You can use the operation flow to check how a user used a file. Also, if a user copied a file to a different device on the network or deleted a file, you can trace the details of such an operation.

User operations can be traced from the search results in the Operation Log List window or the File Operation Trace window that is displayed by clicking the anchor of the file name in the Operation Log Total - Logs List window.

The File Operation Trace window is shown in the following figure.

Figure 6-36 File Operation Trace window

A single operation log is displayed as a single node ().

The node (base node) for the selected operation log is displayed in a heavy frame. Other nodes are for continuous operations from the base node.

A node that is likely to indicate an invalid operation, such as printing a file or copying to media, is indicated by a distinctive color. Operations that are performed on the same date and at the same time, as well as copy operations, are indicated by branching. Note that nodes for operations performed on the same date and at the same time may include other logs. The icons and node display items are explained below.

: Back trace icon

Displays operations prior to the corresponding node. This allows you to see operations that were performed on a file prior to the operation indicated in a displayed node. You can use Hierarchy levels to display when tracing in the Asset Information Manager Subset's Server Setup dialog box to set the number of levels that are to be displayed at the same time when the back trace icon is selected.

: Forward trace icon

Displays operations subsequent to the corresponding node. This allows you to see operations that were performed on a file subsequent to the operation indicated in a displayed node. You can use Hierarchy levels to display when tracing in the Asset Information Manager Subset's Server Setup dialog box to set the number of levels that are to be displayed at the same time when the forward trace icon is selected.

: Operation log details icon

Displays the Operation Log Details dialog box for the node. This dialog box shows the operation log for the preceding and following five minutes. You can use the file name anchor for the displayed operation log to trace other operations.

: Retrace icon

Displays the File Operation Trace window, which uses the node as the base node and can also be used to trace other operations.

: Network icon

Displays a list of devices on the network, which may have been used to operate the node's file. You can use the list of devices to display a File Operation Trace window for other listed devices, so that you can then perform additional trace operations. For details about how to trace the operation of other devices, see (2) Tracing the operation of other devices.

: Close icon

Closes the node. To redisplay a node you have closed, click the back trace icon or forward trace icon of the node immediately before branching.

Date/time

Displays the date and time at which operation of the node was executed.

Type

Displays the node's type. The type displayed for a node corresponds to the type of operation log collected by each linked product. Note that except for the base node, different names are displayed for the node types. For details about the respective correspondences, see (3) Correspondence between node type and operation log type.

In the case of a Copied, Moved, or Renamed node, the nodes before and after the operation are displayed. When you trace a past operation, the node for the file before the operation is displayed. When you trace a subsequent operation, the node for the file following the operation is displayed.

Drive type

Displayed when Network, Removable, or CD ROM is being operated. When you click a file name, the drive type is displayed even when Local, RAM Disk, or Other media is being operated.

User name

The user name used by the user to log onto Windows. This item is displayed only when you click a file name to display details.

Host name

The host name of the node. This item is displayed only when you click a file name to display details.

File name

Displays details such as the node type, the user name used to log in to Windows, and the file's full path.

Placing the mouse cursor on a node pops up a menu from which you can browse the date/time and the file's full path.

The following nodes are displayed in color (the node type is indicated in parentheses):

• Node prior to the base node on which a file deletion operation occurred (Deleted)
• Node prior to the base node on which a file copy, file move, or file renaming operation occurred (Copied, Moved, or Renamed)
  If there is a Network, Removable, or CD ROM operation subsequent to a node, it is displayed in color.
  
• Node subsequent to the base node on which a file creation operation occurred (Created)
• Node subsequent to the base node on which a Network, Removable, or CD ROM operation occurred

To print a trace image displayed in the File Operation Trace window, choose from the menu bar File and then Print. You can also specify the window size.

Notes

• Even for the same operation nodes, whether the domain name is included in the host name depends on the product used to collect the operation logs.
• For a Copied, Moved, or Renamed node, the file name after the change may not be displayed. In this case, trace the node displaying the file name that was branched and changed.
• A Moved or Renamed node is not displayed if the only modification was to change the case of the file name (from upper to lower case and vice versa).
• If there is a Copied operation log for the same date and time as an Opened, Created, or Deleted operation log, and you attempt to trace back based on the Opened, Created, or Deleted operation, the Copied node is not displayed. In this case, if you trace the operation based on the Copied operation, other operation nodes are displayed and you can trace them.
• If the client's OS is Windows 8, Windows Server 2012, Windows 7, Windows Server 2008 or Windows Vista, and a folder was overwritten as a result of folder renaming, the operation log of file moves output by this operation cannot be traced.
• The operation log acquired from a client whose OS is Windows 8, Windows Server 2012, Windows 7, Windows Server 2008 or Windows Vista may not be traced if a file or folder name in the operation log for Copied or Moved contains (n)(n: any number).

Nodes displayed in the File Operation Trace window are based on operation logs stored in the JP1/Software Distribution database. For this reason, nodes that correspond to operation logs stored in a backup file are not displayed.

Organization of this subsection

(1) Trace operation for a device

(2) Tracing the operation of other devices

(3) Correspondence between node type and operation log type