Child pages
  • Reviewing Management Console Activity
Skip to end of metadata
Go to start of metadata

All actions which have been taken by the Central Management Console or by users using the Central Management console are logged in the Event Log, This allows administrators to review activity for auditing, security or reporting purposes.

Viewing Event Logs

To view the event logs, follow the steps below:

Click 'View Event Logs' under 'Other Tasks' on the main console view. The main Event Log page will be shown as below:

To sort or filter the event log, click the menu arrow on one of the column headings and select the appropriate filter or sort options:

Event Log Columns

The Event Log table has columns as follows:

Column NameDescription
TimeThe date and time when the event was logged.
Type

The 'Type' column indicates the severity of the event. The types are:

    • Info - A normal event in the operation of the Management Console
    • Warning - Something unusual which may indicate a problem or unusual operation
    • Error - A failure of some sort which may require investigation
SourceThere are a number of different sources for each event. These sources show which part of the system the event originated from and filtering on source may be useful to show related events from the same area
EventThe event which has occurred. A full list is available below
ComputerIf the event is associated with a computer, the NetBIOS name of the computer will be shown here.
User

If the event was initiated by a user, the user's login name will be shown here.

If the Management Console is configured to allow access without login, this column will always be empty. The session ID may be used to distinguish between actions taken by different users.

Session IDThis column is hidden by default but contains the internal web session ID which was used to perform the action. This can be used to track which changes were made by which user when user login is disabled in the Management Console
MessageThis contains the message detail for the event. The message can vary depending on whether the event is a success or failure event. For example, a 'Backup End' event may show additional error information for a failed backup over a successful one.

Event Log Sources

The available Event Log sources are listed below:

Event Log Source NameDescription
SystemEvents from the server which is running the Central Management Console such as startup and shutdown events from the Management Console service.
LogonEvents relating to user login/logout of sessions
SettingsChanges to any of the items in the Management Console settings
UpdateNotifications of new Central Management Console software versions
LicensesAddition and removal of Client Access License keys, warnings for problems with client licensing
ComputersAdditional and removal of managed computers, online/offline status notifications
Backup DefinitionsChanges to Backup Definitions
SchedulesChanges to Schedules
RepositoryChanges to Repositories
SchedulerEvents from the internal scheduling of backups by repositories including backup scheduling, start and end.
ReflectBackup and restore events initiated from an individual computer's installation of Macrium Reflect rather than centrally
DashboardEvents triggered from user interaction with the Dashboard page
RestoreEvents from Central Management Console triggered restore operations
CMC AgentErrors and notifications from Agents running on managed computers
BackupEvents from Central Management Console triggered backup operations
VerificationEvents from Central Management Console triggered verification operations

Event Log Events

The list of possible events and useful information that may be logged us shown below. Note that if relevant, all events will contain a username and/or computer NetBIOS:

Event Log EventDescriptionData available
StartupThe Management Console service has started upManagement Console version
ShutdownThe Management Console service has been requested to stop 
User LoginA user has logged in.Username, IP address
User LogoutA user has logged outUsername
Security Settings ChangedThe security settings were changed by a user 
Slack Settings ChangedThe Slack settings were changed by a user 
Notification Settings ChangedThe Notification settings were changed by a user 
Update AvailableAn update to the Management console is availableNew Software Version
Update InstalledThe Management Console has started with a new versionOld and new software version numbers
License Key AddedA License Key has been added as a Client Access LicenseLicense key and number of seats
License Key RemovedA License Key has been removedLicense key
Unlicensed ComputersOne or more computers cannot be accessed by the Management Console due to licensing issuesNumber of affected computers
Computer AddedA computer has been added to the Management ConsoleComputer NetBIOS
Computer RemovedA computer has been removed from the Management ConsoleComputer NetBIOS
Agent Remotely InstalledThe Management Console has been used to attempt remote installation of an AgentComputer NetBIOS affected, install success, error messages
Agent PatchedThe automatic Agent patching has pushed a patch to a remote AgentComputer NetBIOS, patch name
Repeat Last BackupThe Repeat Last Backup function has been used to trigger a backupComputer NetBIOS
Set PassphraseThe Passphrase for a computer has been changed on the serverComputer NetBIOS, passphrase
Agent UpdatedA remote Agent is now running a new version of the Agent softwareOld and new versions
Backup Definition CreatedA new Backup Definition was createdBackup Definition name
Backup Definition RemovedA Backup Definition was removedBackup Definition name
Backup Definition UpdatedA Backup Definition was edited and updatedBackup Definition name
Schedule CreatedA new Schedule was createdSchedule name
Schedule RemovedA Schedule was removedSchedule name
Schedule UpdatedA Schedule was edited and updatedSchedule name
Repository CreatedA new Repository was createdRepository path
Repository RemovedA Repository was removedRepository path
Repository UpdatedA Repository was edited and updatedRepository path
Repository OfflineThe server lost contact with a RepositoryRepository path
Scheduled Backup AddedBackups have been scheduled in a RepositoryRepository path, Backup Definition name, Schedule name
Scheduled Backup RemovedScheduled backups have been removed from a RepositoryRepository path, Backup Definition name, Schedule name
Scheduled Backup ActiveA scheduled backup has been set as active on a RepositoryRepository path, Backup Definition name, Schedule name
Scheduled Backup StoppedA scheduled backup has been stopped on a RepositoryRepository path, Backup Definition name, Schedule name
Scheduled Backup TriggeredScheduled backups have triggered a backup to start on a managed computerComputer NetBIOS, Repository path, Backup Definition name, Schedule name
Backup StartedA backup has started or failed to start on a managed computerComputer NetBIOS, error information
Backup FinishedA backup has finished or failed on a managed computer Computer NetBIOS, error information, log file name
Restore StartedA restore has started or failed to start on a managed computer Computer NetBIOS, error information
Restore FinishedA restore has finished or failed on a managed computer Computer NetBIOS, error information, log file name
Clone StartedA clone operation has started or failed to start on a managed computer Computer NetBIOS, error information
Clone FinishedA clone operation has finished or failed on a managed computer Computer NetBIOS, error information, log file name
Backup PausedA backup has been paused from the Management ConsoleComputer NetBIOS
Backup CancelledA backup has been cancelled from the Management ConsoleComputer NetBIOS
Session StartA web session to the Management Console has been startedIP Address
Session End

A web session to the Management Console has closed.

The session will be closed by the server some time after the user has closed their web browser. This can be up to 10 minutes


 
Restore RequestedA restore operation has been requested through the Management ConsoleComputer NetBIOS, image file name
Message ResponseA request to an Agent has failed.Computer NetBIOS, message type, error
Agent Status ChangedA Managed Computer has changed online statusComputer NetBIOS, Online or offline
Backup RequestedA backup operation has been requested through the Management ConsoleComputer NetBIOS
Verification StartedA backup file verification operation has startedBackup file name and path
Verification FinishedA backup filed verification operation has finishedBackup file name and path, success, error
Home Edition Agent Limit ReachedThe number of Home Edition standalone licensed clients has exceeded the limit (4).Number of Home Edition clients, whether excess clients are using MALs
Email Settings ChangedThe Email settings were changed by a user 
System Settings ChangedThe System settings were changed by a user 

 

 

  • No labels