Reviewing logs of connections to RealVNC Server

In addition to RealVNC Connect's Audit feature, RealVNC Server logs all connections locally.

On Windows, this is to the Windows Event Log. For every connection, the following information is logged:

1. Connection to [server-cloud-id] is from user <RealVNC-account-email>
2. Connected: <RealVNC-account-email> (from <IP:port>)
3. <Authentication-success | failure> <RealVNC-account-email> (from <IP:port>) as <Windows account user> (RealVNC Server permission)
4. Disconnected: <RealVNC-account-email> (from <IP:port>)(<disconnection-reason>)

To view this information:

1. Open Event Viewer by searching with the Windows Start Menu.
2. Select Windows Logs > Application.

3. Select Filter Current Log and choose VNC Server as the Event sources:

   

For more information on logging in general, and particularly about other platforms, visit: All About Logging.

For information about storing logs centrally, please see Centralised logging for VNC Server.