security related logs and monitoring

Hello,

We are doing an audit of the misuse of TeamViewer of one of our employees. 

We need the official statement of the TeamViewer support team of the meaning and use of the following logs:

Incomming_Connections.log

Connections.txt

TeamViewer12_logfile_old.log

TeamViewer12_logfile.log

The time that the logs display rae utc, gmt, or he computer time when the connection was made?

This is to help us completing the report to refer the case to HR.

Thank yu for your help.

JuanD

Best Answers

Answers

  • JuanD
    JuanD Posts: 3

    Hello Julia,

    Thank you for your explanation.

    Another question: The connections_incoming log, is when the user connected from a external computer to the local computer or this log capture the id no matter if the connection was from the local to an external computer and viceversa?

    Thanks

    JuanD

  • JuanD
    JuanD Posts: 3

    Hi Julia,

    Thank you again for the explanation. 

    Unfortunately we had to suspend the employee until investigation is complete, and this information was a must to continue our investigation. 

    Thank you again.

    JuanD

  •  

    [logs data removed]

     
  • Hey Julia, One of my friends was scammed for a large amount of money through her pc. She's not overly tech savvy so I managed to get the incoming connections txt file. She has unfortunately uninstalled the program but I do still have this txt file which I hope you are able to use to track down the individual. If you're able to get me some details regarding this user, that would be great so I can refer that to the Australian Federal Police. Thanks for your time

  • SBSP
    SBSP Posts: 3

    Hi Julia,

    I have a question in a similar topic. I suspect that someone accessed my laptop and want to find it out from the log files, however in the Connections_incoming text file I can see only records from 2016. 

    So I thought I check the TeamViewer12_Logfile, but it contains so many records I don't know what to look for. 

    Could you please help what records showing the incoming connections and how to find out if file transfer happened or not?

    Thank you in advance.

    Kind regards,

    Roland

  • Julia
    Julia Posts: 290 Staff member 🤠

    Hi SBSP,

    If you think that someone had access to your computer please write a mail to

    privacy@teamviewer.com

    Julia
    Senior Support Engineer - 2nd level Support
    Did my reply answer your question? Accept it as a solution to help others.
    Find this helpful? Say thanks by clicking on the Thumbs Up button.
  • SBSP
    SBSP Posts: 3

    Hi Julia,

    Thanks for your reply, however I would prefer to understand and be able to read the logs of TeamViewer, therefore I would highly appreciate if you could give me some hints how to find out from the logs if there has been a breach or not.

    Thank you for understanding.

    Kind regards,

    Roland

  • Julia
    Julia Posts: 290 Staff member 🤠

    Hi Roland,

    The logfiles exist because we (Support) and our development need them to understand unexpected behaviors and general TeamViewer issue. 

    If you want to look for connections, please have a look at the connection files I mentioned earlier. If you still have doubts about incoming our outgoing connections, you can contact us on privacy@teamviewer.com

    Julia
    Senior Support Engineer - 2nd level Support
    Did my reply answer your question? Accept it as a solution to help others.
    Find this helpful? Say thanks by clicking on the Thumbs Up button.
  • Hi Julia,

    good explanation. By the way, I'm trying to open TeamViewer12_logfile_old.log with a regular text editor and unreadable text is shown. 
    Is this file plain text or need to be converted to be readed?

    Thanks ;-)

  • Julia
    Julia Posts: 290 Staff member 🤠

    Hi serfer2,

    What do you mean with unreadable text? Normally it should be able to read the logs with the editor. Do you want to look for a specific entry?

    Julia
    Senior Support Engineer - 2nd level Support
    Did my reply answer your question? Accept it as a solution to help others.
    Find this helpful? Say thanks by clicking on the Thumbs Up button.
  • Hi,

    the file was recovered with a data recovery program. I think this is why it is unreadable.

    Thanks ;-)

  • ory1dj
    ory1dj Posts: 2
    is it possible that someone connected with me can delete the log of my pc for transferring files? so that I can never realize it?
  • I have a problem with the files...  

    In my Teamviewer I see TeamViewer12_logfile.log and TeamViewer13_logfile.log as well, but I don't see at all "Incomming_Connections.log" and "Connections.txt", here is my folder :

    http://prntscr.com/lg8vpg

    http://prntscr.com/lg8vyq

    Si it should be at the top of the folder since it's alphabetical order but there's nothing of these 2 files....    How can I have the files I don't have ?

    Thanks in advance 

  • Is it possible for an intruder to delete Teamviewer logs and leave no trace?

  • Hi,

    does the logfiles, especially Teamviewer12_Logfile.log contains any personal data what could be in fraude of the new DSGVO? Or does it contains only technical informations for the running of teamviewer what will not decover any personal informations of the users?

    Are there maximal two Teamviewer12_Logfile.log und Teamviewer12_Logfile_OLDl.log?

    Please confirm what this logfile is for!

    Thanks a lot in advance!

    Hallo,

    enthält die Teamviewer12_Logfile.log irgendwelche Daten, welche gegen die Bestimmungen zum Personenschutz der neuen DSGVO verstoßen würden? - Wenn ja welche?

    Oder enthält diese Datei lediglich technische Informationen zur Funktion von Teamviewer, welche keine Rückschlüsse auf die betroffenen Personen zulassen?

    Gibt es nur maximal zwei Teamviewer12_Logfile.log und Teamviewer12_Logfile_OLDl.log?

    Bitte bestätigen, was Sache ist!

    Vielen Dank  im Voraus!

    Fi

    fiz