Where is the MassLynx Security Log File (mlevt) located? - WKB5482

ENVIRONMENT

MassLynx 4.1 Security

ANSWER

The audit log file is named mlevt (MassLynx Events), and the default location is in the following folder: 

C:\Windows\MMAuditLog.

The log file is a hidden file by default. To see the .mlevt file, set up Windows Explorer as follows:

1. Choose Organize > Folder and Search options > View tab.
2. "Show hidden files, folders, and drives" must be selected.
3. "Hide protected operating system files" must be cleared.

When MassLynx software is installed, the user has the option of changing the location of the audit log file, so if the file cannot be found in Windows Explorer, then it may be because the user changed the location when they installed MassLynx.  

Note: it is recommended that during MassLynx installation, the location is set to a folder on a local drive, i.e. one that is physically attached to the main BUS of the computer and  displayed in disk manager, rather than a network drive. This is because if a network drive is chosen but Windows has not been correctly configured on both PCs, the software installation will probably hang. It is safer to enable remote logging later via the security manager, if required.

ADDITIONAL INFORMATION

The audit log is a secure system file that records all user activity in MassLynx Security.

The information in the log is stored in a proprietary encrypted format that cannot be edited or read by any program other than the MassLynx securitylogservice.

The securitylogservice starts on demand by the operating system whenever a MassLynx program needs to use it. It does not need to be started or stopped by the user.

Users access the audit log by using the LogLynx viewer, which can be found at: Start > All Programs > MassLynx > LogLynx. The information in the log can be exported and restored using the tools in the LogLynx program.

The logs can be protected from disaster by using the SectionTool program and backing up the resulting file(s) (see How to backup and restore the mlevt file using Section Tool in MassLynx Security - wkb16246).

Note: if you cannot find the mlevt file, it should be possible to use Procmon to give the file path:

• Stop the securitylogservice in Task Manager
• Download ProcMon from the Microsoft website
• Setup the Procmon filter to only show the securitylogservice.exe
• Login to ML or the MSM, in order to re-start the securitylogservice.
• Examine the log for the path to the mlevt file.