Operation logs are classified into software operation logs and file operation logs depending on the operation target. Which type of operation log should be collected depends on the monitoring target event.

Events for which software operation logs are collected

• Start process
• Stop process
• Change caption
• Change active window
• Start/Stop of machine
• Logons/Logoffs

Events for which file operation logs are collected

• File operations

The items displayed in an operation log in the Software Operation Information window are different for a software operation log and a file operation log.

The table below shows the items displayed in a software operation log and a file operation log. These items are displayed with a comma (,) as a delimiter. Nothing is displayed if no value is available for an item.

Table 6-3 Items displayed in operation logs

Item	Software operation log	File operation log
Time	Time at which the event to be captured in the operation log occurred YYYY/MM/DD hh:mm:ss format	Time at which the event to be captured in the operation log occurred YYYY/MM/DD hh:mm:ss format
Type	Type of event that occurred	Type of operation in which the event occurred
Logon user	Logon user name at the computer where the event occurred#	Logon user name at the computer where the event occurred
Drive type	--	Drive type at the operation source. One of the following is displayed: Local disk (local HDD, USB-HDD, etc.) Network drive (UNC path, network drive, etc.) Removable (FD, USB memory, etc.) CDROM RAMDISK Other (drive information collection error, etc.)
File name	--	Full path of the file or folder before the operation took place
Drive type (after change)	--	Operation destination drive type Local disk (local HDD, USB-HDD, etc.) Network drive (UNC path, network drive, etc.) Removable (FD, USB memory, etc.) CDROM RAMDISK Other (drive information collection error, etc.)
File name (after change)	--	Full path of the file or folder after the operation took place
Window title	Window caption when the event occurred	--
Program name	Full path of the file name or formal file name of the program in which the event occurred	Process name that executed the operation Explorer.exe if the operation was executed from a Windows common dialog box. Explorer.exe is also displayed when the OS is Windows 8, Windows Server 2012, Windows 7, Windows Server 2008 or Windows Vista and the file was manipulated by an application or from a command prompt.
File version	File version of the program in which the event occurred	--
Account	Account that executed the program in which the event occurred	Account that executed the program in which the event occurred

Legend:

--: Item that is not displayed

#

In a virtual environment, the information to be displayed varies for the following events:

• Start process and Stop process
  The information to be displayed depends on the software's startup method and the OS:
  
  • If the user started the process
    Name of the user who started the software
    
  • If the software was started from a service
    If the OS is Windows Server 2003 and a user is logged on at the local console, name of the user logged on at the local console; otherwise, Service
    
• Change caption, Change active window, Logons/Logoffs, and File operations
  Logon user name for the session in which the event occurred
  
• Start/Stop of machine
  The logon user is not displayed.
  

The operation log display format is shown in the following figure.

Figure 6-32 Operation log display format