Control of user actions when exporting a file containing sensitive or protected information from the qlikview web application

[qwert2012tutor]

The problem:
In order to control the downloading of sensitive or protected information by users from the qlikview web application, the information security administrator needs the ability to compare user actions in logging files and the name of the downloaded file.

What we have:

QlikView Build Info: release/QV12-40/63
When a user exports a file from the qlikview web application, the server creates the file in a folder ..\ProgramData\QlikTech\qlikviewserver\Temp and then passes it to the user's machine. An entry is made in the audit file about the export of the file. However, it is not possible to uniquely match the name of the downloaded file and the entry in the audit file.

The proposed solution:
We suggest adding a field containing the name of the downloaded file to the logging file, and adding a session ID to each file name. This structure will allow you to uniquely determine the type and volume of information downloaded by the user. In order for this system to work, we need to create an application that transfers the downloaded files from ..\ProgramData\QlikTech\qlikviewserver\Temp to the archive database

We ask for help in solving the problem.

[Bill_Britt · Accepted solution]

Hi,

You have to look at two logs. The first is the Audit log to find the download.

20210419T091102.000-0400 20210419T091552.000-0400 C:/Documents/data visualization.qvw SendToExcel L50\Administrator Sheet Object Document\CH26 3 88eefd3f-7ddc-41ec-a7ee-fceb62e09b89
20210419T091102.000-0400 20210419T091612.000-0400 C:/Documents/data visualization.qvw Export L50\Administrator Sheet Object Document\CH26 3 88eefd3f-7ddc-41ec-a7ee-fceb62e09b89

The above in red is what you need to look for in the QVS event log.  There you will find the document and the user.

Line 435: 20210419T091102.000-0400 20210419T091128.000-0400 4 700 Information Document Load: The document C:\Documents\data visualization.qvw was loaded. 88eefd3f-7ddc-41ec-a7ee-fceb62e09b89
Line 436: 20210419T091102.000-0400 20210419T091128.000-0400 4 700 Information System: Server - UpdateSharedFile: updating DONE for document C:\DOCUMENTS\DATA VISUALIZATION.QVW (elapsed time: 0 ms) 88eefd3f-7ddc-41ec-a7ee-fceb62e09b89
Line 437: 20210419T091102.000-0400 20210419T091128.000-0400 4 700 Information CAL usage: Named CAL "L50\ADMINISTRATOR" now used - ok. 88eefd3f-7ddc-41ec-a7ee-fceb62e09b89

Bill