Read this article in ChineseFrenchJapanese | Spanish


This article applies to all TeamViewer customers with an Enterprise/Tensor license.

This article applies to TeamViewer version 14.1

This article applies to Windows, Mac, and Linux.
The auditability feature provides you with information necessary for your audits and protects your business against abusive claims by showing the track of activities.

Prerequisite

To be able to use this feature, you must meet the following requirements:

  • You have a TeamViewer company account in order to access the Management Console where you can activate the feature for your company
  • You/your company own(s) a TeamViewer Tensor license

How to activate event logs

By default, event logging is not activated for your company as you should get general consent within your company about collection and usage of the data.

Activating event logging can only be done as a company admin. You can activate it in the Management Console by clicking on your user profile and then navigate to Maintain <your company> --> Advanced --> Event logging. Now certain activities of all users that belong to your company will be logged.

image2018-7-9_14-34-10.png

How to access event logs for auditing

In order to have access to the event logs, you need to have access to the Event Log dialog in the Management Console. Your company admin can grant you access to this page.

image2018-7-9_14-35-24.png

Info
Granting access to event logs only works with the 4-eye-principle. You need another company admin granting you access.

How to watch and filter event logs

When you have access to the event logs of your company, navigate to → "Event logs" in the left navigation panel of the Management Console.

If event logging is active for your company you will see the following screen:

event_logs_overview.PNG

If event logging is deactivated for your company you will see the following screen:

event_logs_deactivated.PNG

You can now start to search for specific events by using the given filter possibilities:

  1. Date range: use this filter if you need to search for events in a specific date range.

    Be aware that the maximum date range is one month! If you want to search for events throughout multiple months, you need to execute multiple searches.

  2. User: use this filter if you need to search for events executed by a specific person.
  3. Change: use this filter if you need to search for a certain change done by any user.
  4. Event type: use this filter if you need to search for multiple events grouped under a certain category. It will help you, for example, to search for all changes done by any user in the User Management.

When you selected your filters click on "Get Events". You will now see a filtered list of events, similar to this:

event_logs_filter.PNG

Now you can click on single events to see more details for each event.

How to download event logs

When you have access to the event logs of your company, navigate to → "Event logs" in the left navigation panel of the Management Console.

In order to download events apply your filters and afterward click on "Download Events". You will receive a CSV file containing the filtered events. 

In order to have a good overview of all the downloaded events, we recommend you to import the CSV file into Excel.

CSV columns

The CSV file contains multiple columns that provide details about the recorded event. The following columns exist:

  1. Date: the date when the event was logged. The date logged in this column reflects the server date. 
  2. Time: the time when the event was logged. 
  3. Datetime (ISO8601): the date, time and timezone in ISO8601 format of the logged event.
  4. Author: this is the person that executed the event. The author is displayed by the user name or if that is not existing by the TeamViewer ID.
  5. Change: This is the event the author performed (in a short and readable format).
  6. Event type: this is a category each event belongs to. It will help to group for certain event types, e.g. when you are only interested in changes that have been done to user properties all over the company
  7. Affected item: the object on which the change was made
  8. Property: the detailed property that was changed on the affected item, e.g. the user name of a user object
  9. Old value: this column is only filled when an object was changed or deleted, but not when it was created. In case an object was changed the old, changed value is listed in order for you to see how the value was changed. If an object gets deleted, the old value shows the value the object had before deletion.
  10. New value: this column shows the (new) value of the changed property.

Data retention

All event data is logged for 1 year on TeamViewer servers (located in Frankfurt)

List of Events

This is the list of events TeamViewer catches and stores:

User action Short event name Event origin Event type

Initiate a remote session

Started session (event name for initiator)

Incoming session (event name for receiver)

Remote Session

Session

Closed a remote session

Ended session

Remote Session

Session

The user joins/leaves a running remote session

Joined session

Left session

Remote Session

Session

Additional user joins/leaves a remote session

Participant joined session

Participant left session

Remote Session

Session

Trigger switching of sides during a remote session

Switched sides

Remote Session

Session

Activate/deactivate remote input during a remote session

Changed Disabled Remote Input (event name for initiator)

Received Disabled Local Input (event name for receiver)

Remote Session

Session

Activate/deactivate black screen during a remote session

Changed Show Black Screen (event name for initiator)

Received Show Black Screen (event name for receiver)

Remote Session

Session

Start screen recording

Started recording (event name for initiator)

Remote Session

Session

Stop screen recording

Ended recording (event name for initiator)

Remote Session

Session

Pause screen recording

Paused recording (event name for initiator)

Remote Session

Session

Continue screen recording

Resumed recording (event name for initiator)

Remote Session

Session

Start a file transfer

Sent file (event name for initiator)

Received file (event name for receiver)

Remote Session

Session

Editing own user properties

Edit own user profile

Management Console

User profile

Activating/deactivating TFA of own account

De-/activate TFA

Management Console

User profile

Creating a user in the Management Console

Created user

 

Management Console

User profile

Editing user properties

Edit user properties

Management Console

User profile

Editing user permissions

Edit user permissions

Management Console

User profile

Deleting a user

Delete user

Management Console

User profile

Join a company

Join company

Management Console

Company Administration

Creating a new custom host module

Create custom host module

Management Console

Custom Modules

Editing a custom host module

Edit custom host module

Management Console

Custom Modules

Delete a custom host module

Delete custom host module

Management Console

Custom Modules

Create a new group

Add group

Management Console

Group Management

Share a group

Share group

Management Console

Group Management

Edit a group

Edit group

Management Console

Group Management

Delete a group

Delete group

Management Console

Group Management

Create a new script token

Create Script Token

Management Console

Company Administration

Edit script token properties

Edit Script Token

Management Console

Company Administration

Edit existing script token permissions

Edit Script Token Permissions

Management Console

Company Administration

Delete a script token

Delete Script Token

Management Console

Company Administration

Adding a policy

Policy added

Management Console

Policy

Editing a policy

Policy updated

Management Console

Policy

Deleting a policy

Policy deleted

Management Console

Policy

 

Version history
Revision #:
5 of 5
Last update:
‎31 Jul 2019, 1:04 PM
Updated by:
 
Contributors