This article applies to all TeamViewer customers with an Enterprise/Tensor license.
This article applies to TeamViewer version 14.1 or higher
This article applies to Windows, Mac, and Linux.
The auditability feature provides you with information necessary for your audits and protects your business against abusive claims by showing the track of activities.
Prerequisite
To be able to use this feature, you must meet the following requirements:
- You are using TeamViewer version 13.2 or newer.
- You have a TeamViewer company account in order to access the Management Console where you can activate the feature for your company
- You/your company own(s) a TeamViewer Tensor license
What kind of data is collected
You will find a complete overview in the list of events below at the end of this article.
Whose data is collected during remote control sessions?
Event data during remote control sessions is only collected from users who are authenticated as a member of the company that has enabled event logging.
Examples of a remote control session with two users:
Data retention
All event data is logged for 1 year on TeamViewer servers (located in Frankfurt). This retention period can't be changed. After 1 year all data will be automatically and completely deleted.
How to activate event logs
By default, event logging is not activated for your company as you should get general consent within your company about collection and usage of the data.
Activating event logging can only be done as a company admin. You can activate it in the Management Console by clicking on your user profile and then navigate to Maintain <your company> --> Advanced --> Event logging. Now certain activities of all users that belong to your company will be logged.
How to access event logs for auditing
In order to have access to the event logs, you need to have access to the Event Log dialog in the Management Console. Your company admin can grant you access to this page.
💡Info: Granting access to event logs only works with the 4-eye-principle. You need another company admin granting you access.
How to watch and filter event logs
When you have access to the event logs of your company, navigate to → "Event logs" in the left navigation panel of the Management Console.
If event logging is active for your company you will see the following screen:
If event logging is deactivated for your company you will see the following screen:
You can now start to search for specific events by using the given filter possibilities:
1) Date range: use this filter if you need to search for events in a specific date range.
⚠Be aware that the maximum date range is one month! If you want to search for events throughout multiple months, you need to execute multiple searches.
2) User: use this filter if you need to search for events executed by a specific person.
3)Change: use this filter if you need to search for a certain change done by any user.
4) Event type: use this filter if you need to search for multiple events grouped under a certain category. It will help you, for example, to search for all changes done by any user in the User Management.
When you selected your filters click on Get Events. You will now see a filtered list of events, similar to this:
Now you can click on single events to see more details for each event.
How to download event logs
When you have access to the event logs of your company, navigate to → "Event logs" in the left navigation panel of the Management Console.
In order to download events apply your filters and afterward click on "Download Events". You will receive a CSV file containing the filtered events.
In order to have a good overview of all the downloaded events, we recommend you to import the CSV file into Excel.
CSV columns
The CSV file contains multiple columns that provide details about the recorded event. The following columns exist:
- Date: the date when the event was logged. The date logged in this column reflects the server date.
- Time: the time when the event was logged.
- Datetime (ISO8601): the date, time and timezone in ISO8601 format of the logged event.
- Author: this is the person that executed the event. The author is displayed by the user name or if that is not existing by the TeamViewer ID.
- Change: This is the event the author performed (in a short and readable format).
- Event type: this is a category each event belongs to. It will help to group for certain event types, e.g. when you are only interested in changes that have been done to user properties all over the company
- Affected item: the object on which the change was made
- Property: the detailed property that was changed on the affected item, e.g. the user name of a user object
- Old value: this column is only filled when an object was changed or deleted, but not when it was created. In case an object was changed the old, changed value is listed in order for you to see how the value was changed. If an object gets deleted, the old value shows the value the object had before deletion.
- New value: this column shows the (new) value of the changed property.
Event log REST API
The event log can also be retrieved via the REST API. You will find more information about how to use the API in our official API documentation:
List of Events
This is the list of events TeamViewer catches and stores:
