The event that logs basic, general information related to the sudden termination of a remote session is grouped under the general category.
The Abnormal Termination Detected audit event is logged when a remote management session is terminated suddenly and abnormally. This occurs when either the network is disconnected or when vnc viewer process is killed. This event logs an audit event with basic information of an abnormally terminated remote session.
To enable an Abnormal Termination Detected audit event during the Remote Control operation on a device:
Log in to ZENworks Control Center on a server that has Windows devices.
Click Configuration > Audit Management > Events Configuration.
In the Events Configuration page, click Agent Events > Add.
In the Add Agent Events dialog box, select the Abnormal Termination Detected checkbox under Remote Management > General.
Configure the event settings such as Event classification, Days to keep, NotificationTypes, and so forth, for the Abnormal Termination Detected event, then click Apply.
Click OK to add the Abnormal Termination Detected event and close the Add AgentEvents dialog box.
In ZENworks Control Center, click Devices > Workstations
Select a Windows device, then click Remote Control to remotely manage that device.
When the Remote Control operation is in progress, do the following on the management console:
Press Ctrl+Alt+Del to invoke the Task Manager.
Click the Processes tab, then select nzrViewer.exe from the list.
Click End to kill the nzrViewer.exe process. The managed device will either be locked or logged off which indicates that the Abnormal Termination is detected and the Abnormal Termination Detected event is logged.
NOTE:In a remote management operation that is performed through Join Proxy, when the viewer crashes, and the session is closed, the abnormal termination event is not generated.