Job Management Partner 1/Asset Information Manager Administrator's Guide
You can trace the flow of file operations performed by a user. You can also trace operations performed from another device connected via a network, such as copying or deleting a file.
You trace user operations from the File Operation Trace dialog box, which you display by clicking a link under File name in the search results of the Operation Log List job menu, the Operation Log Details dialog box, or the Operation Log Total - Logs List dialog box.
The following figure shows the File Operation Trace dialog box.
Figure 2-91 File Operation Trace dialog box
A single operation log is displayed as a single node ().
The node of the selected operation log (base node) is framed with a bold line. The other nodes are operation nodes linked to the base node. A node that might be involved in an invalid operation, such as copying a file to media, is displayed in color.
The following explains the node icons and displayed items.
- : Back trace icon
- Displays operations prior to the corresponding node. This allows you to see operations that were performed on a file prior to the operation indicated in a displayed node. The number of levels that can be displayed at one time is set with Hierarchy levels to display when tracing in the Server Setup dialog box.
- : Forward trace icon
- Displays operations subsequent to the corresponding node. This allows you to see operations that were performed on a file subsequent to the operation indicated in a displayed node. The number of levels that can be displayed at one time is set with Hierarchy levels to display when tracing in the Server Setup dialog box.
- : Operation log details icon
- Displays the Operation Log Details dialog box for the corresponding node. The Operation Log Details dialog box displays operation logs of five minutes before and after the node of interest. By clicking a link of a displayed operation log under File name, you can trace another set of operations.
- : Retrace icon
- Displays the File Operation Trace dialog box with the corresponding node as the base node, and traces another set of operations.
- : Network icon
- Displays a list of networked devices from which operations on the file indicated in the corresponding node might have been performed. From this list of devices, you can display the File Operation Trace dialog box for another device, and continue to trace operations further. For details about how to trace operations performed from another device, see (2) Tracing operations performed from another device, below.
- : Close icon
- Closes the corresponding node. To redisplay a node that has been closed, click the back trace icon or the forward trace icon of the node directly above a branch node.
- Date/time
- Displays the date and time the operation indicated in the corresponding node was executed.
- Type
- Displays the type of the corresponding node. The types displayed for nodes correspond to the types of operation logs acquired by JP1/Software Distribution. Note that a name displayed for the node type is different except for the base node. For details about these mappings, see (3) Correspondence between node types and operation log types, below.
- For Copied, Moved, and Renamed nodes, nodes indicating the operations before and after the node are displayed. If you trace an earlier operation, the node indicating the file name prior to the operation is displayed. If you trace a subsequent operation, the node indicting the file name subsequent to the operation is displayed.
- Drive type
- A drive type is displayed for operations whose destination is recorded as Network, Removable, or CD ROM. If you click a file name link, a drive type is also displayed for operations whose destination is recorded as Local, RAM Disk, or Other media.
- User name
- This is the user name entered to log onto Windows. This is displayed only when you have clicked the file name link to display a detailed view.
- Host name
- This is the host name of the corresponding node. This is displayed only when you have clicked the file name link to display a detailed view.
- File name
- This is the file name of the corresponding node. Click the file name link to display details associated with the corresponding node, which includes the type, the user name entered to log onto Windows, and the full path name of the file.
- Branch nodes
- Branch nodes are displayed when operations occur at the same date and time, or when a copy operation is performed. Note that a node indicating an operation performed at the same date and time as another might instead contain the other log.
By placing the cursor over a node, you can view the date, time, and full path name of the file in the pop-up that is displayed.
The following types of nodes are highlighted in color. The text in the parentheses indicates the node type.
- An operation node earlier than the base node that records deletion of a file (Deleted)
- An operation node earlier than the base node that records copying, moving, or renaming of a file (Copied, Moved, or Renamed)
The node following any of these nodes is highlighted in color if it indicates an operation whose destination is recorded as Network, Removable, or CD ROM.
- An operation node later than the base node that records creation of a file (Created)
- An operation node later than the base node that indicates an operation whose destination is recorded as Network, Removable, or CD ROM.
To print the trace image displayed in the File Operation Trace dialog box, from the menu bar click File, and then choose Print.
- Notes:
- The new name for the file might not be displayed in a Copied, Moved, or Renamed node. In this case, use the branch node that displays the new name for the file to continue tracing operations on that file.
- No Moved or Renamed node is displayed if only the letter case of the file name was changed.
- If you trace operations prior to the base node when there is a Copied operation log that occurs at the same date and time as an Opened, Created, or Deleted operation log, the Copied node is not displayed. In this case, use the Copied node as the base node, which allows you to display and trace the other operation nodes as well.
Note that the nodes displayed in the File Operation Trace dialog box are based on the operation logs stored in the JP1/Software Distribution database. This means that nodes of operation logs that are stored only in backup files are not displayed.
- Organization of this subsection
- (1) Tracing operations performed on a device
- (2) Tracing operations performed from another device
- (3) Correspondence between node types and operation log types
(1) Tracing operations performed on a device
The File Operation Trace dialog box displays the flow of operations performed on a device.
This subsection uses an example in which the name of a file that contains confidential information (EmployeeList.xls) is changed to a name that disguises this fact (ExplanatoryNote.xls), and the file is then copied to external media. The following figure shows the File Operation Trace dialog box in this case.
Figure 2-92 File Operation Trace dialog box (example of tracing the copying of a confidential file to external media)
The following explains the operations that can be checked at each node. The numbers 1 through 5 in the figure correspond to the numbers in the explanation below.
- The file EmployeeList.xls is copied from a file server to a local desktop.
This is the base node. In this node, you can see the name of the file before and after it was copied.
- The file name EmployeeList.xls is changed to ExplanatoryNote.xls.
In this node, you can see the name of the file after it was changed. That is, you can see that the file name was changed from EmployeeList.xls to ExplanatoryNote.xls.
- ExplanatoryNote.xls is copied to a USB memory device.
In this node, you can see that the file on the desktop was copied to a USB memory device.
- The ExplanatoryNote.xls file on the desktop is opened.
You can continue to trace the operations performed on the copy source file. In this node, you can see that the file on the desktop was opened.
- The ExplanatoryNote.xls file on the desktop is deleted.
In this node, you can see that the copy source file on the desktop was deleted.
If the possibility exists that operations have been performed on the file in question from another device, you can use the network icon to trace these operations. For details about how to trace operations performed from another device, see (2) Tracing operations performed from another device, below.
(2) Tracing operations performed from another device
Click the network icon in the File Operation Trace dialog box to display a list of devices from which operations on the corresponding file can be performed.
In the list of devices, by clicking the file name link associated with the device for which you want to trace operations, you can display the File Operation Trace dialog box for that device, and continue tracing operations.
When you trace operations performed over the network from another device, use Settings for trace time range in the Server Setup dialog box to set the time range over which operations are treated as having occurred at the same time.
The following figure shows the operation flow to display the File Operation Trace dialog box for tracing operations performed over the network from another device.
Figure 2-93 Operation flow for displaying the File Operation Trace dialog box
The node that is displayed to the left of the base node is the original node.
(3) Correspondence between node types and operation log types
The table below shows the correspondence between the type displayed for each node and the type of operation log output by JP1/Software Distribution. The JP1/Software Distribution operation log type is displayed in the details for each node.
Table 2-7 Correspondence between node types and operation log types
Node type |
JP1/Software Distribution operation log type |
Copied |
Copy file |
Moved |
Move file |
Renamed |
Rename file |
Deleted |
Delete file |
Created |
Create file |
Opened |
Open file |
All Rights Reserved. Copyright (C) 2009, 2011, Hitachi, Ltd.