Posted by JuanD
Digon

security related logs and monitoring

Hello,

We are doing an audit of the misuse of TeamViewer of one of our employees. 

We need the official statement of the TeamViewer support team of the meaning and use of the following logs:

Incomming_Connections.log

Connections.txt

TeamViewer12_logfile_old.log

TeamViewer12_logfile.log

The time that the logs display rae utc, gmt, or he computer time when the connection was made?

This is to help us completing the report to refer the case to HR.

Thank yu for your help.

JuanD

2 Accepted Solutions

Accepted Solutions
Posted by TeamViewer Staff
TeamViewer Staff
Solution

Re: security related logs and monitoring

Hi JuanD,

Thank you for the question.

connections_incoming.txt - You can find the IDs of all incoming connections for the machine in this file.

connections.txt - This file is for all outgoing connections from the machine - you can also see the ID to which you connected.

TeamViewer12_logfile.log - This file is very important, especially when we need to make an internal analyse to troubleshoot problems with TeamViewer. You can find outgoing and incoming connections in this file.

TeamViewer12_logfile_old.log - If the logfile is too big, TeamViewer automatically transfer the old data into this logfile.

The times in the connections.txt and in the connections_incoming.txt is always UTC.

The time in the logfiles is the local time from the computer.

The files are only available on the local computer and not on our side - this is the reason why we asked for logfiles if we have to troubleshoot a TeamViewer problem. The files will only be created when you activate the logging in TeamViewer under "Extras - Options - Advanced".

If you have more questions regarding this do not hesitate to ask :)

Julia
Senior Support Engineer - 2nd level Support
Did my reply answer your question? Accept it as a solution to help others.
Find this helpful? Say thanks by clicking on the Thumbs Up button.
Posted by TeamViewer Staff
TeamViewer Staff
Solution

Re: security related logs and monitoring

Hi JuanD,

If you have a computer with ID "1" and someone connects from ID "2" you will see "2's" ID in the connections_incoming.txt an the computer with ID "1"

You can also see the outgoing connection from "2's" ID to ID "1" in the local connections.txt file from ID "2"

If the logging is activated ;)

Julia
Senior Support Engineer - 2nd level Support
Did my reply answer your question? Accept it as a solution to help others.
Find this helpful? Say thanks by clicking on the Thumbs Up button.
16 Replies
Posted by TeamViewer Staff
TeamViewer Staff
Solution

Re: security related logs and monitoring

Hi JuanD,

Thank you for the question.

connections_incoming.txt - You can find the IDs of all incoming connections for the machine in this file.

connections.txt - This file is for all outgoing connections from the machine - you can also see the ID to which you connected.

TeamViewer12_logfile.log - This file is very important, especially when we need to make an internal analyse to troubleshoot problems with TeamViewer. You can find outgoing and incoming connections in this file.

TeamViewer12_logfile_old.log - If the logfile is too big, TeamViewer automatically transfer the old data into this logfile.

The times in the connections.txt and in the connections_incoming.txt is always UTC.

The time in the logfiles is the local time from the computer.

The files are only available on the local computer and not on our side - this is the reason why we asked for logfiles if we have to troubleshoot a TeamViewer problem. The files will only be created when you activate the logging in TeamViewer under "Extras - Options - Advanced".

If you have more questions regarding this do not hesitate to ask :)

Julia
Senior Support Engineer - 2nd level Support
Did my reply answer your question? Accept it as a solution to help others.
Find this helpful? Say thanks by clicking on the Thumbs Up button.
Posted by JuanD
Digon

Re: security related logs and monitoring

Hello Julia,

Thank you for your explanation.

Another question: The connections_incoming log, is when the user connected from a external computer to the local computer or this log capture the id no matter if the connection was from the local to an external computer and viceversa?

Thanks

JuanD

Posted by TeamViewer Staff
TeamViewer Staff
Solution

Re: security related logs and monitoring

Hi JuanD,

If you have a computer with ID "1" and someone connects from ID "2" you will see "2's" ID in the connections_incoming.txt an the computer with ID "1"

You can also see the outgoing connection from "2's" ID to ID "1" in the local connections.txt file from ID "2"

If the logging is activated ;)

Julia
Senior Support Engineer - 2nd level Support
Did my reply answer your question? Accept it as a solution to help others.
Find this helpful? Say thanks by clicking on the Thumbs Up button.
Posted by JuanD
Digon

Re: security related logs and monitoring

Hi Julia,

Thank you again for the explanation. 

Unfortunately we had to suspend the employee until investigation is complete, and this information was a must to continue our investigation. 

Thank you again.

JuanD

Posted by daisydaisydaisy
Photon

Re: security related logs and monitoring

 

[logs data removed]

 
Posted by MrFluffy94
Photon

Security Concerns

Hey Julia, One of my friends was scammed for a large amount of money through her pc. She's not overly tech savvy so I managed to get the incoming connections txt file. She has unfortunately uninstalled the program but I do still have this txt file which I hope you are able to use to track down the individual. If you're able to get me some details regarding this user, that would be great so I can refer that to the Australian Federal Police. Thanks for your time

Posted by SBSP
Henagon

Re: security related logs and monitoring

Hi Julia,

I have a question in a similar topic. I suspect that someone accessed my laptop and want to find it out from the log files, however in the Connections_incoming text file I can see only records from 2016. 

So I thought I check the TeamViewer12_Logfile, but it contains so many records I don't know what to look for. 

Could you please help what records showing the incoming connections and how to find out if file transfer happened or not?

Thank you in advance.

Kind regards,

Roland

Posted by TeamViewer Staff
TeamViewer Staff

Re: security related logs and monitoring

Hi SBSP,

If you think that someone had access to your computer please write a mail to

privacy@teamviewer.com

Julia
Senior Support Engineer - 2nd level Support
Did my reply answer your question? Accept it as a solution to help others.
Find this helpful? Say thanks by clicking on the Thumbs Up button.
Posted by SBSP
Henagon

Re: security related logs and monitoring

Hi Julia,

Thanks for your reply, however I would prefer to understand and be able to read the logs of TeamViewer, therefore I would highly appreciate if you could give me some hints how to find out from the logs if there has been a breach or not.

Thank you for understanding.

Kind regards,

Roland

Posted by TeamViewer Staff
TeamViewer Staff

Re: security related logs and monitoring

Hi Roland,

The logfiles exist because we (Support) and our development need them to understand unexpected behaviors and general TeamViewer issue. 

If you want to look for connections, please have a look at the connection files I mentioned earlier. If you still have doubts about incoming our outgoing connections, you can contact us on privacy@teamviewer.com

Julia
Senior Support Engineer - 2nd level Support
Did my reply answer your question? Accept it as a solution to help others.
Find this helpful? Say thanks by clicking on the Thumbs Up button.
Posted by serfer2
Henagon

Re: security related logs and monitoring

Hi Julia,

good explanation. By the way, I'm trying to open TeamViewer12_logfile_old.log with a regular text editor and unreadable text is shown. 
Is this file plain text or need to be converted to be readed?

Thanks ;-)

Posted by TeamViewer Staff
TeamViewer Staff

Re: security related logs and monitoring

Hi serfer2,

What do you mean with unreadable text? Normally it should be able to read the logs with the editor. Do you want to look for a specific entry?

Julia
Senior Support Engineer - 2nd level Support
Did my reply answer your question? Accept it as a solution to help others.
Find this helpful? Say thanks by clicking on the Thumbs Up button.
Posted by serfer2
Henagon

Re: security related logs and monitoring

Hi,

the file was recovered with a data recovery program. I think this is why it is unreadable.

Thanks ;-)

Posted by ory1dj
Henagon

Re: security related logs and monitoring

is it possible that someone connected with me can delete the log of my pc for transferring files? so that I can never realize it?
Highlighted
Posted by Craftendo64
Electron

Re: security related logs and monitoring

I have a problem with the files...  

In my Teamviewer I see TeamViewer12_logfile.log and TeamViewer13_logfile.log as well, but I don't see at all "Incomming_Connections.log" and "Connections.txt", here is my folder :

http://prntscr.com/lg8vpg

http://prntscr.com/lg8vyq

Si it should be at the top of the folder since it's alphabetical order but there's nothing of these 2 files....    How can I have the files I don't have ?

Thanks in advance 

Posted by gbanta
Electron

Re: security related logs and monitoring - Deleting Teamviewer Logs

Is it possible for an intruder to delete Teamviewer logs and leave no trace?