Shadow Log Viewer (Service)

There is a built-in shadow log viewer that allows you to retrieve the shadow log from DeviceLock Service.

The typical DeviceLock configuration assumes that the shadow data is stored on DeviceLock Enterprise Server. In this case all shadow data which is originally logged and cached by DeviceLock Service on the local computer is periodically moved to the server. The local shadow log is cleared as soon as the data is successfully moved to the server, so to view this data, you should use the server's shadow log viewer.   

However, in some cases you may need to view the shadow log of a certain computer. This need arises when, for example, you do not use DeviceLock Enterprise Server at all or when the server is being used, but for some reason the data still exists on the client computer.

The columns of this viewer are defined as follows:

• Status - indicates the status of the record. The Success status indicates that data is successfully logged; the Incomplete status indicates that data is possibly not completely logged while the Failed status is given to shadow copies of files whose transmission was blocked by Content-Aware Rules.

• Date/Time - the date and the time when the data was transferred.

• Source - the type of device or protocol involved.

• Action - the user's activity type.

• File Name - the original path to the file or the auto-generated name of the data that originally was not a file (such as CD/DVD/BD images, data written directly to the media or transferred through the serial/parallel ports).

• File Size - the size of the data.

• User - the name of the user transferred the data.

• PID - the identifier of the process used to transfer the data.

• Process - fully qualified path to the process executable file. In some cases, the process name may be displayed instead of the path.

Use the context menu available via a right mouse click on every record.

Open

To open the file from a selected record with its associated application, use Open from the context menu. If there is no associated application then the 'Open With' dialog box is shown.

If you use Open for shadowing data captured from either Printer or Parallel port device types then the associated application is always the built-in viewer called DeviceLock Printer Viewer.

DeviceLock Printer Viewer is able to show you the shadowed printed document in the native print spooler format, send it to the printer again, or save it as a graphic file (such as BMP, GIF, JPEG, PNG, EMF or TIFF). Next print spooler formats are supported: PostScript, PCL5, PCL6 (PCL XL), HP-GL/2, GDI printing (ZjStream) and EMF Spooled Files.

In case the record has no associated data (its size is 0 or it was not logged), Open is disabled.

When you are opening the large file, you can press the Cancel button on the progress bar to abort the opening process. In this case the application will get only that part of the data which was received before you aborted the opening process.

Save

If you need to save data from a selected record to your local computer, use Save from the context menu or press the appropriate button on the toolbar. Using Ctrl and/or Shift you can highlight and save the data from several records simultaneously.

In case the record has no associated data (its size is 0 or it was not logged), Save is disabled in the context menu and on the toolbar.

The progress bar appears when you are saving a large file. You may press the Cancel button at any time to abort the saving process. In this case the resultant file on the local computer will be incomplete and will contain only that part of the data which was received before you aborted the saving process.

If the data was transferred by the user as a file, it is stored in the shadow log as a file and can be saved to the local computer as a file too.

When a user has written data to a CD/DVD/BD disk, all data is stored in a shadow log as a single CD/DVD/BD image (one image per each written CD/DVD/BD disk or session) in the CUE format.

CD/DVD/BD images as well as other data that originally was not transferred as files (direct media access or serial/parallel ports transfer) have auto-generated names based on the action's type, drive's letter or device's name and time/date (e.g. direct_write(E:) 19:18:29 17.07.2006.bin).

Each CD/DVD/BD image is saved to the local computer as two files: the data file with the .bin extension (e.g. direct_write(E_) 19_18_29 17_07_2006.bin) and the cue sheet file that has the same name as its data file with the .cue extension (e.g. direct_write(E_) 19_18_29 17_07_2006_bin.cue). Both these files are necessary to open the CD/DVD/BD image in the external application that supports the CUE format (such as Cdrwin, Nero, DAEMON Tools, IsoBuster, UltraISO, WinISO and many others).

Save As Raw Data

When you select a record that contains the data originally written as an additional session to a multi-session CD/DVD/BD disk, the Save As Raw Data item is available in the context menu. It allows you to save the data to the local computer as is (without fixing references to the data in previous sessions).

If you are using the regular saving function (the Save menu item or the toolbar's button), DeviceLock Management Console detects that the CD/DVD/BD image contains a session that refers to the data in other (previous) sessions. Since the previous sessions are not available (they could be written on the computer where DeviceLock Service is not installed), DeviceLock Management Console locates and fixes all references to these non-existent sessions to make the .cue file readable by applications that support this format.

However, if you need to get the data that wasn't modified by DeviceLock Management Console, use Save As Raw Data. In this case the resultant file may be unreadable by applications that support the CUE format.

When saving large files, you can press the Cancel button on the progress bar to abort the saving process. In this case the resultant file on the local computer will contain only that part of the data which was received before you aborted the saving process.

View

To open the data in the built-in viewer, use View from the context menu.

When you are opening the large file, you can press the Cancel button on the progress bar to abort the opening process. In this case the viewer will show only that part of the data which was received before you aborted the opening process.

External Viewer

Also, you can define the external program that will be used to view the shadow data. If such an external application is defined, External Viewer is enabled in the context menu. To define it, open Regedit and set the following entry on the computer where DeviceLock Management Console is running:

- Key: HKEY_CURRENT_USER\Software\SmartLine Vision\DLManager\Manager

- Name: ExternalShadowViewer

- Type: REG_SZ

- Value: <full_path_to_viewer> %1

where <full_path_to_viewer> must be replaced by the full path to the external application. If this path contains spaces, use quotation marks. For example: "C:\Program Files\Microsoft Office\OFFICE11\winword.exe" %1.

When you are opening a large file, you can press the Cancel button on the progress bar to abort the opening process. In this case the external application will receive only that part of the data which was received before you aborted the opening process.

Delete