security related logs and monitoring
Hello,
We are doing an audit of the misuse of TeamViewer of one of our employees.
We need the official statement of the TeamViewer support team of the meaning and use of the following logs:
Incomming_Connections.log
Connections.txt
TeamViewer12_logfile_old.log
TeamViewer12_logfile.log
The time that the logs display rae utc, gmt, or he computer time when the connection was made?
This is to help us completing the report to refer the case to HR.
Thank yu for your help.
JuanD
Best Answers
-
Hi JuanD,
Thank you for the question.
connections_incoming.txt - You can find the IDs of all incoming connections for the machine in this file.
connections.txt - This file is for all outgoing connections from the machine - you can also see the ID to which you connected.
TeamViewer12_logfile.log - This file is very important, especially when we need to make an internal analyse to troubleshoot problems with TeamViewer. You can find outgoing and incoming connections in this file.
TeamViewer12_logfile_old.log - If the logfile is too big, TeamViewer automatically transfer the old data into this logfile.
The times in the connections.txt and in the connections_incoming.txt is always UTC.
The time in the logfiles is the local time from the computer.
The files are only available on the local computer and not on our side - this is the reason why we asked for logfiles if we have to troubleshoot a TeamViewer problem. The files will only be created when you activate the logging in TeamViewer under "Extras - Options - Advanced".
If you have more questions regarding this do not hesitate to ask
Julia
Senior Support Engineer - 2nd level Support
Did my reply answer your question? Accept it as a solution to help others.
Find this helpful? Say thanks by clicking on the Thumbs Up button.7 -
Hi JuanD,
If you have a computer with ID "1" and someone connects from ID "2" you will see "2's" ID in the connections_incoming.txt an the computer with ID "1"
You can also see the outgoing connection from "2's" ID to ID "1" in the local connections.txt file from ID "2"
If the logging is activated
Julia
Senior Support Engineer - 2nd level Support
Did my reply answer your question? Accept it as a solution to help others.
Find this helpful? Say thanks by clicking on the Thumbs Up button.6
Answers
-
Hi JuanD,
Thank you for the question.
connections_incoming.txt - You can find the IDs of all incoming connections for the machine in this file.
connections.txt - This file is for all outgoing connections from the machine - you can also see the ID to which you connected.
TeamViewer12_logfile.log - This file is very important, especially when we need to make an internal analyse to troubleshoot problems with TeamViewer. You can find outgoing and incoming connections in this file.
TeamViewer12_logfile_old.log - If the logfile is too big, TeamViewer automatically transfer the old data into this logfile.
The times in the connections.txt and in the connections_incoming.txt is always UTC.
The time in the logfiles is the local time from the computer.
The files are only available on the local computer and not on our side - this is the reason why we asked for logfiles if we have to troubleshoot a TeamViewer problem. The files will only be created when you activate the logging in TeamViewer under "Extras - Options - Advanced".
If you have more questions regarding this do not hesitate to ask
Julia
Senior Support Engineer - 2nd level Support
Did my reply answer your question? Accept it as a solution to help others.
Find this helpful? Say thanks by clicking on the Thumbs Up button.7 -
Hello Julia,
Thank you for your explanation.
Another question: The connections_incoming log, is when the user connected from a external computer to the local computer or this log capture the id no matter if the connection was from the local to an external computer and viceversa?
Thanks
JuanD
0 -
Hi JuanD,
If you have a computer with ID "1" and someone connects from ID "2" you will see "2's" ID in the connections_incoming.txt an the computer with ID "1"
You can also see the outgoing connection from "2's" ID to ID "1" in the local connections.txt file from ID "2"
If the logging is activated
Julia
Senior Support Engineer - 2nd level Support
Did my reply answer your question? Accept it as a solution to help others.
Find this helpful? Say thanks by clicking on the Thumbs Up button.6 -
Hi Julia,
Thank you again for the explanation.
Unfortunately we had to suspend the employee until investigation is complete, and this information was a must to continue our investigation.
Thank you again.
JuanD
0 -
[logs data removed]
0 -
Hey Julia, One of my friends was scammed for a large amount of money through her pc. She's not overly tech savvy so I managed to get the incoming connections txt file. She has unfortunately uninstalled the program but I do still have this txt file which I hope you are able to use to track down the individual. If you're able to get me some details regarding this user, that would be great so I can refer that to the Australian Federal Police. Thanks for your time
0 -
Hi Julia,
I have a question in a similar topic. I suspect that someone accessed my laptop and want to find it out from the log files, however in the Connections_incoming text file I can see only records from 2016.
So I thought I check the TeamViewer12_Logfile, but it contains so many records I don't know what to look for.
Could you please help what records showing the incoming connections and how to find out if file transfer happened or not?
Thank you in advance.
Kind regards,
Roland
0 -
Hi SBSP,
If you think that someone had access to your computer please write a mail to
privacy@teamviewer.com
Julia
Senior Support Engineer - 2nd level Support
Did my reply answer your question? Accept it as a solution to help others.
Find this helpful? Say thanks by clicking on the Thumbs Up button.0 -
Hi Julia,
Thanks for your reply, however I would prefer to understand and be able to read the logs of TeamViewer, therefore I would highly appreciate if you could give me some hints how to find out from the logs if there has been a breach or not.
Thank you for understanding.
Kind regards,
Roland
0 -
Hi Roland,
The logfiles exist because we (Support) and our development need them to understand unexpected behaviors and general TeamViewer issue.
If you want to look for connections, please have a look at the connection files I mentioned earlier. If you still have doubts about incoming our outgoing connections, you can contact us on privacy@teamviewer.com
Julia
Senior Support Engineer - 2nd level Support
Did my reply answer your question? Accept it as a solution to help others.
Find this helpful? Say thanks by clicking on the Thumbs Up button.1 -
Hi Julia,
good explanation. By the way, I'm trying to open TeamViewer12_logfile_old.log with a regular text editor and unreadable text is shown.
Is this file plain text or need to be converted to be readed?Thanks ;-)
0 -
Hi serfer2,
What do you mean with unreadable text? Normally it should be able to read the logs with the editor. Do you want to look for a specific entry?
Julia
Senior Support Engineer - 2nd level Support
Did my reply answer your question? Accept it as a solution to help others.
Find this helpful? Say thanks by clicking on the Thumbs Up button.0 -
Hi,
the file was recovered with a data recovery program. I think this is why it is unreadable.
Thanks ;-)
0 -
is it possible that someone connected with me can delete the log of my pc for transferring files? so that I can never realize it?0
-
I have a problem with the files...
In my Teamviewer I see TeamViewer12_logfile.log and TeamViewer13_logfile.log as well, but I don't see at all "Incomming_Connections.log" and "Connections.txt", here is my folder :
Si it should be at the top of the folder since it's alphabetical order but there's nothing of these 2 files.... How can I have the files I don't have ?
Thanks in advance
0 -
Is it possible for an intruder to delete Teamviewer logs and leave no trace?
0 -
Hi,
does the logfiles, especially Teamviewer12_Logfile.log contains any personal data what could be in fraude of the new DSGVO? Or does it contains only technical informations for the running of teamviewer what will not decover any personal informations of the users?
Are there maximal two Teamviewer12_Logfile.log und Teamviewer12_Logfile_OLDl.log?
Please confirm what this logfile is for!
Thanks a lot in advance!
Hallo,
enthält die Teamviewer12_Logfile.log irgendwelche Daten, welche gegen die Bestimmungen zum Personenschutz der neuen DSGVO verstoßen würden? - Wenn ja welche?
Oder enthält diese Datei lediglich technische Informationen zur Funktion von Teamviewer, welche keine Rückschlüsse auf die betroffenen Personen zulassen?
Gibt es nur maximal zwei Teamviewer12_Logfile.log und Teamviewer12_Logfile_OLDl.log?
Bitte bestätigen, was Sache ist!
Vielen Dank im Voraus!
Fi
fiz0
