheduled Tasks. For details about the settings for registering the command in Scheduled Tasks, see (a) Settings for periodic execution of jamTakeOperationLog.bat.

Format

jamTakeOperationLog.bat     -p search-pattern-name
                            -f output-destination-file-name
                            -s collection-start-date
                            [-e collection-end-date]
                            [-x extended-output-item]

Arguments

• -p
  Specifies the search pattern name for which operation logs are collected. Specify a registered name. Use double quotation marks (") to enclose the search pattern name. If there is a double quotation mark in the search pattern name, it must be specified as two double quotation marks in succession. For example, you would specify the search pattern name Copy as "plain text" as -p "Copy as ""plain text""".
  
• -f
  Specifies a full path for the name of the CSV file to be output.
  
• -s
  Specifies the start date for collection of the operation log.
  You can use the formats shown below to specify the collection start date. Using -s Mx[MDy] or -s Dz is convenient when the task is to be executed periodically.
  -s yyyymmdd[hhmm] (yyyy is an integer in the range from 1900 to 9999)
  Specifies the actual date and time at which to start collection. If the time is omitted, 00:00:00 is set.
  -s Mx[MDy] (x is an integer in the range from 0 to 999; y is an integer in the range from 1 to 31)
  Specifies when collection of the operation log begins, in terms of an interval of time preceding the task execution date. You specify in x the number of months before the task execution date, and you specify in y the date within the indicated month. If the date is omitted, operation log collection begins on the first day of the month x months prior to the task execution date. For example, if the task is to be executed on October 1 and you wish to start collecting the operation log as of August 1, you could specify either -s M2MD or -s M2. Both of these specifications indicate the first day of the second month before October 1.
  -s Dz (z is an integer in the range from 0 to 999)
  Specifies when collection of the operation log begins, in terms of the number of days before the task execution date. For example, if the task is to be executed on October 1 and you wish to start collecting the operation log as of September 10, you would specify -s D21.
  
• -e
  Specifies the last date on which the operation log is collected. If this item is omitted, the operation log is collected until the date on which the task is executed. Using -e Mx[MDy] or -e Dz is convenient when the task is to be executed periodically.
  You can use the formats shown below to specify the collection end day.
  -e yyyymmdd[hhmm] (yyyy is an integer in the range from 1900 to 9999)
  Specifies the date and time at which collection of the operation log ends. If the time is omitted, 23:59:59 is set.
  -e Mx[MDy] (x is an integer in the range from 0 to 999; y is an integer in the range from 1 to 31)
  Specifies when collection of the operation log ends, in terms of an interval of time preceding the task execution date. You specify in x the number of months before the task execution date, and you specify in y the date within the indicated month. If the date is omitted, the operation log is collected through the last day of the month x months prior to the task execution date. For example, if the task is to be executed on October 1 and you wish to collect the operation log through September 30, you could specify either -e M1MD30 or -e M1. Both of these specifications indicate the 30th day of the first month before October 1.
  -e Dz (z is an integer in the range 0 to 999)
  Specifies when collection of the operation log ends, in terms of the number of days before the task execution date. For example, if the task is to be executed on October 1 and you wish to collect the operation log through September 20, you would specify -e D11.
  
• -x
  Specifies the item to be output. You can specify the group name, user name, or location of the asset information (AssetInfo) that is assigned from Host name in operation logs. This option can be omitted.
  Specify an extended output item in the format -x extended-output-item-code. You can specify multiple extended output item codes.
  The extended output item codes are as follows:
  G: Group name
  U: User name
  L: Location
  To specify multiple codes, enter the desired codes consecutively, such as -x GUL.
  If there are multiple identical host names in operation logs, Group name, User name, and Location of the first asset information that was assigned are output.
  

Return codes

The following table shows the return codes that are returned when the jamTakeOperationLog.bat command is executed.

Code	Explanation
0	Terminated normally.
2	An invalid value is specified for a command argument.
3	No applicable search pattern was found.
4	An error occurred in the connection to the JP1/Software Distribution database.
6	An error occurred in the connection to the JP1/Software Distribution database.
7	An invalid environment
8	A DLL load error occurred.
9	An error occurred during operation log exporting.
10	An error occurred during registry information collection.
11	An error occurred in the Asset Information Manager Subset database processing.

If the return code is in the range from 4 to 9, check ASTMESn.LOG. If the return code is in the range from 4 to 6, a database connection error has occurred, and you should check ASTCIMn.LOG. Each log file is output to the installation folder \jp1asset\log of JP1/Software Distribution Manager.

(a) Settings for periodic execution of jamTakeOperationLog.bat

To execute jamTakeOperationLog.bat periodically, register into Windows Scheduled Tasks a task that executes jamTakeOperationLog.bat. When you register this task, you must use the following format to specify the file name of the task in the Run text box under the Task tab of the Scheduled Tasks's Properties dialog box. This is so that the command prompt directly understands the executable format of jamTakeOperationLog.bat.

%COMSPEC% /D /S /C "executable-format-of-jamTakeOperationLog.bat"

Specify executable-format-of-jamTakeOperationLog.bat in the same way as when you normally execute a command. Always enclose it in double quotation marks (").

An example of the name of the file to be executed

%COMSPEC% /D /S /C ""C:\Program Files\HITACHI\NETMDM\jp1asset\exe\jamTakeOperationLog.bat" -p "file-copied-to-external-media" -f c:\temp\OperationLog.csv -s M3 -e D1 -x GU"

After registration, %COMSPEC% is replaced with the CMD.EXE execution path.