Auditability / Event Log - TeamViewer Support
<main> <article class="userContent"> <p>The Auditability feature provides you with information necessary for your audits and protects your business against abusive claims by showing the track of activities.</p><div class="blockquote"><div class="blockquote-content"><p class="blockquote-line"><em>This article applies to all TeamViewer customers with a Tensor </em><a href="https://www.teamviewer.com/en/pricing/" rel="nofollow noreferrer ugc"><em>license</em></a>, using <em>TeamViewer version 14.1 or higher and running Windows, Mac, and Linux.</em></p></div></div><p><br></p><h3></h3><h2 data-id="how-to-activate-event-logs">How to activate event logs</h2><p>By default, event logging is not activated for your company, as you should get general consent within your company about the collection and usage of the data.</p><p>Activating event logging can only be done as a company admin.</p><p>To activate event logging, please follow the instructions below:</p><ol><li>Open the Management Console: <a href="https://login.teamviewer.com/" rel="nofollow noreferrer ugc">https://login.teamviewer.com/</a></li><li>Navigate to <strong>Company administration</strong>,<strong> </strong>and click on<strong> Advanced.</strong></li><li><strong>Enable </strong>the <strong>Event logging </strong>toggle and click <strong>Save</strong>.</li></ol><p>Now certain activities of all users that belong to your company will be logged.</p><div class="embedExternal embedImage display-medium float-none"> <div class="embedExternal-content"> <a class="embedImage-link" href="https://us.v-cdn.net/6032394/uploads/CR9N2OI829V6/image.png" rel="nofollow noreferrer noopener ugc" target="_blank"> <img class="embedImage-img" src="https://us.v-cdn.net/6032394/uploads/CR9N2OI829V6/image.png" alt="image.png" height="767" width="1123" loading="lazy" data-display-size="medium" data-float="none"></img></a> </div> </div> <p><br></p><h3 data-id="-1"></h3><h2 data-id="how-to-grant-access-to-event-logs">How to grant access to event logs</h2><p>You need access to the <strong>Event Log</strong> dialog in the Management Console to access the event logs. Your company admin can grant you access to this page.</p><div class="embedExternal embedImage display-medium float-none"> <div class="embedExternal-content"> <a class="embedImage-link" href="https://us.v-cdn.net/6032394/uploads/DT0SUZ2PPKAE/image.png" rel="nofollow noreferrer noopener ugc" target="_blank"> <img class="embedImage-img" src="https://us.v-cdn.net/6032394/uploads/DT0SUZ2PPKAE/image.png" alt="image.png" height="908" width="1334" loading="lazy" data-display-size="medium" data-float="none"></img></a> </div> </div> <p><strong>💡Info: </strong>Granting access to event logs only works with the 4-eye-principle. You need another company admin granting you access.</p><p><br></p><h3 data-id="-2"></h3><h2 data-id="how-to-watch-and-filter-event-logs">How to watch and filter event logs</h2><p>When you have access to the event logs of your company, navigate to → "Event logs" in the left navigation panel of the Management Console.</p><p>If event logging is active for your company, you will see the following screen:</p><div class="embedExternal embedImage display-medium float-none"> <div class="embedExternal-content"> <a class="embedImage-link" href="https://us.v-cdn.net/6032394/uploads/9LWEFVX3BGSS/image.png" rel="nofollow noreferrer noopener ugc" target="_blank"> <img class="embedImage-img" src="https://us.v-cdn.net/6032394/uploads/9LWEFVX3BGSS/image.png" alt="image.png" height="385" width="715" loading="lazy" data-display-size="medium" data-float="none"></img></a> </div> </div> <p>You can now start to search for specific events by using the given filter possibilities:</p><ol><li>Date range: use this filter to search for events in a specific date range.<ul><li>⚠Be aware that the maximum date range is one month! You need to execute multiple searches if you want to search for events throughout multiple months.</li></ul></li><li>User: use this filter if you need to search for events executed by a specific person.</li><li>Change: use this filter if you need to search for a certain change done by any user.</li><li>Event type: use this filter to search for multiple events grouped under a certain category. It will help you, for example, to search for all changes done by any user in the User Management.</li></ol><p>Now you can click on single events to see more details for each event.</p><p><br></p><h3 data-id="-3"></h3><h2 data-id="how-to-see-event-logs-of-incoming-connections">How to see event logs of incoming connections</h2><p>With Incoming connection logging, you can audit what happened during the connections to the end user's devices.</p><h3 data-id="requirements">Requirements</h3><ul><li>Your devices must be placed within a <a href="https://community.teamviewer.com/English/kb/articles/106782-managed-devices-managed-groups-and-managed-users" rel="nofollow noreferrer ugc">Managed group</a> and <a href="https://community.teamviewer.com/English/kb/articles/108805-assign-a-device-to-your-company" rel="nofollow noreferrer ugc">assigned to your Company</a>.</li><li><strong>TeamViewer Host</strong> needs to be installed on the end user's devices. This feature is not compatible with the full client.</li></ul><p>Incoming connections logged via Auditability can be found in the Event Log by looking for entries with a <strong>TeamViewer ID as</strong> <strong>Author</strong>.</p><div class="embedExternal embedImage display-medium float-none"> <div class="embedExternal-content"> <a class="embedImage-link" href="https://us.v-cdn.net/6032394/uploads/3G04O0PVGZWT/image.png" rel="nofollow noreferrer noopener ugc" target="_blank"> <img class="embedImage-img" src="https://us.v-cdn.net/6032394/uploads/3G04O0PVGZWT/image.png" alt="User: "image.png"" height="180" width="320" loading="lazy" data-display-size="medium" data-float="none"></img></a> </div> </div> <ol><li><strong>Incoming connection</strong><ul><li>Any entry which shows a TeamViewer ID only belongs to an incoming connection.</li><li>This is because it's the device that provides the information for the Event Log, i.ethe device is the author of this information.</li></ul></li><li><strong>The device that got accessed</strong><ul><li><strong>ID of presenter</strong> shows the TeamViewer ID, which had the incoming connection.</li><li><strong>Name of presenter</strong> is empty in this case; assigning to an account is not possible in TeamViewer Host.</li></ul></li><li><strong>The device the connection came from</strong><ul><li><strong>ID of participant</strong> shows which device is connected to the Host.</li><li>If an account was used on that device, the account's display name shows in <strong>Name of participant</strong>.</li></ul></li><li><strong>Active permissions</strong><ul><li>The permissions show which rights the person who connected to the Host had during the connection.</li></ul></li></ol><p>File transfers are also logged for incoming connections:</p><div class="embedExternal embedImage display-medium float-none"> <div class="embedExternal-content"> <a class="embedImage-link" href="https://us.v-cdn.net/6032394/uploads/BDUJ75OHVL1L/image.png" rel="nofollow noreferrer noopener ugc" target="_blank"> <img class="embedImage-img" src="https://us.v-cdn.net/6032394/uploads/BDUJ75OHVL1L/image.png" alt="User: "image.png"" height="180" width="320" loading="lazy" data-display-size="medium" data-float="none"></img></a> </div> </div> <p><br></p><h3 data-id="-4"></h3><h2 data-id="how-to-download-event-logs">How to download event logs</h2><p>When you have access to the event logs of your company, navigate to → "Event logs" in the left navigation panel of the Management Console.</p><p>To download events, apply your filters and click "Download Events" afterward. You will receive a CSV file containing the filtered events. </p><p>We recommend importing the CSV file into Excel to have a good overview of all the downloaded events.</p><h4 data-id="csv-columns">CSV columns</h4><p>The CSV file contains multiple columns that provide details about the recorded event. The following columns exist:</p><ol><li>Date: the date when the event was logged. The date logged in this column reflects the server date. </li><li>Time: the time when the event was logged. </li><li>Datetime (ISO8601): the date, time, and timezone in ISO8601 format of the logged event.</li><li>Author: this is the person that executed the event. The user name displays the author or if that is not existing, the TeamViewer ID.</li><li>Change: This is the event the author performed (in a short and readable format).</li><li>Event type: this is a category each event belongs to. It will help to group for certain event types, e.g., when you are only interested in changes that have been done to user properties all over the company</li><li>Affected item: the object on which the change was made</li><li>Property: the detailed property that was changed on the affected item, e.g., the user name of a user object</li><li>Old value: this column is only filled when an object was changed or deleted, but not when it was created. If an object was changed, the old value is listed for you to see how the value was changed. If an object gets deleted, the old value shows the value the object had before deletion.</li><li>New value: this column shows the (new) value of the changed property.</li></ol><p><br></p><h3 data-id="-5"></h3><h2 data-id="whose-data-is-collected-during-remote-control-sessions">Whose data is collected during remote control sessions?</h2><p>Event data during remote control sessions are only collected from users authenticated as company member that has enabled event logging.</p><p>Examples of a remote control session with two users:</p><div class="embedExternal embedImage display-large float-none"> <div class="embedExternal-content"> <a class="embedImage-link" href="https://us.v-cdn.net/6032394/uploads/U7G3QYS52O5Q/image.png" rel="nofollow noreferrer noopener ugc" target="_blank"> <img class="embedImage-img" src="https://us.v-cdn.net/6032394/uploads/U7G3QYS52O5Q/image.png" alt="User: "image.png"" height="180" width="320" loading="lazy" data-display-size="large" data-float="none"></img></a> </div> </div> <p><br></p><h3 data-id="-6"></h3><h2 data-id="data-retention">Data retention</h2><p>All event data is logged on TeamViewer servers (in Frankfurt) for one year. This retention period can't be changed. After one year, all data will be automatically and completely deleted.</p><p><br></p><h3 data-id="-7"></h3><h2 data-id="event-log-rest-api">Event log REST API</h2><p>The event log can also be retrieved via the REST API. You will find more information here:</p><h3 data-id="use-the-teamviewer-api"><a href="https://community.teamviewer.com/English/kb/articles/109647-use-the-teamviewer-api" rel="nofollow noreferrer ugc">Use the TeamViewer API</a></h3><p><br></p><h3 data-id="-8"></h3><h2 data-id="list-of-events">List of Events</h2><p>This is the list of events TeamViewer catches and stores:</p><div class="embedExternal embedImage display-large float-none"> <div class="embedExternal-content"> <a class="embedImage-link" href="https://us.v-cdn.net/6032394/uploads/IKYEKNH47H71/image.png" rel="nofollow noreferrer noopener ugc" target="_blank"> <img class="embedImage-img" src="https://us.v-cdn.net/6032394/uploads/IKYEKNH47H71/image.png" alt="image.png" height="817" width="725" loading="lazy" data-display-size="large" data-float="none"></img></a> </div> </div> <p><br></p><div class="embedExternal embedImage display-large float-none"> <div class="embedExternal-content"> <a class="embedImage-link" href="https://us.v-cdn.net/6032394/uploads/Y1SNOCE8VCPI/image.png" rel="nofollow noreferrer noopener ugc" target="_blank"> <img class="embedImage-img" src="https://us.v-cdn.net/6032394/uploads/Y1SNOCE8VCPI/image.png" alt="image.png" height="565" width="725" loading="lazy" data-display-size="large" data-float="none"></img></a> </div> </div> <p> </p><div class="embedExternal embedImage display-large float-none"> <div class="embedExternal-content"> <a class="embedImage-link" href="https://us.v-cdn.net/6032394/uploads/KU087OCXFG88/image.png" rel="nofollow noreferrer noopener ugc" target="_blank"> <img class="embedImage-img" src="https://us.v-cdn.net/6032394/uploads/KU087OCXFG88/image.png" alt="image.png" height="312" width="823" loading="lazy" data-display-size="large" data-float="none"></img></a> </div> </div> <p><br></p> </article> </main>
