Using a search pattern to check operation logs

You can retrieve operation logs by using a search pattern in which operation log search conditions are pre-registered. Using search patterns saves time because you do not need to specify search conditions for each search.

You set a search pattern from the following location in the Operation Log List window:

Figure 6-35 Area for specifying a search pattern name in the Operation Log List window

[Figure]

Search pattern: Select the desired search pattern from among the registered search patterns. For details about the search patterns that are provided as the default, see (1) Default search patterns.

Apply button: When this button is clicked, the selected search pattern is reflected in the search condition.

Save button: When this button is clicked, the search pattern is registered or updated using the search pattern name displayed in the combo box. For details about how to register or update search patterns, see (2) Registering and updating search patterns.

Delete button: When this button is clicked, the search patterns displayed in the combo box are deleted. For details about how to delete search patterns, see (3) Deleting search patterns.

The procedure for retrieving operation logs by using a search pattern is described below, using as an example a case in which operation logs for file copying are retrieved.

Select Copy detections in Search pattern.
Copy detections is one of the default search patterns provided. For details about other default search patterns provided, see (1) Default search patterns. Modify the search conditions as needed.
To reset the condition to its initial state, click the Clear button.
Click the Apply button.
The search pattern is reflected in the search condition. The following search conditions are set in the search pattern File copying:
- Logs to display: File operations
- Type: Copied
- Drive type: All
For details about the operation logs that can be set in Logs to display, see 6.6.2(2) Specifying items in Logs to display.
Because there is a risk that a massive volume of search results may be displayed, check the search condition before executing a search operation.
Click the Search button.
Operation logs that match the search condition are displayed.
A maximum of 5,000 operation logs can be displayed as search results.
If you modified the set conditions in the search pattern in step 1, you can also register it as a new search pattern. For the procedure for registering search patterns, see (2) Registering and updating search patterns.

Organization of this subsection: (1) Default search patterns; (2) Registering and updating search patterns; (3) Deleting search patterns

(1) Default search patterns

The following table lists and describes the provided default search patterns and the logs that are displayed.

Table 6-6 Explanation of search patterns selected by default and the displayed logs

Search pattern	Explanation	Logs to display
Site inspections	Searches for the window titles of the sites users visited.	Window tile change log
Copy detections	Searches for folder or file copies.	File operation log
Program start preventions	Searches for program start preventions.	Start program
Output of all logs	Searches for all operation logs.	Start program Window title change log File operation log PC startup log Web access log External media log
Output of all program start logs	Searches for program startup, stop, and suppression.	Start program
Output of all window title change logs	Searches for window title changes.	Window title change log
Output of all file operation logs	Searches for user operations on folders or files.	File operation log
Web access logs	Searches for titles or URLs of accessed Web pages.	Web access log
Print logs	Searches for print operations.	File operation log
External media logs	Searches for connections to or disconnections from external media and operations for which connection to external media was permitted or prohibited.	External media log
Output of all PC startup logs	Searches for PC startup, stop, logon, and logoff.	PC startup log

(2) Registering and updating search patterns

To register and update a search pattern, follow the procedure described below. You can register as many search patterns as you like.

To register and update a search pattern:

Specify search conditions.
Specify search conditions according to the purpose. Specify appropriate search conditions to prevent a massive volume of search results from being output.
When updating a pre-registered search pattern, selecting that pattern and clicking the Apply button sets the search conditions. Then, you can modify these search conditions.
Enter a search pattern name in Search pattern.
Specify a search pattern name as 1 to 64 bytes of alphanumeric characters and symbols. When updating a search pattern, make sure that the search pattern name to be used after the update is entered.
Click the Save button.
A dialog box for confirming registration or updating opens.
Click the OK button.
The search pattern is saved with the specified search conditions.
If a search pattern name is not already registered, a new search pattern is registered. If a pre-registered search pattern name is specified, the existing search pattern is updated with the specified search conditions.
When you click the OK button, an error occurs if another user is trying to register a search pattern under the same name. In this case, save your search pattern under a different name.

Note: When you update JP1/Software Distribution Manager's Asset Information Manager Subset component, the default search patterns are overwritten. If necessary, first save the search patterns under different names.

(3) Deleting search patterns

All Rights Reserved. Copyright (C) 2009, 2013, Hitachi, Ltd.
Copyright, patent, trademark, and other intellectual property rights related to the "TMEng.dll" file are owned exclusively by Trend Micro Incorporated.

6.6.3 Using a search pattern to check operation logs

(1) Default search patterns

(2) Registering and updating search patterns

(3) Deleting search patterns