Docs / Audit Logging

Audit Log

Lanview records audit events for administration and support activity.

Audit logging helps organisations review what happened, who requested an action, which device or object was involved, and whether the action succeeded, failed or was denied.

Audit records are stored by Lanview Server and can be viewed through Lanview Studio by users with the required permissions.

What audit logging is for

Lanview audit logging is intended to support operational review, security review and accountability.

It can help answer questions such as:

Who signed in to Lanview Studio?
Who approved or rejected a device?
Who requested Remote View or Remote Control?
Which user changed a Server setting?
Which action was denied because of missing permissions?
What reason was supplied for a sensitive action?

Audit logging is separate from technical application logs. Application logs are used for troubleshooting. Audit records are used to review administrative activity.

Where audit records are viewed

Audit information may be available in several areas, depending on permissions and the current Lanview feature set.

Common locations include:

Device Window > Audit Log for device related history.
Security or audit areas in Lanview Studio where available.
Lanview console audit commands for authorised administrators.
Supported export or reporting functions where enabled.

The exact views available depend on the user’s permissions and Lanview configuration.

Required permissions

Audit access is permission controlled.

Common permissions include:

Permission	Allows
`device.audit_log.view`	View device audit history.
`device.audit_log.export`	Export device audit search results where supported.
`server.console`	Run permitted console commands where available.
`Settings.Server.View`	View audit related Server settings and diagnostics.
`Settings.Server.Manage`	Change audit related Server settings.

Assign audit viewing and export permissions based on the organisation’s operational and compliance requirements.

What gets audited

Lanview Server can record audit events for many types of activity, including:

Authentication and sign out.
Permission denied events.
Missing required reason events.
Device approval, rejection, deletion, blocking and renaming.
Remote View and Remote Control activity.
Remote execution and task activity.
Power actions.
Service and process control.
File transfer activity.
Package and deployment activity.
Monitoring configuration.
Settings changes.
Security user and role administration.
Audit retention cleanup.

The audit record depends on the action being performed and the information available at the time.

Reasons and audit prompts

Lanview can require a reason before allowing certain sensitive actions.

When reason prompts are enabled, Lanview Studio asks the operator to enter a reason before the action continues.

Reasons are stored with the audit record so the action can be reviewed later. They are commonly used to link an administrative action to a support ticket, change request, incident, user request or internal approval process.

The organisation using Lanview decides what is considered a valid reason. Lanview records the supplied reason and applies the minimum reason length configured on Lanview Server.

Audit settings

Lanview Server controls audit behaviour through Server settings.

Common settings include:

Setting	Purpose
`AuditMode`	Controls the audit mode used by Lanview Server.
`AuditRetentionEnabled`	Controls whether audit retention cleanup is enabled.
`AuditRetentionDays`	Controls how long audit records are retained before cleanup.
`AuditRequireReasonForSensitiveActions`	Controls whether sensitive actions require a reason.
`AuditMinimumReasonLength`	Controls the minimum length of a supplied reason.

Only authorised administrators should change audit settings.

Audit retention

Audit retention controls how long audit records are kept before they are eligible for cleanup.

Retention settings should be agreed with the organisation’s operational, legal and compliance requirements.

Before reducing retention, consider whether audit records are needed for investigations, support review, internal policy or external compliance.

Privacy and sensitive data

Lanview audit records are intended to record administrative activity, not to capture unnecessary user content.

For Remote View and Remote Control, Lanview does not record typed text, screen frames, screenshots or video as part of the audit record.

Audit records should still be treated as sensitive administrative data because they may contain usernames, device names, action details, reasons and timestamps.

Console commands

Authorised administrators may use Lanview console commands to review or manage audit data.

Common audit related commands include:

audit.show
audit.find
audit.event.show <eventId>
audit.retention.show
audit.cleanup.preview
audit.cleanup.apply
config.audit.mode
config.audit.retentionDays
config.audit.requireReasonForSensitiveActions
config.audit.minimumReasonLength

Use cleanup commands carefully. Audit retention and cleanup should follow the organisation’s agreed policy.

Troubleshooting

Audit records are not visible

Check that the user has the required audit viewing permissions.

A reason prompt appears before an action

Reason prompts are controlled by Lanview Server settings and the type of action being performed.

Enter a reason that matches the organisation’s internal policy.

Audit cleanup does not remove expected records

Check whether audit retention is enabled, what retention period is configured and whether the cleanup was run in preview or apply mode.

Audit export is unavailable

Export availability depends on the current Lanview feature set and the user’s permissions. Use the supported Lanview views and commands available in your installation.