security related logs and monitoring

JuanD

Hello,

We are doing an audit of the misuse of TeamViewer of one of our employees. 

We need the official statement of the TeamViewer support team of the meaning and use of the following logs:

Incomming_Connections.log

Connections.txt

TeamViewer12_logfile_old.log

TeamViewer12_logfile.log

The time that the logs display rae utc, gmt, or he computer time when the connection was made?

This is to help us completing the report to refer the case to HR.

Thank yu for your help.

JuanD

Julia

Hi JuanD,

Thank you for the question.

connections_incoming.txt - You can find the IDs of all incoming connections for the machine in this file.

connections.txt - This file is for all outgoing connections from the machine - you can also see the ID to which you connected.

TeamViewer12_logfile.log - This file is very important, especially when we need to make an internal analyse to troubleshoot problems with TeamViewer. You can find outgoing and incoming connections in this file.

TeamViewer12_logfile_old.log - If the logfile is too big, TeamViewer automatically transfer the old data into this logfile.

The times in the connections.txt and in the connections_incoming.txt is always UTC.

The time in the logfiles is the local time from the computer.

The files are only available on the local computer and not on our side - this is the reason why we asked for logfiles if we have to troubleshoot a TeamViewer problem. The files will only be created when you activate the logging in TeamViewer under "Extras - Options - Advanced".

If you have more questions regarding this do not hesitate to ask

Julia

Hi JuanD,

If you have a computer with ID "1" and someone connects from ID "2" you will see "2's" ID in the connections_incoming.txt an the computer with ID "1"

You can also see the outgoing connection from "2's" ID to ID "1" in the local connections.txt file from ID "2"

If the logging is activated

Julia

Hi JuanD,

Thank you for the question.

connections_incoming.txt - You can find the IDs of all incoming connections for the machine in this file.

connections.txt - This file is for all outgoing connections from the machine - you can also see the ID to which you connected.

TeamViewer12_logfile.log - This file is very important, especially when we need to make an internal analyse to troubleshoot problems with TeamViewer. You can find outgoing and incoming connections in this file.

TeamViewer12_logfile_old.log - If the logfile is too big, TeamViewer automatically transfer the old data into this logfile.

The times in the connections.txt and in the connections_incoming.txt is always UTC.

The time in the logfiles is the local time from the computer.

The files are only available on the local computer and not on our side - this is the reason why we asked for logfiles if we have to troubleshoot a TeamViewer problem. The files will only be created when you activate the logging in TeamViewer under "Extras - Options - Advanced".

If you have more questions regarding this do not hesitate to ask

JuanD

Hello Julia,

Thank you for your explanation.

Another question: The connections_incoming log, is when the user connected from a external computer to the local computer or this log capture the id no matter if the connection was from the local to an external computer and viceversa?

Thanks

JuanD

Julia

Hi JuanD,

If you have a computer with ID "1" and someone connects from ID "2" you will see "2's" ID in the connections_incoming.txt an the computer with ID "1"

You can also see the outgoing connection from "2's" ID to ID "1" in the local connections.txt file from ID "2"

If the logging is activated

JuanD

Hi Julia,

Thank you again for the explanation. 

Unfortunately we had to suspend the employee until investigation is complete, and this information was a must to continue our investigation. 

Thank you again.

JuanD

daisydaisydaisy

 

[logs data removed]

 

MrFluffy94

Hey Julia, One of my friends was scammed for a large amount of money through her pc. She's not overly tech savvy so I managed to get the incoming connections txt file. She has unfortunately uninstalled the program but I do still have this txt file which I hope you are able to use to track down the individual. If you're able to get me some details regarding this user, that would be great so I can refer that to the Australian Federal Police. Thanks for your time

SBSP

Hi Julia,

I have a question in a similar topic. I suspect that someone accessed my laptop and want to find it out from the log files, however in the Connections_incoming text file I can see only records from 2016. 

So I thought I check the TeamViewer12_Logfile, but it contains so many records I don't know what to look for. 

Could you please help what records showing the incoming connections and how to find out if file transfer happened or not?

Thank you in advance.

Kind regards,

Roland

Julia

Hi SBSP,

If you think that someone had access to your computer please write a mail to

privacy@teamviewer.com

SBSP

Hi Julia,

Thanks for your reply, however I would prefer to understand and be able to read the logs of TeamViewer, therefore I would highly appreciate if you could give me some hints how to find out from the logs if there has been a breach or not.

Thank you for understanding.

Kind regards,

Roland

Julia

Hi Roland,

The logfiles exist because we (Support) and our development need them to understand unexpected behaviors and general TeamViewer issue. 

If you want to look for connections, please have a look at the connection files I mentioned earlier. If you still have doubts about incoming our outgoing connections, you can contact us on privacy@teamviewer.com

serfer2

Hi Julia,

good explanation. By the way, I'm trying to open TeamViewer12_logfile_old.log with a regular text editor and unreadable text is shown. 
Is this file plain text or need to be converted to be readed?

Thanks ;-)

Julia

Hi serfer2,

What do you mean with unreadable text? Normally it should be able to read the logs with the editor. Do you want to look for a specific entry?

serfer2

Hi,

the file was recovered with a data recovery program. I think this is why it is unreadable.

Thanks ;-)

ory1dj

is it possible that someone connected with me can delete the log of my pc for transferring files? so that I can never realize it?

Craftendo64

I have a problem with the files...  

In my Teamviewer I see TeamViewer12_logfile.log and TeamViewer13_logfile.log as well, but I don't see at all "Incomming_Connections.log" and "Connections.txt", here is my folder :

http://prntscr.com/lg8vpg

http://prntscr.com/lg8vyq

Si it should be at the top of the folder since it's alphabetical order but there's nothing of these 2 files....    How can I have the files I don't have ?

Thanks in advance 

gbanta

Is it possible for an intruder to delete Teamviewer logs and leave no trace?

fizzlifax

Hi,

does the logfiles, especially Teamviewer12_Logfile.log contains any personal data what could be in fraude of the new DSGVO? Or does it contains only technical informations for the running of teamviewer what will not decover any personal informations of the users?

Are there maximal two Teamviewer12_Logfile.log und Teamviewer12_Logfile_OLDl.log?

Please confirm what this logfile is for!

Thanks a lot in advance!

Hallo,

enthält die Teamviewer12_Logfile.log irgendwelche Daten, welche gegen die Bestimmungen zum Personenschutz der neuen DSGVO verstoßen würden? - Wenn ja welche?

Oder enthält diese Datei lediglich technische Informationen zur Funktion von Teamviewer, welche keine Rückschlüsse auf die betroffenen Personen zulassen?

Gibt es nur maximal zwei Teamviewer12_Logfile.log und Teamviewer12_Logfile_OLDl.log?

Bitte bestätigen, was Sache ist!

Vielen Dank  im Voraus!

Fi