The Audit feature in RealVNC Connect provides comprehensive logging for key events regarding your RealVNC Connect team, such as when people are added or removed from your team, when a person's role is changed, and when cloud connections made to your computers. If your subscription does not include Audit (see above), please contact our Sales team to discuss adding it.
How do I access Audit events?
Viewing a summary list of events
Audit events are available to Managers, Admins and Owners of Teams in the RealVNC Connect Portal on the Audit page, found in the Add-ons section.
By default, Audit events from the last 14 days will be shown, however there are controls to search for events from other periods of time.
Audit event data is kept for 30 days.
Viewing more details about an event
Each event can be clicked/tapped on to bring up more details about the event in a popup dialog that contains additional data fields.
Can I export Audit events?
Audit events can be exported from the portal as a CSV file which can be imported into other systems, such as a SIEM, or accessed using RealVNC Connect's API Access.
Which events are logged by Audit?
Audit events are broken down into 2 categories, Team Management and Session Logs. A list of the different events in each category and a short description about the event can be found below.
Team Management
| Event Type | This event is logged when... |
|---|---|
| User invited to team | A user is invited to join the RealVNC Connect team using the People page of the RealVNC Connect Portal to allow them to access your devices via the cloud. |
| User accepted invitation | A user accepts a RealVNC Connect team invitation, either by clicking the link in the invitation email or using the RealVNC Connect Portal. |
| User removed from team | A user is removed from the RealVNC Connect team using the People page of the RealVNC Connect Portal to prevent them accessing your devices via the cloud. |
| User role changed | A user's role is changed using the People page of the RealVNC Connect Portal, e.g. from User to Manager. |
| User changed email address | A user changes the email address registered to their RealVNC account using the Profile page of the RealVNC Connect Portal. |
| User created cloud join token | Either:
|
| User revoked cloud join token | A Manager/Admin/Owner revokes a cloud connectivity token using the Device Access -> Deployment page of the RealVNC Connect Portal. |
Session Logs
Audit events are created for cloud connections made to devices joined to your RealVNC Connect team.
Direct connections are not currently logged by Audit, and instead stored locally on each RealVNC Server.
| Event Type | This event is logged when |
|---|---|
| Connection start | A cloud connection is initiated by a user in RealVNC Viewer. |
| Connection end |
Available with RealVNC Server 7.8.0 A cloud connection to a remote device is ended. |
| Connection authentication success |
Available with RealVNC Server 7.8.0 A cloud connection to a remote device is established successfully and a remote access session took place. |
| Connection authentication fail |
Available with RealVNC Server 7.8.0 A cloud connection to a remote device is not established due to a failed authentication attempt, such as an incorrect username or password being supplied, or access being denied due to inadequate permissions for the connecting user. |
| Connection fail | A cloud connection to a remote device is not established due to a connectivity failure, such as RealVNC Server being offline and not listening for cloud connections. |
| Server stopped | RealVNC Server has been stopped on the remote device while there is an active connection to it, for example when the computer running RealVNC Server is shut down. Connections to the device are not possible. This is only logged when a connection end event is not sent by RealVNC Server. |
Comments
Article is closed for comments.