Monitoring

View Monitoring enables creating and managing monitoring configuration templates for computers. An administrator can define any number of profiles and assign them to devices. Based on these profiles, data is collected regarding device performance, print history, user activity monitoring, and many other parameters.

Note: Tab Monitoring settings does not include DLP policies. Information about them can be found in the documentation in Data Protection.

Monitoring settings view

The view presents a list of created templates as tiles that contain the following information:

• Profile name – A unique name for the monitoring configuration.

• Creation date – Information about the date the profile was added.

• Last edited/By Date of last edit and the user who edited it.

• Action buttons:

  • Edit – Opens the configuration side menu.

  • Duplicate – Creates a copy of the existing profile.

  • Delete – Permanently deletes the profile.

Monitoring profile configuration

List of available options

During configuration, the administrator can select the following monitoring elements:

• Services

• Printing

• Event logs

• Network

• User activity

• Task scheduler

• E-mail

• Performance

• RDP sessions

Each option has a checkbox fieldthat enables or disables monitoring. For more complex elements, an icon is available gear leading to Advanced settings.

Details of individual option configurations

Services

Simple monitoring of Windows services, allowing them to be stopped, restarted, or started.

User activity

Records the activity of pointing devices - keyboard and mouse.

By default, the system monitors all started processes for user activity. It is possible to exclude selected processes, e.g., Chrome, from monitoring. If a process is excluded, the system will not record information about whether the user was active or inactive in it.

The system allows configuring the maximum user inactivity time. The default value is 60 seconds. This means that as long as the user does not exceed 60 seconds without using the keyboard or mouse, they are shown as active. After exceeding this time, the system marks them as inactive and records this in the logs.

This value can be adjusted freely in seconds; for example, setting 180 means 3 minutes of inactivity before marking the user as passive. This parameter is assigned per computer and applies to the user logged in there.

Printing

Monitoring of prints from physical devices and virtual printers, including saving to PDF via the print mechanism. The number of pages, color or mono mode, and document size are recorded. It is also possible to define printing costs - details are described in the Printing.

Here we define the monitored printers by name. The default value is *, which means monitoring all printers detected in the system. Specific names can be specified, e.g., Printer123.

The exclusion mechanism works analogously. If we do not want print-to-PDF operations to appear in monitoring, we can add, for example, *pdf*. However, note that this will exclude any printer containing the phrase “pdf” in its name, e.g., HPPDF123.

The safest approach is to specify the exact name visible in the system, e.g., “Print to PDF”.

Event logs

Monitoring Windows logs with the ability to select the type, kind, and number of recent events for analysis.

NOTE!

When selecting log types to monitor, keep in mind that levels such as Debug and other detailed entries generate a very large number of events. This can cause significant database load - in extreme cases even an enormous number of entries per minute.

It is recommended to enable such logging levels judiciously. A good approach is to create a separate configuration and assign it only to selected devices in situations where detailed monitoring of a specific case is required.

This should be taken into account in the context of limitations resulting from the system plan - for example, in the Free plan the available database space is 10 GB per account.

Network

Monitoring of network traffic generated by selected processes.

There is the possibility to add or exclude specific processes from monitoring. If a process is excluded, the system will not record data sent or received by that process.

For example, to exclude the Chrome browser or Microsoft Teams, specify the process name, e.g., chrome.exe, ms-teams.exe or use a pattern, e.g., *chrome*.

Computer performance

Performance monitoring allows detailed analysis of system resources. The following parameters are available:

• Available memory

  • Shows the amount of memory available to the system and new processes.

• Used memory

  • Shows overall memory usage in the system, taking into account different allocation types such as physical memory or cached memory.

• CPU usage

  • Illustrates overall processor load, taking into account all cores. Enables system performance analysis.

• Disk utilization

  • Shows disk activity, including the number of read and write operations, and the time required to complete them.

• Disk queue length

  • Shows the number of I/O operations waiting to be performed, which allows assessing disk load.

Task scheduler

Monitoring of the Windows system event scheduler.

E-mail

Monitoring of outgoing mail in desktop Outlook (recipient, user, subject, attachment, date). Advanced configuration such as blocking file sending in email via DLP is available in Data Protection.

RDP

Recording of remote desktop (RDP) sessions, including who and when connected, with which account, and the moment the session ended.

Summary

View "Monitoring settings" enables administrators to comprehensively manage device monitoring templates. Thanks to the wide range of available options and integration with Data Protection this feature allows tailoring monitoring to the organization’s specific needs, supporting optimization of device performance and data security.