Copyright: © JONESDC


Help Contents
Contents

Introduction

Introduction to MassLynx Security

The MassLynx Security Model

Installing the Security System

Starting a MassLynx Application

Starting a MassLynx Application when Security is Enabled

Starting a MassLynx Application when Security is Disabled

Windows Logon Security

The MassLynx Security Manager

The MassLynx Security Manager

Starting the MassLynx Security Manager

The MassLynx Security Manager Facilities

Creating a New User

Changing User Details

Creating a New Group

Changing Group Details

Deleting a User or a Group

MassLynx User Rights

Configuring the Audit Policy Settings

Configuring the Signature Policy Settings

Configuring the Dual Authorization Policy Settings

Locking MassLynx and the MassLynx Security Editor

Signatures

Signatures

Items that may be Signed

Printed Signatures

The Dual Authorization Policy

The Dual Authorization Policy

The BackLynx Utility

The BackLynx Utility

Opening the BackLynx User Interface

The BackLynx User Interface

Starting an Operation

The BackLynx Scheduler

Operation

The LogLynx Utility

The LogLynx Utility

Auditable Events

Opening the LogLynx User Interface

The LogLynx User Interface Menu Bar

Exporting Audit Log Data

Importing Audit Log Data

Deleting Audit Log Data

The LogLynx User Interface Tree and Event Windows

Query Filters

Event Details


Introduction to MassLynx Security

When installing MassLynx, any one of the following MassLynx Security System options may be installed (refer to Installing the Security System for details):

•	No security.

•	Security installed with "Secure File Access". In this option, the integrity of files is maintained, an audit trail is maintained in the Audit Log and the NT File System (NTFS) ensures that the files are written by the MassLynx User (who is not necessarily the Windows User, see below). This security is often referred to as "Secure Files".

•	Security compliant with Good Laboratory Practice (GLP); this does not have the secure file access, signatures and audit trail features of the above option. This security is often referred to as "Non-Secure Files".

The MassLynx Security System performs tasks such as User Account management and Group management, logging Users in and out of MassLynx, and checking their Access Privileges. All events are logged, complete with electronic signatures, so that a complete Audit Trail is maintained at all times. The event log forming the Audit Trail is viewed by the LogLynx utility; for further details of this utility and the types of events that are logged, see  The LogLynx Utility.

The MassLynx Security Manager allows a System Administrator to control User Group access to the MassLynx system and control the range of operations available to User Groups when using MassLynx, see  The MassLynx Security Manager.

Each site using MassLynx Security must initially set up its Windows User Accounts. Each User must have a Password and a unique combination of User Name and domain name. Each User's Password must not be known by the System Administrator; similarly, Users must not know the System Administrator's, or the local Administrator's, Password. Site and workstation policies can be set up to allow individual Groups of Users access to only permitted data and operations on a MassLynx workstation.

When starting MassLynx with Security enabled, the User must enter their details in a MassLynx Login dialog that identifies the User to MassLynx, see  Starting a MassLynx Application when Security is Enabled . Note that this means that the MassLynx User is not necessarily the same person who has logged onto Windows on the PC.

The Windows Explorer application cannot be used to manipulate MassLynx secure files whilst maintaining security. If Windows Explorer is used to copy secure files, they cannot then be used in MassLynx, as copied files are not auditable and constitute a breach of security. Hence, the BackLynx utility is provided; this allows files to be copied between locations without invalidating them, refer to The BackLynx Utility for full details. Each file copied by BackLynx, has an associated checksum (.CSM) file; this contains details such as the creator (User), PC on which the file was created, file path, size, time and date created, checksum of contents, etc. If any of these details are found to have changed when an attempt is next made to open the file, MassLynx security will assume that the file has been tampered with, prevent the file from being re-opened, and generate a security alert.

Note:

Windows Explorer can still be used to manipulate files if they are not used in a secure MassLynx environment.


The MassLynx Security Model

The MassLynx Security Model is based around User Accounts; each User is a member of a Group, which has Access Privileges. A User cannot be directly given Access Privileges.

The components of the MassLynx Security System are shown in the following Figure; it will be noted that the MassLynx Security Subsystem works in conjunction with the Windows NT Security Subsystem.

Validate User Account

The system whereby MassLynx Security is presented with a User Name and Password (validated by the Windows Security Subsystem) to check against the existing User Accounts. If an Account is found for the specified User Name, and the Password is correct, the User is allowed to proceed. All subsequent access requests can then be validated by MassLynx. Any information written to the Audit Log will contain a reference to the login User Name.

File Access

Allows the User to access files, based on the permissions contained in the Windows Security Subsystem.

MassLynx Security Subsystem: Access Validation

Whenever an attempt is made to enter a protected area of MassLynx or the Security Manager, a check is made to determine whether the Group to which the currently logged-in User belongs is allowed access to that area. An entry is also written to the Audit Log to reflect the outcome of the access attempt.

MassLynx Security Subsystem: Audit Log Management

The Audit Log management system is used to maintain the Audit Log.

Windows NT Security Subsystem: Validate Account Password

The NT LAN Manager (NTLM) controls the Authentication Protocol used for validating the Account Password.

Windows NT Security Subsystem: File Permissions

The NT File System (NTFS) controls the file permissions, which specify the files a User may access.


Installing the Security System

The Security System is installed as an option when installing MassLynx from the MassLynx Installation CD; refer to Installing MassLynx (MassLynx NT User's Guide) for details of how to install MassLynx. Refer to Installation for Security System installation details.

More:

Pre-Installation Set Up

Installation


Pre-Installation Set Up

Hardware

If there is more than one MassLynx controlled instrument in the same regulated group on site, then a dedicated logging PC is recommended, in addition to the PC required for each instrument.

System Requirements

The following are required to run MassLynx Security:

•	One of the following operating systems:

•	English Language Version Windows NT V4.0 with Service Pack 6a.

•	English Language Version Windows 2000 with Service Pack 2.

•	English Language Version Windows XP Professional.

•	English Language Version NT Server.

•	English Language Version 2000 Server.

•	English Language Version 2000 Advanced Server.

•	The file system must be NTFS.

•	The Workstation Messenger and Alerter services must be set to Started and Automatic.

•	The account used to install MassLynx should have Windows administrator privileges on the local PC.

•	As an additional security measure, the logged on Desktop User should not have access to the Telnet and HyperTerminal applications.


Installation

The MassLynx Security Manager and hence, MassLynx Security System, is installed when installing the MassLynx application; refer to Installing MassLynx (MassLynx NT User's Guide) for details of how to start the MassLynx installation.

More:

The MassLynx Security Options dialog

The MassLynx Security Parameters Options dialog

The MassLynx Remote Log Service Options dialog

The MassLynx Optional Security Packages dialog

The Wizard Completed dialog


The MassLynx Security Options dialog

The MassLynx Security Options dialog gives the option of installing the MassLynx Security Manager.

Select the No option if no MassLynx Security is required. Select the Yes option if MassLynx Security is required; selecting the Next> button then invokes the MassLynx Security Parameters Options dialog, see  The MassLynx Security Parameters Options dialog.


The MassLynx Security Parameters Options dialog

The MassLynx Security Parameters Options dialog allows the option of installing a previously stored set of security parameters as an alternative to the default MassLynx security parameters. The existing security parameters may be retained if MassLynx is being reinstalled on the computer.

Options Frame
Default   Settings	Imports the default MassLynx security parameters.
Retain   Settings	Retains the current MassLynx security parameters when re-installing MassLynx. Note: The Retain Settings option is only available if MassLynx security has been previously installed on the computer.
Import   Settings	Imports a stored set of security parameters, selected in the Import Options Frame.
Import Options Frame	This Frame is only enabled when the Import Settings option is selected.
Locate   Security    rollout file:	Select the Browse button to invoke a browser and select the file containing the required security parameters. The file type is .SRF (Security Rollout File).
The MassLynx Optional Security Packages dialog is invoked when the MassLynx Security Parameters Options dialog Next > button is selected, see  The MassLynx Optional Security Packages dialog.


The MassLynx Remote Log Service Options dialog

The MassLynx Remote Log Service Options dialog allows a remote computer (the remote log server) to be used to store MassLynx audit log information. Refer to Configuring the Audit Policy Settings for further details of remote logging.

Note:

1.	The MassLynx Remote Log Service Options dialog will not be displayed if the MassLynx Security Parameters Options dialog Import Settings has been selected, see  The MassLynx Security Options dialog.

2.	If a remote log server is to be used, MassLynx with security should be set up on that computer before installing MassLynx on the local PC(s).

Enter the name of the remote log server in the Options text box. A security rollout file, which includes details of the remote log server, may be used as an alternative to entering a remote log server name in the Options text box; see  The MassLynx Security Parameters Options dialog.

Note:

If the remote log server is changed later, the entry in the MSM Audit Policy dialog Store On text box must be changed to suit on all the local PCs.

A remote log server is not used if the default computer name (the local machine) is left in the Options text box.

When the MassLynx Remote Log Service Options dialog Next> button is selected, the MassLynx installation continues; follow the on-screen instructions. Eventually the Wizard Completed dialog is invoked, see  The Wizard Completed dialog.


The MassLynx Optional Security Packages dialog

The MassLynx Optional Security Packages dialog allows the MassLynx Security options to be selected.

MassLynx Secure File Access	When selected, "Secure Files" security is installed; otherwise, "Non-Secure Files" security is installed.
Backup Scheduler	Installs the BackLynx utility; this allows files to be copied, moved, archived and restored without invalidating them; refer to  The BackLynx Utility.
Audit Event And Audit Trail Viewer	Installs the LogLynx Utility; this is the viewer for the Audit Log, refer to The LogLynx Utility for details.
The MassLynx Remote Log Service Options dialog is invoked when the MassLynx Optional Security Packages dialog Next > button is selected, see  The MassLynx Remote Log Service Options dialog.


The Wizard Completed dialog

Select the Create Checksums button; the Administrator Confirmation Required dialog is invoked. Enter the Logon Name and Password of a MassLynx User on the left-hand-side; enter the Logon Name and Password of a MassLynx Administrator on the right-hand-side, see The Dual Authorization Policy for details.

Note:

To aid this process, a new installation of MassLynx automatically creates a MassLynx User, with the Windows account <Local Machine>\Micromass, and a MassLynx administrator, with the Windows account <Local Machine>\Administrator.

If there is no local NT user named <Local Machine>\Micromass, the local administrator account has been renamed, or the local administrator account has a blank password, these conditions will need to be corrected before installation can proceed.

The <Local Machine>\Micromass account must be removed from MassLynx security as soon as possible after the installation is completed, and replaced by real account information (with private passwords). Refer to The MassLynx Security Manager for details.

Select the OK button; the Importing Secure Files window is invoked; this displays information on the progress of importing secure MassLynx files.

The Cancel button changes to Close when all the secure MassLynx files have been imported, select this button to end the installation.


Starting a MassLynx Application when Security is Enabled

When starting a MassLynx application with Security enabled, the MassLynx Login dialog is invoked.

Note:

1.	MassLynx applications and the MassLynx Security Manager cannot be run simultaneously.

2.	The MassLynx Login dialog is also invoked if a User has logged out of MassLynx, whilst leaving the application running (by using the MassLynx Menu Bar Security, Log Off command).

3.	When the MassLynx Login dialog is invoked, the Logon Name: and Domain boxes will contain the entries last used for the application, unless specified otherwise in the MassLynx Security Manager (MSM).

The details entered in this dialog form the User's identification to the MassLynx Security System and must uniquely identify the User (site policy procedures should ensure this). The User must enter their Logon Name: and Password:, select a Domain from the list box and select the OK push-button.

If the MassLynx Security System accepts the information that has been entered, a Group Warning message will appear.

Select the OK push-button to start the MassLynx application.

If one of the following messages appears after entering the information in the MassLynx Login dialog, the User must check that the Logon Name:, Password: and Domain are correct. If the message still appears, then it is possible that the User does not have a User Account with MassLynx Security, or the Account may have been disabled by the Administrator. The Administrator should be asked to check the Account.

Security Logon Message 1

Security Logon Message 2

The name used to login determines the level of access allowed within the MassLynx application. If the User does not have full administrative privileges, this message may appear at some point while using one of these applications.

If the User needs to access the particular area, the Administrator will need to make the User a member of a Group with the necessary Access Privileges.


Starting a MassLynx Application when Security is Disabled

When the Non-Secure Files Mode is installed, the Administrator can disable MassLynx Security (in the MSM).

Note:

This does not apply when the Secure Files Mode is installed.

When starting a MassLynx application with MassLynx Security disabled and the Use Individual INI files option deselected, the MassLynx splash screen is invoked before MassLynx is opened.

When starting a MassLynx application with MassLynx Security disabled and the Use Individual INI files option selected, the MassLynx Non-Secure Login dialog is invoked; in this case, the User has to enter their User Name.

Note:

When the MassLynx Non-Secure Login dialog is invoked the User Name: box will contain the entry last used for the application, unless specified otherwise in the MassLynx Security Manager.


Windows Logon Security

Windows can be set to the control age of a Password (i.e. the period, in days, for which the Password can be used before it has to be changed), and to lock a User out of the system after repeated failures to logon to a MassLynx application. Local site policy should define these parameters, which are set in the Windows Local Security Settings dialog; this is invoked via the Windows Start, Settings, Control Panel, Administrative Tools, Local Security Policy option.


The MassLynx Security Manager - The MassLynx Security Manager
The MassLynx Security Manager

The MassLynx Security Manager (MSM) is used to administer MassLynx security, i.e. assign Access Privileges, set up User Accounts and Groups, etc.

Note:

The MassLynx Security Manager and MassLynx (or any MassLynx Application Manager) cannot be run simultaneously; MassLynx must be closed down before any administration can take place.


Starting the MassLynx Security Manager

The MSM is started by selecting the Windows Task Bar Start, Programs, MassLynx, Security Editor option or by double-clicking on the Security Editor shortcut (if one has been created).

Note:

When either of the above options is selected, the MassLynx Login dialog is automatically invoked before the MSM starts; the User must enter the required details in order to proceed, see  Starting a MassLynx Application when Security is Enabled .

If the User is a member of the Administrators Group and MassLynx Security is enabled, the details in the MSM are editable and all functions are accessible. For Users belonging to other Groups, only a limited number of facilities can be seen or used as follows:

•	Details of Usernames that are allowed entry to MassLynx on this workstation may be viewed.

•	Details of User Groups that are configured for MassLynx on this workstation may be viewed.

•	The Windows Event Viewer (Local) and Windows Local Users and Groups Manager may be accessed (according to the Windows permissions of the User). If the MSM is opened on a server that is a domain controller, the Domain User's Configuration will be displayed.

Note:

The MSM will lock automatically after a set time when no actions have been made, see  The MSM Menu Bar: Policies Menu.


The MassLynx Security Manager Facilities

The MSM Menu Bar: File Menu

The MSM Menu Bar: Create Menu

The MSM Menu Bar: Policies Menu

The MSM Menu Bar: Tools Menu

The MSM Menu Bar: View Menu

The MSM Menu Bar: Help Menu

The MSM Tool Bar


The MSM Menu Bar: File Menu

Save	Saves all the security parameter settings currently in the MSM. This command is grayed if no details have been changed since the file was last saved.
Import	Invokes an Open dialog, which allows an existing Security Rollout File to be imported into the MSM. See The MassLynx Security Parameters Options dialog for details. Note: The Accounts on one PC may not be available on another. Not all Domains will be accessible; where necessary, dialogs will be displayed to prevent invalid set-ups.
Export	Invokes the Save As dialog, which allows the security parameter settings currently in the MSM to be saved to a Security Rollout File (.SRF) for use on another PC, by using the Import option, or during an installation.
Print	Prints out all the settings currently in the MSM. This option should be used to store a record of the policy implemented on a MassLynx PC, or as a hardcopy report for an auditor.
Exit	Closes the MSM. Closing the MSM when changes have been made, but have not been saved by a member of the Administrators Group, invokes the following dialog; this prompts the User to save the security details.


The MSM Menu Bar: Create Menu

New User	Invokes the New User dialog, which allows a new User to be created, see Creating a New User  for details.
New Group	Invokes the New Group dialog, which allows a new Group to be created, see Creating a New Group  for details.
Delete	Deletes either the currently selected User, or the currently selected Group, depending on which item was last selected. This command is grayed if no item is selected.


The MSM Menu Bar: Policies Menu

MassLynx Security Enabled	Enables MassLynx Security; a checkmark appears beside the option when enabled. Note: This option is only available when the Non-Secure Files Security is installed; it is grayed-out when Secure Files Security is installed. MassLynx Security must be enabled for any other element of the MSM user interface to work, other than those parts accessible by non-administrative Users. If MassLynx Security is disabled, no MassLynx Login dialog will appear when MassLynx is started, and all security checks done by MassLynx will return true. Note: A login will still be required when opening the MSM.
Terminate On Crash	If this option and MassLynx Security are enabled, and one of the executables that make up the MassLynx suite crashes, then ALL executables that are part of that suite will be immediately terminated. This ensures that, even if a critical error occurs in any of the MassLynx suite of programs, the security system will not be invalidated. This option should be selected in a regulated environment, a checkmark appears beside the option when enabled.
Use Individual INI Files	When MassLynx is run with this option selected, the MassLynx configuration settings, held in the MassLynx.INI file, have a separate copy for each logged-on User. The file will be stored in and retrieved from <domain>_<user>.INI. For systems that require an embedded PC system, there also will be an individual copy of CONFIG.DAT for each User, in the MassLynx Instrument directory. If this option is not selected, any changes made in MassLynx will affect all Users. A checkmark appears beside this option when enabled.
Forget Last Username	When MassLynx is run with this option selected, any login dialog invoked will not display the Logon Name: and Domain last used for the application; the dialog fields will be blank. A checkmark appears beside this option when enabled.
Tamper Detection	If this option is selected and any component of MassLynx fails to open a file because the checksum details checks fail, a log entry is generated. The User is immediately informed (by a pop-up dialog) and an Administrator alert is sent to the configured computer, see  Configuring the Audit Policy Settings. The messages produced (log, alert, and dialog) indicate the reason for the failure. A checkmark appears beside this option when enabled.
Network File Access	This option applies ONLY to secure file access. When this option is selected, files in the MassLynx suite of applications may be read from, and saved to, network locations. If this option is disabled, any attempt to save to, or read from, files not on the local machine will fail. A checkmark appears beside this option when enabled. For further information, refer to  The BackLynx Utility.
User	Invokes the Windows Local Users and Groups dialog. This allows the MassLynx Administrator to review (or set-up if they have sufficient privileges) details of Windows login policies and passwords on the local PC. (This is as opposed to the domain accounts and policies that are normally used to set these items up.)
Audit	Invokes the Audit Policy dialog; this allows the Audit Policy Settings to be configured, see Configuring the Audit Policy Settings for details.
Signatures	Invokes the Signature Policy dialog; this allows the signature policy settings to be configured, see Configuring the Signature Policy Settings for details.
Dual Authorization	Invokes the Dual Authorization Policy dialog; this allows the Dual Authorization policy settings to be configured, see Configuring the Dual Authorization Policy Settings for details.
Timeout	Invokes the Timeout Settings dialog; this allows the security timeout period used by MassLynx and its associated application managers to be configured. After the timeout period expires, the Unlock MassLynx dialog is invoked and the User must log in to MassLynx again. Note: The Unlock MassLynx dialog is also invoked when a MassLynx is locked; see Locking MassLynx and the MassLynx Security Editor for details. The timeout from the last keyboard, or mouse movement is configured in minutes. The default setting is 5 minutes, the minimum setting is 0.5 minutes, and the maximum setting is 60 minutes.


The MSM Menu Bar: Tools Menu

Event Viewer	Invokes the Windows Event Viewer; this allows the Windows audit log to be viewed and (if Access Rights allow) the setting of audit log Rights and configuration. Windows NT Service problems often log information in the System Log that can be viewed in the Event Viewer. Note: This is not the same as the LogLynx User Interface, which is used to view the MassLynx audit log and audit trails, see  Opening the LogLynx User Interface.


The MSM Menu Bar: View Menu

Toolbar	Displays or hides the MSM Tool Bar. The Tool Bar holds shortcuts to items selectable from the Menu Bar, see The MSM Tool Bar for details.
Status Bar	Displays or hides the Status Bar at the bottom of the MSM; this contains information on the current state of the MSM and about any key adjusters (such as Caps Lock) that are currently selected.
Lock Security Editor	Locks the MSM so that it can be left unattended. The Unlock MassLynx dialog is invoked, so that the User has to enter their Password: in order to re-enter the MSM; see Locking MassLynx and the MassLynx Security Editor for details.


The MSM Menu Bar: Help Menu

About MassLynx Security Manager	Invokes a dialog describing the current version of the MSM.
Security	Opens the MassLynx help file at the section on security.


The MSM Tool Bar

Note:

The Tool Bar can be displayed or hidden by selecting the Menu Bar View, Toolbar command.

Tool Bar button	Menu equivalent	Purpose
	File, Save	Saves all the details currently in the MSM to disk. This tool is grayed if no details have been changed.
	File, Print	Prints out all the settings currently in the MSM.
	Create, New User	Invokes the New User dialog, which allows a new User to be created, see Creating a New User  for details.
	Create, New Group	Invokes the New Group dialog, which allows a new Group to be created, see Creating a New Group  for details.
	Create, Delete	Deletes either the currently selected User or the currently selected group, depending on which window was last selected. This tool is grayed if no item is selected.
	Policies, User	Invokes the Windows Local Users and Groups dialog. This allows the MassLynx Administrator to review (or set-up if they have sufficient privileges) details of Windows login policies and passwords on the local PC. (This is as opposed to the domain accounts and policies that are normally used to set these items up.)
	Policies, Audit	Invokes the Audit Policy dialog; this allows the Audit policy settings to be configured, see Configuring the Audit Policy Settings for details.
	Tools, Audit Log Viewer	Invokes the Windows Event Viewer; this allows the Windows event log to be viewed and (if Access Rights allow) configured. Note: This is not the same as the LogLynx User Interface, which is used to view the MassLynx audit log and audit trails, see  Opening the LogLynx User Interface.
	About MassLynx Security Manager	Invokes a dialog describing the current version of the MSM.
	View, Lock Security Editor	Locks the MSM so that it can be left unattended. The Unlock MassLynx dialog is invoked, so that the User has to enter their Password: in order to re-enter the MSM; see Locking MassLynx and the MassLynx Security Editor for details.
 Related Topics


Creating a New User

1.	Either: a) Select the MSM Menu Bar Policies, User option. Or: b) Select the Tool Bar Setup User tool, [image]. The Windows Local Users and Groups dialog is invoked.
2.	Setup the required User Accounts using standard Windows procedures.
3.	Close the Windows Local Users and Groups dialog.
Note:

The User setup must be carried out by a domain administrator if domain accounts are to be used rather than local PC accounts; Micromass recommend that domain accounts be used where possible.

4.	Either: a) Select the MSM Menu Bar Create, New User command. Or: b) Select the Tool Bar New User tool, [image]. The New User dialog is invoked.
5.	Complete the fields as required, see below.
User Name:	Enter the User Name for the new User. The new User will only be created if the User Name: field does not match an existing MassLynx User or Group name. A blank User Name: is not allowed.
Full Name:	Enter the new User's full name. This field is used in the annotation of security events. A blank Full Name: is not allowed. If two people have the same name, some differentiator must be used, e.g.: John Smith (Payroll ID 5789)
Description:	A suitable description of the User's role and requirements for MassLynx use must be entered in this field, a blank Description is not allowed.
Domain	Select the domain for which the User Name is valid from the drop-down list. This Domain is used to check the Login Password for this User Name. It should preferably be a site-based trusted domain controller controlled by the Information Technology (IT) department rather than a logon to the local machine. Operating procedures on the customer site should ensure this. A blank Domain is not allowed. Note: Only Domains trusted by the workstation are displayed in the drop-down list.
Current MassLynx Group:	This read-only field will always be blank for a new User; to assign the User to a Group, use the Manage Group dialog, see  Changing Group Details.
OK	Select this button to enter the new User information. A check will be made to see whether this is a valid Windows User; if not, a warning message will be displayed. Note: This message will not be invoked if the Windows User Accounts have been correctly set-up, see Step 2 above.

The User will also be checked to see whether they have administrative privileges on the local machine; if so, the following warning appears.


Changing User Details

Double-clicking on an entry in the MSM Username display invokes the Manage User dialog, which allows the User details to be edited.

This dialog is the same as the New User dialog, except that the details for the selected User are displayed. The dialog is used in the same way as the New User dialog, see  Creating a New User .


Creating a New Group

To create a new Group, either select the MSM Menu Bar Create, New Group command, or select the Tool Bar New Group tool, [image]; this invokes the New Group dialog. Complete the fields as required, see below.

Group Name:	Enter the Group Name for the new Group. The new Group will only be created if the Group Name: field does not match an existing MassLynx User or Group name. A blank Group Name: is not allowed.
Description:	Enter a concise description of the role of Users in this Group. A blank Description: is not allowed.
Members:	A list of the Users currently assigned to this Group is displayed here. This field is initially blank; to assign Users to this Group use the Group Members dialog, see below.
Rights:	Descriptions of Rights that are assigned to Users who are members of this Group are displayed here. This field is initially blank; to assign Rights to this Group use the Group Rights dialog, see below.
Warning	This button invokes the Group Warning dialog. This allows the Group warning (displayed at login) to be edited; the required text is entered in the text box. Select the Use Warning box to display the warning on login, if this box is not selected, no warning will be displayed.
Assign Members:	This button invokes the Group Members dialog; this allows Users to be assigned to the Group. All the currently configured MassLynx Users are shown in this dialog in the form <domain>\<User>; they are sorted alphabetically. If a User is currently assigned to another Group, their entry is grayed and cannot be selected. All other Users will appear in black; each can have the associated tick box checked to add them to the current Group. Selecting the OK button updates the associated New Group dialog, but the current information in the MSM is changed only when that dialog is closed (via its own OK button).
Assign Rights:	This button invokes the Group Rights dialog; this allows Rights to be assigned to the Group. This shows a list of all the possible User Rights. Rights that are not permitted for the Group are grayed; permitted Rights are shown in black and can be selected by the associated tick box. Refer to MassLynx User Rights for further details.


Changing Group Details

Double-clicking on an entry in the MSM Group display invokes the Manage Group dialog, which allows the Group details to be edited.

This dialog is the same as the New Group dialog, except that the details for the selected Group are displayed. The dialog is used in the same way as the New Group dialog, see Creating a New Group  for details.


Deleting a User or a Group

To delete a User or a Group from the MSM, select the User or Group by clicking on it, then either:

Select the Menu Bar Create, Delete command.

Or:

Select the Tool Bar Delete tool, [image].

Or:

Use the keyboard Delete button.

The User or Group will be completely removed from the system; a subsequent User or Group created with the same name will be treated as being entirely new.

Note:

The Administrators, Disabled and Maintenance Groups cannot be deleted. At least one User must be a member of the Administrators Group.


MassLynx User Rights

MassLynx User Rights are assigned to Groups by using the Group Rights dialog, see  Creating a New Group .

More:

Administrative User Rights

Acquisition User Rights

Method File User Rights

Data File Alteration User Rights

QuanLynx Calibration User Rights

QuanLynx File Export User Rights

General User Rights

Inorganic User Rights

Report User Rights

BackLynx User Rights

LogLynx User Rights


Administrative User Rights

Administrative - Administer user accounts and groups	Allows Users to login to the MSM and change Users, Groups and Rights.
Privacy - Use encryption when creating databases	Users with this Right selected will always create encrypted files for storing quantify results.
Administrative - Override current MassLynx login	Allows Users to login (in the Unlock MassLynx dialog) when MassLynx is already locked by someone else. This will delete the existing User logon. Note: This Right is disabled at present.
Maintenance - Act as maintenance user	Allows Users to select the Unlock MassLynx dialog Maintenance Login button to temporarily override the login of a currently locked MassLynx session. See Locking MassLynx and the MassLynx Security Editor for further details.
Administrative - Validate import options	Allows Users to act as second signatories on operations that violate the normal security rules. This Right is required so that if data are being falsified by the operation, the cooperation of at least two people is needed. See  for further details. Note: Users with this right cannot actually perform an import.


Acquisition User Rights

Acquisition - Start from tune page	Allows Users to acquire from the tune page.
Acquisition - Start from sample list	Allows Users to queue acquisitions from the top-level window in MassLynx.
Acquisition - Start calibration acquisitions	Allows Users to start the calibration process to create new calibration acquisitions from the tune page.
Instrument Setup - Enter tuning window	Allows Users to enter the tune page.
Instrument Setup - Enter instrument calibration window	Allows Users to enter the calibration graph window (for creating MALDI calibrations, etc.) or the calibration window (to start or adjust quad calibrations, for example).
Setup - Modify lab and user info	Users who have this Right set will be able to adjust the MassLynx lab and User information that is stored with acquired or quantified data.
Acquisition - Overwrite raw data	Allows Users to overwrite raw data. Users who do not have this Right will not be given the normal "Overwrite?" dialog when attempting to acquire to a filename that already exists; the action will be disallowed and an appropriate Access Right warning will be generated.
Acquisition - Enable tune page during acquisitions	Allows Users to access the Tune Page while an acquisition is in progress.
Acquisition - Access the sample queue	Allows Users to access the MassLynx queue.
Tune Page - Create tune file	Allows Users to create a tune parameter file.
Tune Page - Alter tune file	Allows Users to change the contents of a tune parameter file.


Method File User Rights

MS Method - Enter editor	Allows Users to enter the acquisition method setup window.
MS Method - Create new file on disk	Allows Users to create new acquisition method files.
MS Method - Alter existing file on disk	Allows Users to overwrite existing acquisition method files.
ACE Inlet Editor - Enter editor	Allows Users to enter the Acquisition Control Editor (ACE) inlet control and method editor window.
ACE Inlet Editor - Create new file on disk	Allows Users to create new ACE inlet method files.
ACE Inlet Editor - Alter existing file on disk	Allows Users to overwrite existing ACE inlet method files.
Quan Method Editor - Enter editor	Allows Users to enter the quantification method editor window.
Quan Method Editor - Create new file on disk	Allows Users to create new quantification method files.
Quan Method Editor - Alter existing file on disk	Allows Users to overwrite existing quantification method files.
Sample List - Create new file on disk	Allows Users to create new sample list files.
Sample List - Alter existing file on disk	Allows Users to alter sample files.
QuanLynx Method - Internal alteration	Allows Users to alter the quantification method within a QuanLynx dataset but not save the method to disk.
QuanLynx Method - Internal RT auto adjustment	Allows automatic alteration of retention times in the quantify method in a QuanLynx dataset.


Data File Alteration User Rights

Quantify - Save new calibration curves to disk	Allows Users to create new quantification calibration curves.
Quantify - Alter existing calibration curves on disk	Allows the manual alteration of points on quantification calibration curves.
Quantify - Re/Integrate samples	Allows integrated peaks to be created.
Quantify - Add/Modify/Delete peaks	Allows Users to add new peaks and modify or delete existing peaks.
File Browser - Delete file	Allows Users to delete files from within MassLynx.
Quantify - Quantify samples	Allows quantification results to be created and then stored as report or LIMS export files
MS Calibration - Create new file on disk	Allows Users to create new MS Calibration files.
MS Calibration - Alter existing file on disk	Allows Users to overwrite existing MS Calibration files.
QuanLynx Dataset - Save new dataset to disk	Allows Users to create a new QuanLynx Dataset.
QuanLynx Dataset - Alter existing dataset on disk	Allows Users to overwrite an existing QuanLynx Dataset on disk.
QuanLynx Dataset - Accept a dataset	Allows Users to 'Accept' a QuanLynx Dataset.
QuanLynx Dataset - Review a dataset	Allows Users to 'Review' a QuanLynx Dataset.
QuanLynx Dataset - Unaccept a dataset	Allows Users to 'Unaccept' a QuanLynx Dataset.
MS Calibration - Recalibrate a raw file	Allows Users to recalculate the calibration for the current compound.


QuanLynx Calibration User Rights

QuanLynx - Use calibrated calculation	Allows Users to use the calibrated calculation.
QuanLynx - Include/Exclude points	Allows Users to include or exclude points in the calibration calculation for the current compound.
QuanLynx - Change individual curve fitting	Allows Users to change the fit for the current calibration curve.


QuanLynx File Export User Rights

QuanLynx - Allow Send To \ Get From Network	Allows the User access to the Send To \ Get From network file access in QuanLynx. This option is required for Users to be able to send QLD files across a network in secure files mode when Network File Access has been disabled. See the  for further details.
QuanLynx - Export LIMS file	Allows the User to export LIMS files.
QuanLynx - Export QML file	Allows the User to export QML files.
QuanLynx - Export current summary	Allows the User to export the currently selected summary from the QuanLynx Summary Report.
QuanLynx - Export complete summary	Allows the User to export the complete QuanLynx Summary Report.
QuanLynx - Export all groups summary	Allows the User to export the All Groups summary from the QuanLynx Summary Report.


General User Rights

General - Import legacy projects	Allows Users to start the 'import project' process to import legacy data into MassLynx.
General - Modify fonts and colours	Allows Users to change the fonts and colors used by MassLynx.
General - Modify sample list format	Allows Users to change the fields displayed by the sample list editor at the top level of MassLynx.
General - Customize MassLynx system globals	Allows Users to change MassLynx global settings from the top level.
NeoLynx - Modify test tables	Allows Users to modify NeoLynx test tables.
NeoLynx - Modify browser schemes	Allows Users to modify NeoLynx browser schemes.


Inorganic User Rights

Custom Inlet - Allow	Allows inorganic MassLynx Users to use the custom inlet.
Custom Inlet - Create/Modify	Allows inorganic MassLynx Users to edit the custom inlet parameters.
Inorganic Inlet - Enter auto injector editor.	Allows Users to enter the MS-controlled autosampler setup editor.


Report User Rights

Quantify - (legacy) Modify screen based report format	Allows Users to modify the format of the quantification report (not used in QuanLynx).
Quantify - Modify report format	Allows Users to modify the format of the quantification report table (output table in QuanLynx).


BackLynx User Rights

Note:

1.	Only Users with the following Rights will be able to enter the BackLynx utility.

2.	When used, these actions may require Administrator validation, depending on the current Dual Authorization Policy, see  Configuring the Dual Authorization Policy Settings.

BackLynx - Copy	Allows Users to use BackLynx to copy secure files to a remote location. Refer to  for details.
BackLynx - Backup	Allows Users to use BackLynx to create a backup image of portions of MassLynx data that includes the logged history associated with these files.
BackLynx - Restore	Allows Users to restore data from a backup file and bring it under the aegis of the current security.
BackLynx - Backup and Delete	Allows Users to back-up data and remove the data on disk if it has been successfully sent to the archive location. The logged history will be included in the back-up. If any events in the audit log refer only to files which… a) have been successfully backed-up and removed with this option, and b) do not form part of an audit trail for files elsewhere, and which are still present, …then they will be removed.
BackLynx - Copy and Delete	Allows a BackLynx copy operation that also removes the successfully copied source files. This is effectively a Move rather than a Copy.
BackLynx - Overwrite Old Target	Enables the option for overwriting old files, i.e. only those destination files that are older than the files being copied will be overwritten.
BackLynx - Overwrite Any Target	Enables the option for overwriting all existing files, i.e. copied files will overwrite any existing destination files.


LogLynx User Rights

LogLynx - Enter log viewer	Allows Users to enter the LogLynx application to view MassLynx security history.
LogLynx - Delete log	Allows Users to delete the contents of the MassLynx log. After deletion, the log will contain an entry noting when the contents were deleted and by whom.
LogLynx - Import log	Allows Users to import parts of a MassLynx log from a file.
LogLynx - Export log	Allows Users to export parts of a MassLynx log to a file.


Configuring the Audit Policy Settings

To configure Audit Policy Settings, select the MSM Menu Bar Policies, Audit command; this invokes the Audit Policy dialog.

Audit Frame	Only one of the three options in this frame may be selected at any one time.
Enabled	An entry is generated in the Audit log every time an auditable event occurs.
Failures   Only	Only auditable events that fail will be logged.
Disabled	No entries are generated in the Audit log.
Auditable events Frame	Any of the four options in this frame may be selected simultaneously.
Logon and   Logoff	An entry is generated in the Audit log whenever a User logs on to, or out of, MassLynx or the MSM.
Policy   changes	An entry is generated in the Audit log whenever changes are made on the MSM.
Object   access	An entry is generated in the Audit log whenever events occur relating to the Rights detailed in  MassLynx User Rights.
Other   event	An entry is generated in the Audit log whenever other auditable events occur. Note: This includes file Audit Trail events in secure files mode.
Remote Logging Frame
Enabled	When selected, a computer remote from the local computer (the remote log server) is used to store MassLynx logging information.
Store On	The name of the remote computer must be entered in this text box when the Enabled option is selected. Note: It is possible to select Enabled and enter the name of the local machine in the Store On text box; this is convenient when exporting a Security Rollout File from the log server. See The MassLynx Security Parameters Options dialog for details of Security Rollout Files.
Remote Alerts Frame
Set	When selected, immediate alerts of serious security problems (such as tampered files, attempts to log-on using an expired password, etc.) are sent to the computer specified in the Send To text box. Note: The alerts will appear on the interactive screen, so they must not be sent to a server that normally runs without a logged-in User.
Send To	When the Set option is selected, the name of the computer to which the alerts are sent must be entered in this text box. Note: This service uses the Windows Alerter service; entering, or removing, a name in the Send To box will enter, or remove, that name from the computers configured to receive Windows alert information from this workstation. Changes to the Alerter service will require the workstation to be rebooted.


Configuring the Signature Policy Settings

To configure the Signature Policy Settings, select the MSM Menu Bar Policies, Signatures command; this invokes the Signature Policy dialog.

The main body of the dialog displays a list of reasons for signing an event and a description of each one; this list can be edited, see below. The Reason text is used in the Sign Alteration dialog, see  for further details.

Allow Freeform Reason	When this option is selected, the Reason field of a displayed Sign Alteration dialog will allow freeform text entry (i.e. the reason list is not used, the User types in a reason directly). If this option is not selected, the Sign Alteration dialog Reason field will be a list box containing the reasons defined in the Signature Policy dialog Reason list.
All Fields Must Be Entered	When this option is selected, and a Sign Alteration dialog is invoked, all its fields will be empty and must be completed by the User. When this option is not selected, the current User: and Domain: will be displayed in the Sign Alteration dialog. In addition, if the Allow Freeform Reason option is not selected, the first of the available reasons will be displayed in the Reason list box.
Force Frame	The options in this frame control the way in which signatures are applied when saving a modified file or editing peaks.
Don't Force	Does not require a signature to be placed on the file at the time of saving. If peaks are being edited, no on-screen warning is generated if the peak modification is not signed. Editors for files that would normally be signed when saving will now have the ability to sign the file manually from the File, Sign Spectrum command, or the Tool Bar [image] button, see .
Force	Requires a signature to be placed on every saved file at the time of saving. If peaks are being edited, the peak modification must be signed when it is saved.
Warn	Requires a signature to be placed on the file at the time of saving. An on-screen warning is displayed if a peak modification is made without comment, but the modification is still allowed.
Adjust Reasons Frame	The controls in this frame allow the Reasons in the Signature Policy dialog list box to be added to, changed and deleted.
New	Invokes the New Reason dialog; this allows a new Reason to be added to those in the Signature Policy dialog list box. This dialog can also be invoked by clicking on an empty part of the Signature Policy dialog list box. Enter the Reason name in the Reason: text box; enter an explanation of the reason in the Advice: text box.
Alter	Invokes the Edit Reason dialog for the currently selected Reason; this allows the Reason to be changed. This dialog can also be invoked by double-clicking on the Reason to be changed in the Signature Policy dialog list box. Enter changes to the Reason name in the Reason: text box; enter changes to the explanation in the Advice: text box. Note: If no reason has been selected prior to selecting this button, the New Reason dialog is invoked, see above.
Delete	Selecting this button deletes the currently selected Reason from the Signature Policy dialog list box. The currently selected Reason can also be deleted by using the keyboard Delete key.


Configuring the Dual Authorization Policy Settings

To configure the Dual Authorization Policy Settings, select the MSM Menu Bar Policies, Signatures command. This invokes the Signature Policy dialog, which allows selection of the actions for which a dual authorization is required (i.e. actions for which the Administrator Confirmation Required dialog is invoked. Refer to  for details).

When the Signature Policy dialog is first invoked, all the options are selected by default. To deselect an option, click on the check box so that the tick mark is removed.


Locking MassLynx and the MassLynx Security Editor

If the Workstation is to be left unattended for a period, MassLynx and the MassLynx Security Editor can be locked to prevent other Users from accessing it.

Note:

When locked, MassLynx will continue any current processing; this cannot be stopped until MassLynx is unlocked, see below.

To lock the MassLynx Security Editor, select the Tool Bar Lock Workstation button, [image], or select the Menu Bar View, Lock Security command.

To lock MassLynx, select the Tool Bar Lock MassLynx button, [image], or select the Menu Bar Security, Lock MassLynx command.

The Unlock MassLynx dialog is invoked in each case; this allows the current User, a Maintenance User, or an Administrator User to unlock the application.

When the Unlock MassLynx dialog is invoked, the Logon Name: and Domain boxes will contain the entries for the current User, unless specified otherwise in the MSM.

Note:

Selecting the Cancel button causes any changes to the contents of the Unlock MassLynx dialog list and text boxes to be reset to the currently stored settings.

The current User must enter their Password and select the Resume button to unlock the application. A Maintenance or Administrator User must enter their Logon Name and Password, and then select the Maintenance Login button to unlock the application.

Note:

1.	If the Maintenance or Administrator User unlocks MassLynx using a maintenance login, any currently running processes will be paused; they can then perform operations in line with their assigned privileges. Any paused processes will be resumed when the Maintenance or Administrator User logs out.

2.	In MassLynx, if the Maintenance or Administrator User selects the Security, Log Off command, only the Maintenance or Administrator User will be logged-off; the original User will still be logged-on, in the locked-out state, and paused processes will resume. If the Maintenance or Administrator User selects the File, Exit command, or the Windows close button, the Maintenance (or Administrator) User and the original User will both be logged-off.


Signatures - Signatures
Signatures

In MassLynx, raw data files may be signed via the Data Browser dialog, see  Signing Raw Data Files. Also, when results are created or altered, they can be:

•	Signed at the time (if the MSM Signature Policy dialog Force signature option is selected, see Configuring the Signature Policy Settings).

•	Signed later by using the Menu Bar File, Sign Sample List command.

Signatures are assigned by means of the Sign Alteration dialog, see  The Sign Alteration Dialog .

The details of existing signatures on files can be viewed, see  Viewing Existing Signatures.

See Items that may be Signed for details of items that may be signed.

Note:

1.	If MassLynx Security is not enabled, peak alterations may be commented rather than signed, see  Comments.

2.	Signatures in the Quan dataset are viewed by the Audit Log window in the QuanLynx application.

More:

The Sign Alteration Dialog

Comments

Viewing Existing Signatures


The Sign Alteration Dialog

The Sign Alteration dialog allows the user to sign data changes. The format of the invoked dialog depends on the current settings in the MSM Signature Policy dialog, refer to  Configuring the Signature Policy Settings.

For Secure Files Security, the dialogs are refererd to in the table below; the relevant MSM Signature Policy dialog settings are as follows:

MSM Signature Policy dialog setting	Figure 1	Figure 2	Figure 3	Figure 4
Allow Freeform reason		Click		Click
Don't Force	Click	Click
Force			Click	Click
The User must enter their User: Name and Password:, and then select a Domain: from the list box. The User Identity (i.e. User Name and Domain Name) and Password must match those of the currently logged-in MassLynx User otherwise the operation will fail.

Depending on the dialog invoked, the Reason: will have to be entered manually, or selected from the reasons in the list box. A blank Reason: field is not allowed.

Once the fields have been completed, the Ok or Sign It push-button must be selected. If the Don't Sign push-button is selected, the action that caused the Sign Alteration dialog to be invoked will be cancelled as well as the signature not being applied. (For example, a File, Save command would not save the file).

 Related Topics


Comments

No permission checks are required when using QuanLynx with no MassLynx Security installed; however, actions requiring comments will prompt the User with the Alteration Comment dialog. This dialog may be switched off or on by selecting the QuanLynx Browser Menu Bar Edit, Disable Comments command.


Viewing Existing Signatures

Existing signatures (if any) on MassLynx files can be viewed by selecting the MassLynx Menu Bar File, Sample List Properties command. This command will invoke one of three dialogs, depending on the whether Security is enabled and whether the file has been signed.

This dialog is invoked if secure files are not in use. The full file name and time that the file was modified are displayed.

This dialog is invoked if secure files are in use but the file has no signature.

This dialog is invoked if the file has a valid signature. Details of the User who signed the file, the time and date the signature was applied and the reason for the signature are displayed.

 Related Topics


Items that may be Signed

This section lists those items that must be signed when MassLynx Security is enabled.

Method Files

•	MS method files.

•	Quan method files.

•	Inlet method files.

Quantification Results

•	Results Dataset.

•	Calibration Curve files.

•	Quan Method files.

•	Peak alterations.

Instrument Files

•	Tune files

•	Instrument Calibration files.

Sample Lists

Sample lists can be signed to indicate that the experiment details have been checked, and follow site policy.

Raw Data Files

Raw data files may be signed as described in  Signing Raw Data Files.

Spectrum Files

Processed spectrum files may be signed as described in  Signing a Processed Spectrum.

 Related Topics

More:

Signing Raw Data Files

Signing a Processed Spectrum

Displaying Signatures in the Spectrum Window


Signing Raw Data Files

Raw data files can be signed by selecting the Sign button in the appropriate Data Browser dialog (MassLynx Window, Chromatogram, Spectrum, Library, or Map).

Note:

The Sign button is only available if MassLynx Security with Secure Files is installed.

 Related Topics


Signing a Processed Spectrum

When the MSM Signature Policy dialog Force option is selected, a signature will be automatically applied to a processed spectrum file when it is saved using the Spectrum Menu Bar File, Save Spectrum command.

When the MSM Signature Policy dialog Don't force, or Warn option is selected; a processed spectrum file that has already been saved can be signed by using the File, Sign Spectrum command, or the Tool Bar [image] button.

Note:

1.	The Menu Bar File, Save Spectrum command is disabled if the file has already been saved.

2.	The Menu Bar File, Sign Spectrum command and Tool Bar [image] button are disabled if the file has not been saved, or if the file has already been signed.

3.	The Menu Bar File, Sign Spectrum command and Tool Bar [image] button are not present if the MSM Signature Policy dialog Force option is selected

 Related Topics


Displaying Signatures in the Spectrum Window

Signatures can be displayed in the Spectrum Window. The Header Editor Dialog is used to set up the signature display; the raw data file signature is displayed in the center of the window, with the processed spectrum signature being displayed on the right-hand-side. Refer to The Header Editor Dialog (MassLynx NT User's Guide) for details.

No signatures are displayed if "Non-Secure Files" is being used. If "Secure Files" is being used, "not signed" will be displayed if the file is not signed. "Mismatched signatures" will be displayed if the signatures do not match for all the file components.

This figure shows the Header Editor dialog display options for a raw data file signature (User, Date, and Reason).

This figure shows the Header Editor dialog display options for a processed spectrum file signature (User, Date and Reason).

 Related Topics


Printed Signatures

The signature appears on the print-out when any signed file is printed.

 Related Topics


The Dual Authorization Policy - The Dual Authorization Policy
The Dual Authorization Policy

When using MassLynx, under certain circumstances an action may be requested that jeopardizes the security of the System but which needs to be allowed. In order to ensure the action is compliant, the Administrator Confirmation Required dialog is invoked.

This dialog requires a MassLynx User (the currently logged-on User, or any non-administrative MassLynx User if there is no current MassLynx User) and a MassLynx Administrator to both provide details in order that the action may be completed.

More:

Actions that Invoke the Administrator Confirmation Required dialog


Actions that Invoke the Administrator Confirmation Required dialog

The following actions all invoke the Administrator Confirmation Required dialog, unless the relevant option has been disabled in the Dual Authorization Policy dialog (see Configuring the Dual Authorization Policy Settings):

•	Import Project.

•	Import Worksheet.

•	Import Data.

•	Import Sample List.

•	Import Inlet Method.

•	Import Acquisition Method.

•	Import of Secure Files (Installation).

•	BackLynx Queue.

•	Import Instrument Calibration file.

•	Import calibration reference file.

•	Import Spectral library.


The BackLynx Utility - The BackLynx Utility
The BackLynx Utility

When operating in a secure MassLynx environment, it is sometimes necessary to move files from one location to another. Such operations include archiving data; or moving data from an acquisition machine to a central server where the data can be viewed and reviewed by other operators. If Windows Explorer were used to move a file, the change in file location would invalidate the file as part of the security operation. The BackLynx Utility allows files to be moved under secure conditions, without invalidating them.

BackLynx can be used in both secure and non-secure environments (i.e. when no MassLynx Security is installed).

BackLynx can be used to:

•	Copy files see Non-Secure Copy and Secure Copy for details.

•	Backup files; see Backup for details.

•	Restore files see Restore for details.

•	Automate any of the above actions.

BackLynx can operate on whole projects (*.PRO files, including the data files), whole MassLynx raw data files (*.RAW files), or meta-data files (i.e. project files without the raw data files).


Opening the BackLynx User Interface

To open the BackLynx User Interface:

1.	Select the Windows Start, Programs, MassLynx, BackLynx option.
2.	Enter the Logon Name:, Password: and Domain.
3.	Select the OK push-button.
4.	If the MassLynx Security System accepts the information that has been entered, a Warning message may appear; select the OK push-button.
5.	The BackLynx User Interface is invoked; this has six pages, which are described in  The BackLynx User Interface.


The BackLynx User Interface

The BackLynx User Interface has six pages which are used to specify the options to be used during the file copying process; these pages are described in the following sections. The push-buttons at the foot of the User Interface are accessible at all times. The left-hand push-button may be named Run or Queue depending on whether the Immediate or Timed option is selected on the Schedule page, see  The BackLynx User Interface, Schedule Page. This push-button starts, or queues, the defined operation, see Starting an Operation for further details. The Exit push-button closes the BackLynx application.

Note:

The availability of certain options in the BackLynx User Interface depends on the MassLynx User Rights assigned to the current User's Group; see MassLynx User Rights for details.

More:

The BackLynx User Interface, Locations Page

The BackLynx User Interface, Log Page

The BackLynx User Interface, Mode Page

The BackLynx User Interface, Method Page

The BackLynx User Interface, Schedule Page

The BackLynx User Interface, Review Page


The BackLynx User Interface, Locations Page

The BackLynx User Interface, Locations page is used to specify the source and target directories for the backup, restore, or copy operation.

Backup From:	The path and file name of the file to be backed-up, restored, or copied can be typed in this text box. The Browse push-button invokes the Browse for folder dialog, which allows folders to be browsed and directly entered in the text box.
Backup To:	The destination directory path and file name can be typed in this text box; the Browse push-button invokes the Browse for folder dialog, which allows folders to be browsed and directly entered in the text box.


The BackLynx User Interface, Log Page

The BackLynx User Interface, Log page is used to specify the options for the creation of a log file (type .log) of the backup, restore or copy operation. The file can be read using a suitable text editor, such as Notepad.

Note:

These log files are not secure, they are merely to be used by MassLynx, and System Administrators to check that scheduled backup operations have occurred as planned.

Logging Enabled: Frame
No	When selected, no log file is created.
Overwrite	When selected, log data is written over any existing data in the log file specified in the Log Name: text box.
Append	When selected, log data is appended to any existing data in the log file specified in the Log Name: text box.
Log Name:	The destination path and log file name can be typed in this text box; the Browse push-button invokes the Select Log File dialog, which allows files to be browsed and directly entered in the text box. This Field is not available if the No option is selected, see above. Note: If the name entered is not specified as a .LOG file, ".LOG" will be appended when creating the file.


The BackLynx User Interface, Mode Page

The BackLynx User Interface, Mode page is used to specify the type of operation required.

Note:

Only the options available to the currently logged-on MassLynx User are available.

Mode Frame
Back up to   archive or CD   workstation	When selected, the data is backed-up to an archive or a CD writer workstation defined by the current entry in the BackLynx User Interface, Locations page Backup To: text box, see  Backup.
Restore to   secure   workstation	When selected, archived data is restored to the secure workstation, see  Restore.
Copy to secure   workstation	When selected, archived data is copied to a secure workstation, see  Secure Copy.
Copy, back up   or restore   without    security	When selected, data is copied, backed-up or restored from archive without any security features, see  Non-Secure Copy. Note: This option not available when MassLynx is installed with Secure Files security; it is the only available option when MassLynx is installed without Secure Files security.
Remove Source Frame	Note: This Frame is not available when the Restore to secure workstation option is selected.
Yes	When selected, if a Backup operation is successful, the audit trails and original files for all the backup files are removed from the source tree. However, a successful Copy operation will only remove the files.
No	When selected, if a backup is successful, the audit trails and original files for all the backup files are retained in the source tree.


The BackLynx User Interface, Method Page

The BackLynx User Interface, Method page is used to select the data to be copied, backed-up or restored, and the available overwrite options.

Note:

Only the options available to the currently logged-on MassLynx User are available.

BackLynx can operate on whole projects (*.PRO files, including the data files), whole MassLynx raw data files (*.RAW files), or meta-data files (i.e. project files without the raw data files).

Backup/Copy Method Frame
Full (complete   project)	Backs-up the directories named *.PRO and their subdirectories and files, i.e. the complete project.
Data (data   files only)	Backs-up only the directories named *.RAW and their subdirectories and files, i.e. the raw data only.
Metadata    (project minus    data)	Backs-up the directories named *.PRO and their subdirectories and files, but not the directories named *.RAW and their subdirectories and files, i.e. the project less the raw data.
Overwrite Existing Files Frame
Always	When selected, the files to be copied overwrite any existing destination files.
Newer source    only	When selected, only those destination files that are older than the files to be copied are overwritten.
Never	When selected, files being copied never overwrite existing destination files.


The BackLynx User Interface, Schedule Page

The BackLynx User Interface, Schedule Page is used to configure the time that the backup, copy or restore operation should run.

Note:

The time specified in this page refers to the 'local time' e.g. Eastern Standard Time (EST) or Greenwich Mean Time (GMT). Internally, all times are stored as Coordinated Universal Time (UTC). This will result in a backup scheduled for 1.30 AM British Summer Time (BST) occurring at 1.30 AM and not re-occurring when the time becomes 1.30 AM GMT. There is also no possibility of missing a backup due to daylight saving changes or change of the time zone. If a scheduled backup is due to coincide with an inconvenient change in local time, it should be deleted and rescheduled for a different time. Obviously, if the underlying system time changes, the scheduling will use the new time. Users of the system should not have access to the PC's system clock. The simplest way to arrange this is to have the site IT Administrator control the time on each computer remotely and not allow other Users to change the system clock.

Immediate	When selected, the operation runs immediately, as does any run-once Timed backup where the time and date pre-empts the current time.
Timed	When selected, the operation will run at the time(s) specified in the Period Frame.
Note:

When the Immediate option is selected, the left-hand push-button at the bottom of the BackLynx User Interface is named Run. When the Timed option is selected, the push-button is named Queue, see Starting an Operation for further details.

Period Frame	Note: The Period Frame is only available when the Timed option is selected.
Once	When selected, the operation will run once at the time and date specified in the at and on Fields.
Daily	When selected, the operation will run once a day at the time specified in the at Field.
Weekly	When selected, the operation will run on the day(s) specified by the adjacent "day" check boxes, at the time specified in the at Field. The check boxes are only available when the Weekly option is selected.
Monthly	When selected, the operation will run once at the time and date specified in the at and on Fields.
at Field	The time at which an operation will start can be typed directly in this Field; alternatively, the arrows, [image] can be used to increment the hours, minutes and seconds values after first selecting the value to be changed.
on Field	The date on which an operation will occur can be typed directly in this Field; alternatively, selecting the [image] button will invoke a calendar dialog.

The Calendar dialog defaults to the current day when invoked.

Clicking on the year in the dialog heading invokes scroll buttons that allow the another year to be selected. Clicking on the month in the dialog heading invokes a drop-down menu from which the required month can be selected. Alternatively, clicking on the arrow buttons in the dialog heading, [image] and [image], will scroll through the months and years.


The BackLynx User Interface, Review Page

This page is used to review scheduled operations, see  Starting an Operation.

The Review window lists all the operations currently queued or running.

Time Field	Displays the time at which the operation is to take place.
Date Field	Displays the date on which the operation is to take place.
From Field	Displays the source for the operation.
Target Field	Displays the target for the operation.
Owner Field	Displays the owner of the operation, i.e. the User who created the operation.
If a recurrent timed operation is stopped, it will be re-queued to occur at its next due time.

A task, or tasks, can be deleted by selecting the Time Field entry (or entries) in the list and pressing the keyboard Delete key. Only the task owner or a member of the MassLynx Administrator Group may delete or stop a secure task.

The data in the Review page will be refreshed on entry to the page, when a task is queued, or when the F5 key is pressed.

Double-clicking on a task's Time Field invokes the Review Scheduled Task dialog for that task; this contains full details of the task.

Delete	Deletes the operation from the queue.
Stop	Stops the operation if it is currently executing.


Starting an Operation

When the required options have been selected in the BackLynx User Interface pages (see The BackLynx User Interface), select the BackLynx User Interface Run (or Queue) push-button to start, or queue, the currently configured operation. The ensuing sequence of events depends on whether the operation is being performed:

•	Under non-secure file conditions, see  Starting an Operation under Non-Secure File Conditions.

•	Under secure file conditions, see  Starting an Operation under Secure File Conditions.

Note:

The left-hand push-button on the BackLynx User Interface is named Run or Queue depending on whether the Immediate or Timed option is selected on the Schedule page; see  The BackLynx User Interface, Schedule Page.

More:

Starting an Operation under Non-Secure File Conditions

Starting an Operation under Secure File Conditions


Starting an Operation under Non-Secure File Conditions

1.	Select the BackLynx User Interface Run (or Queue) push-button; the About to start (or queue) Non Secure Copy operation dialog is invoked.

2.	To continue the operation, select the OK push-button. The Account Details dialog is invoked.

3.	The MassLynx User must enter their password in the Password: Field and confirm this password in the Retype Password: Field.

4.	Select the OK push-button; the operation is either started immediately, or queued on the BackLynx Scheduler, as appropriate. See The BackLynx Scheduler for further details of the BackLynx Scheduler; see Following the Progress of an Operation for further details of how progress of the operation is monitored.


Starting an Operation under Secure File Conditions

1.	Select the BackLynx User Interface Run (or Queue) push-button; the About to start (or queue) operation dialog is invoked.

2.	To continue the operation, select the OK push-button. The Administrator Confirmation Required dialog is invoked, see The Dual Authorization Policy for full details.

3.	The MassLynx User and Administrator must enter their respective details in the Logon Name:, Password: and Domain Fields.

4.	Select the OK push-button; the operation is either started immediately, or queued on the BackLynx Scheduler, as appropriate. See The BackLynx Scheduler for further details of the BackLynx Scheduler; see Following the Progress of an Operation for further details of how progress of the operation is monitored.


The BackLynx Scheduler

The BackLynx Scheduler is run by the BackLynx Service; which is installed on the PC as part of the BackLynx installation. The BackLynx Service starts whenever the PC's operating system starts and shuts down when the operating system shuts down.

Every two seconds, the BackLynx Scheduler checks to see if any queued process needs to be run. If an operation is already running, the Scheduler will wait until that task has finished before starting the next operation.


Operation

When an operation is started, BackLynx will check to see if the specified user still has the required permissions. The file operations will be carried out in the Windows User account of the MassLynx User who started, or queued, the operation. Queued operations will proceed whether a User is logged onto the PC or not.

The actual file operations that occur will depend on the type of operation queued.

More:

Non-Secure Copy

Secure Copy

Backup

Restore

Following the Progress of an Operation


Non-Secure Copy

Non-secure copy, and non-secure copy and delete can only be performed when MassLynx has been installed without security.

Non-secure copy is performed when the BackLynx User Interface, Mode page, Copy, back up or restore without security option is selected; see  The BackLynx User Interface, Mode Page.

All non-secure files are copied from the source to the target; overwriting will occur as specified in the BackLynx User Interface, Method page when the operation was queued.


Secure Copy

Secure copy is performed when the BackLynx User Interface, Mode page, Copy to secure workstation option is selected; see  The BackLynx User Interface, Mode Page.

All secure files are copied from the source to the target destination. If a directory does not already exist at the destination, one will be created.

If a directory already exists at the destination, any existing file that is the same as the file being copied into the directory will not be replaced, or flagged as an error. However, if the existing file is different to that being copied, an error will be flagged.

The audit log for the copied file will be updated to show that the target file was based on the source file.

Note:

If the remote PC uses a separate log, this will not be updated. Copy operations are only valid when both machines are on the same logging and audit trail system.

When the MSM Menu Bar Policies, Network File Access option is enabled, and files are copied, or saved to a remote machine, the resulting files can still be accessed from the source machine. However, if the remote machine is now used to save a file, the original (i.e. copied or saved) files will no longer be accessible from the local machine.

When the MSM Menu Bar Policies, Network File Access option is disabled, and files have been copied TO another location, they are SEMI-SECURE rather than secure. They can be used by any application that can use SEMI-SECURE files for a source. [Semi-secure files are secure, but they do not have complete UNC (Uniform Naming Convention) path protection.]

More:

Copying between Workstations (with the MSM Menu Bar Policies, Network File Access option disabled)


Copying between Workstations (with the MSM Menu Bar Policies, Network File Access option disabled)

Secure MassLynx files have to 'know' on which partition of the local disk they are stored. Because of this, a 'Copy' operation between two Workstations has to be done in two stages via a third Workstation, this, preferably, should be a secure server. First, make a copy to the server (PUT), then copy from that server to the second local Workstation (GET).

e.g. PUT (onto the server):

SOURCE	c:\masslynx\default.pro

DESTINATION	\\server\datadrive\masslynxtemp\default.pro

GET (from the server):

SOURCE	\\server\datadrive\masslynxtemp\default.pro

DESTINATION	c:\masslynx\default.pro


Backup

Backup is performed when the BackLynx User Interface, Mode page, Back up to archive or CD workstation option is selected; see  The BackLynx User Interface, Mode Page.

All files are copied from the source to the target, so that they can be restored if required; see  Restore. If a file already exists at the target location, it will be overwritten as specified by the options selected in the BackLynx User Interface, Method page, Overwrite Existing Files Frame. See The BackLynx User Interface, Method Page for details.


Restore

Restore is performed when the BackLynx User Interface, Mode page, Restore to secure workstation option is selected; see  The BackLynx User Interface, Mode Page.

A Restore will work from a complete or partial backup set.

A Restore will NOT work if:

•	The Restore operation had been asked to work over files that originally came from more than one machine.

•	If some of the files on the restore set have been moved relative to each other (e.g. if test01.raw and test02.raw have had their names swapped round), a restore of each raw file individually would work. However, a restore of the project directory above them wouldn't.

•	Any of the files have been edited outside MassLynx.


Following the Progress of an Operation

When an operation is being executed a Progress dialog is invoked. This provides details of the progress of the operation and, if files fail to be copied, the reason for the failure.

Status:	Displays the stage of the operation currently in progress.
Overall Progress:	Displays the percentage of source file data transferred to the target.
List Box	Displays the success, or failure, of each unitary sub-operation occurring during the operation, the time that the sub-operation occurred, what it was, the result of the operation and any error information. The displayed text is also copied to any log file specified on the BackLynx User Interface Log page, see  The BackLynx User Interface, Log Page.
Dismiss Button	Closes the Progress dialog only, the operation will continue to completion.
When an operation has been successfully completed, Finished is displayed in the Status: bar.

If an error occurs at any time during the operation, the Status: bar will start flashing red and green.


The LogLynx Utility - The LogLynx Utility
The LogLynx Utility

The LogLynx Utility is used to create an Audit Trail from a sequence of Events in MassLynx Security. Users with the Enter LogLynx User Right can view an Audit Trail using the LogLynx User Interface, see  Opening the BackLynx User Interface. Users without the Enter LogLynx User Right cannot view Audit Trail information.


Auditable Events

For security purposes, the following Events are logged for the Audit Trail:

1.	Logging on or off (including locking and releasing a workstation).

2.	Changes of policy inside the MassLynx Security Manager.

3.	Performing a permissions check to verify that a User can perform a particular operation.

4.	Changes made to a secure method or configuration file.

5.	Changes made to a data file.

6.	Logging of operation execution, such as a backup and restore.

7.	Movements of secure files within the security system and to, or from, external archive storage.

8.	Changes made within QuanLynx.

9.	The signing of changes made to configuration or raw data.

10.	Second person verification (i.e. such as when importing files and the Administrator Confirmation Required dialog is invoked, see The Dual Authorization Policy).


Opening the LogLynx User Interface

Note:

The LogLynx User Interface can only be opened by Users with the Enter LogLynx User Right.

To open the LogLynx User Interface:

1.	Either:

Select the Windows Start, Programs, MassLynx, LogLynx option.

Or:

Select the LogLynx shortcut on the Windows desktop (if one has been created).

In either case, the MassLynx Login dialog is invoked, see  Starting a MassLynx Application when Security is Enabled .

2.	Enter the Logon Name:, Password: and Domain.

3.	Select the OK push-button.

4.	If the MassLynx Security System accepts the information that has been entered, a Warning message will appear; select the OK push-button.

5.	The LogLynx User Interface is invoked.

The LogLynx User Interface contains two windows:

•	The Tree Window, on the left-hand-side of the User Interface. The tree in this window indicates any active filters or searches; see The LogLynx User Interface Tree and Event Windows for details. When the User Interface is first invoked, only All Events is present.

•	The Event Window, on the right-hand-side of the User Interface; this contains a summary line for each Event. Double-clicking on an Event invokes an Event details window which contains full details of the Event, see Event Details for details.


The LogLynx User Interface Menu Bar

The File Menu

The View Menu

The Query Menu

The Security Menu

The Help Menu


The File Menu

Print	Prints out the current Audit Log. Note: Thousands, possibly millions, of Events may be present in the current Audit Log. It is strongly recommended that only Audit Logs that have been passed through a Query Filter and, hence, contain a smaller number of Events, should be printed, see  Query Filters.
Print Setup	Invokes the standard Windows Print Setup dialog.
Import	Invokes a dialog which allows the Event log data [*.EAR (Event ARchive)] to be imported.
Export	Invokes the Export Events dialog; this allows non-audit event log data to be exported to disk, refer to Exporting Audit Log Data for details.
Delete All	Deletes all the entries from the Audit Log; see Deleting Audit Log Data for details. Note: This command should only be used after a Backup operation has been performed in BackLynx; see  Backup.
Exit	Closes the LogLynx User Interface.


The View Menu

Status Bar	Toggles the Status Bar (at the bottom of the LogLynx User Interface) on and off. A tick appears beside the command when the Status Bar is displayed.


The Query Menu

Note:

The Menu Bar Query commands are also available in the pop-up menus invoked by right-clicking on an entry in the LogLynx User Interface Tree Window, see  Query Filters.

Event Type	Invokes a sub-menu:
Permission   Check	Invokes the Query: Permission Check Event dialog, see The Permission Check Event Filter for details.
Log in/out	Invokes the Query: Log In/Out Event dialog, see Log In/Log Out Event for details.
Security	Invokes the Query: Security dialog, see  The Security Event Filter.
Audit	Invokes the Query: Audit Path dialog, see  The Audit Path Filter.
Date/Time Range	Invokes the Date/Time Event Query dialog, The Date/Time Range Filterfor details.
Origin	Invokes the Query: Event Origin dialog, see The Event Origin Filterfor details.


The Security Menu

The Menu Bar Security, Lock workstation command locks the workstation; the Unlock MassLynx dialog is invoked. The current User must enter their Password and select the Resume button to unlock the application. A Maintenance or Administrator User must enter their Logon Name and Password, and then select the Maintenance Login button to unlock the application. See Locking MassLynx and the MassLynx Security Editor for further details.


The Help Menu

The Menu Bar Help, About LogLynx command invokes a window giving information about LogLynx.


Exporting Audit Log Data

The Export Events dialog

To Export Audit Log Data


The Export Events dialog

Non-audit log Events (such as Permission, Log in, etc. may be exported to disk, provided that the User has the necessary privileges. To export Audit Log Data, select the Menu Bar File, Export command; the Export Events dialog is invoked.

Date Range Frame	This frame is used to specify the period over which the data is to be exported.
From:	Specifies the start time for the data to be exported. The time and date can be entered directly in the text boxes. Alternatively, in the time field, the arrows, [image], can be used to increment the hours, minutes and seconds values after first selecting the value to be changed. Selecting the [image] button in the date field will invoke a calendar dialog.
	The Calendar dialog defaults to the current day when invoked. Clicking on the year in the dialog heading invokes scroll buttons that allow the another year to be selected. Clicking on the month in the dialog heading invokes a drop-down menu from which the required month can be selected. Alternatively, clicking on the arrow buttons in the dialog heading, [image] and [image], will scroll through the months and years.
To:	Specifies the end time for the data to be exported. The time and date can be selected as above.
Mode Frame
Export only	Exports the selected data.
Export and   Remove	Exports the selected data and then deletes that data from the log.
Export	Selecting this push-button continues the Export process, see  To Export Audit Log Data.


To Export Audit Log Data

1.	Select the Menu Bar File, Export command; the Export Events dialog is invoked, see  The Export Events dialog.

2.	Enter the required details in the Export Events dialog.

3.	Select the Export push-button; the Event Export dialog (when the Export Events dialog Export only option is selected), or the Event Export and Delete dialog (when the Export Events dialog Export and Remove option is selected) is invoked.

4.	Select the Yes push-button; an Event Export information window is invoked.

5.	Select the OK push-button; a Save As dialog is invoked.

6.	Enter the required location and file name using conventional Windows techniques.

7.	Select the Save push-button; the file will be saved as type .EAR (Event Archive).


Importing Audit Log Data

An Audit Log data file may be imported, if the User has the LogLynx-Import Log privilege.

Note:

This privilege is checked on the local machine. If the Audit Log is located on a separate machine, the privilege is also checked on the log server machine.

1.	Select the Menu Bar File, Import command; a Windows Open dialog is invoked.
2.	Select the required .EAR file.
3.	Select the Open push-button; a File Import information window is invoked; this displays details of the selected file.
4.	Select the OK push-button; the data is imported into LogLynx.


Deleting Audit Log Data

Audit log data may be deleted, if the User has the necessary privileges.

Note:

•	This procedure should only be used after a Backup operation has been performed in BackLynx; see  Backup.

•	All Events will be removed, except for Security Events that indicate previous deletion of audit log data; this maintains an audit trail for deletion events.

1.	Select the Menu Bar File, Delete All command; the Delete All Events dialog is invoked.

3.	Select the Yes push-button; the Delete All Events information window is invoked.

4.	Select the OK push-button; the appropriate Events are deleted from the Audit Log.


The LogLynx User Interface Tree and Event Windows

The LogLynx User Interface Tree Window (on the left-hand-side of the Interface) displays any active filters or searches.

Each entry in the Tree corresponds to a filter that works on the Events passed through the filter on the previous level. For example, in the above figure, an Origin filter is active that will only pass through Events generated by User micromass. A Permission (Allow) check filter is then applied to those resulting Events, giving an AND type query. Selecting a Tree entry will display the Events that have passed through that filter in the Events Window (on the right-hand-side of the User Interface), see figure. Refer to Query Filters for details.

A summary line for each Event is displayed in the Events Window; double-clicking on an Event invokes an Event details window which contains full details of the Event, see Event Details for further information.


Query Filters

Event queries may be entered by selecting an entry in the Tree Window and then selecting a query to run. Queries may be selected from the Menu Bar Query menu (see The Query Menu) or from the pop-up menus invoked by right-clicking on an entry in the Tree Window.

Queries/filters may be based on:

•	A Date/Time Range, see  The Date/Time Range Filter.

•	The Origin of the Event (User/Machine), see . The Event Origin Filter

•	The Event Type, Event Type Filters

To delete a filter from the Tree, right-click on the entry and select the Close List command from the invoked menu.

 Related Topics

More:

The Date/Time Range Filter

The Event Origin Filter

Event Type Filters


The Date/Time Range Filter

The Date/Time Range Filter searches for data written to the Audit Log during specified periods.

To select the Date/Time Range Filter, either:

Click on the Filter Tree entry to which a filter is to be added, and select the Menu Bar Query, Date/Time Range command.

Or:

Right-click on the Filter Tree entry to which a filter is to be added, and select the Refine List, Date/Time Range command from the invoked menu.

In either case, the Date/Time Event Query dialog is invoked. This dialog has two pages:

•	Query Type: This page is used to define the Query to be made, see  The Date/Time Event Query dialog: Query Type page.

•	Parameters: This page is used to specify the times and/or days for which the Query is to apply, see  The Date/Time Event Query dialog: Parameters page.

The options available on the Parameters page depend on the options currently selected on the Query Type page.

 Related Topics

More:

The Date/Time Event Query dialog: Query Type page

The Date/Time Event Query dialog: Parameters page


The Date/Time Event Query dialog: Query Type page

Method Frame	Contains options defining the method used for the query.
Fast query (no   event search   required)	Performs a fast search; only Event indexing information is referenced, giving virtually instantaneous results.
Full query   (event search   required)	Performs a full search; every Event between the specified times is read and passed through the filter. This may take several minutes for large databases.
Note:

Where possible, perform a Fast query first on large databases before performing subsequent queries on the restricted dataset; this should speed the search.

Day Filter	Enables the options in the Parameters page Weekday frame; and various additional options in the Query Type page Query Options frame. This option is only available when the Full query option is selected.
Query Options Frame
Before given   time and date	Enables the Before: time and date boxes in the Parameters page Range and Limits frame.
Between given   Times/dates	Enables the From: and To: time and date boxes in the Parameters page Range and Limits frame.
After given   time/date	Enables the After: time and date boxes in the Parameters page Range and Limits frame.
Before given   time	Enables the Before: time box in the Parameters page Range and Limits frame.
Between given   times	Enables the From: and To: time boxes in the Parameters page Range and Limits frame.
After given   time	Enables the After: time box in the Parameters page Range and Limits frame.
This week	Confines the search to the current week.
Last week	Confines the search to the previous week.
This month	Confines the search to the current month.
Last month	Confines the search to the previous month.
Day Filter    Only	Confines the search to the days selected in the Parameters page Weekday frame.
Today	Confines the search to the current day.
Last…days	Confines the search to the previous number of days entered in the text box.
 Related Topics


The Date/Time Event Query dialog: Parameters page

Range and Limits Frame	This frame contains Time and Date boxes that are used to define the periods in the Audit Log over which the search is to be performed. The boxes displayed depend on the options currently selected in the Query Type page Query Options frame.
After:	The Query will search data written to the Audit Log after the specified time and date.
Before:	The Query will search data written to the Audit Log before the specified time and date.
From….To	The Query will search data written to the Audit Log between the specified times and dates.
The time can be typed directly in the Time box; alternatively, the arrows, [image], can be used to increment the hours, minutes and seconds values after first selecting the value to be changed.

The date can be typed directly in the Date box; alternatively, selecting the [image] button will invoke a calendar dialog.

The Calendar dialog defaults to the current day when invoked.

Clicking on the year in the dialog heading invokes scroll buttons that allow the another year to be selected. Clicking on the month in the dialog heading invokes a drop-down menu from which the required month can be selected. Alternatively, clicking on the arrow buttons in the dialog heading, [image] and [image], will scroll through the months and years.

Weekday Frame	The Query will search data written to the Audit Log on the weekday specified in this frame. This frame is only available when the Query Type page Method frame Day Filter option is selected.
 Related Topics


The Event Origin Filter

The Event Origin Filter searches for Audit Log data, based on the User(s) and Machine(s) that originated the Events.

To select the Event Origin Filter, either:

Click on the Filter Tree entry to which a filter is to be added, and select the Menu Bar Query, Origin command.

Or:

Right-click on the Filter Tree entry to which a filter is to be added, and select the Refine List, Origin command from the invoked menu.

In either case, the Query : Event Origin dialog is invoked.

User Filter Frame	This frame specifies which Users will be included in the Event search, on the machines(s) currently defined in the Machine Filter frame.
All Users	Searches for Events generated by all the Users.
Only this user	Searches for Events generated by the User specified in the User: text box.
All users   except	Searches for Events generated by all the Users, except for the User specified in the User: text box.
Accept partial   match	When selected, the search covers the text string entered in the User: text box; this may be used to search for Events generated by several Users with similar User Names, for example.
User:	Enter the User Name to be used in conjunction with the above options.
Machine filter Frame	This frame specifies which machines will be included in the search for Events generated by the User(s) currently defined in the User Filter frame.
All machines	The search will include all machines on the local network.
Only this   machine	The search will include only the machine specified in the Machine: text box.
All Machines   except	The search will include all the machines, except for the machine specified in the Machine: text box.
Accept partial   match	When selected, the search covers the text string entered in the Machine: text box; this may be used to search several Machines with similar Names, for example.
Machine:	Enter the Machine's Name to be used in conjunction with the above options.
 Related Topics


Event Type Filters

The Permission Check Event Filter

The Log In/Out Event Filter

The Security Event Filter

The Audit Path Filter


The Permission Check Event Filter

The Permission Check Event Filter searches for Audit Log data based on the permissions allocated to operations.

To select the Permission Check Event Filter, either:

Click on the Filter Tree entry to which a filter is to be added, and select the Menu Bar Query, Event Type, Permission Check command.

Or:

Right-click on the Filter Tree entry to which a filter is to be added, and select the Refine List, Event Type, Permission Check command from the invoked menu.

In either case, the Query: Permission Check Event dialog is invoked.

Outcome Frame
Show   ALLOWED   operations	Searches for Allowed operations (shown as Allowed in the Audit Log Outcome column).
Show DENIED   operations	Searches for Denied operations (shown as Denied in the Audit Log Outcome column).
User filter Frame	This frame specifies which Users will be included in the search, on the machines(s) currently defined in the Machine filter frame.
Only this user	Searches for operations generated by the User specified in the adjacent text box.
Allow partial   match	When selected, the search covers the text string entered in the adjacent text box; this may be used to search for operations generated by several Users with similar User Names, for example.
Machine filter Frame	This frame specifies which machines will be included in the search for operations generated by the User(s) currently defined in the User filter frame.
Only this   machine	The search will include only the machine specified in the adjacent text box.
Allow partial   match	When selected, the search covers the text string entered in the adjacent text box; this may be used to search several Machines with similar Names, for example.
 Related Topics


The Log In/Out Event Filter

The Log In/Out Event Filter searches for Log In and Log Out operations.

To select the Log In/Out Event Filter, either:

Click on the Filter Tree entry to which a filter is to be added, and select the Menu Bar Query, Event Type, Log in/out command.

Or:

Right-click on the Filter Tree entry to which a filter is to be added, and select the Refine List, Event Type, Log in/out command from the invoked menu.

In either case, the Query: Log In/Out Event dialog is invoked.

Outcome Frame
Log in   ALLOWED	Searches for Allowed Log in Attempts.
Log in   DENIED	Searches for Denied Log in Attempts.
Log out	Searches for Log out Attempts.
User filter Frame	This frame specifies which Users will be included in the search, on the machines(s) currently defined in the Machine filter frame.
Only this user:	Searches for operations generated by the User specified in the adjacent text box.
Allow partial   match	When selected, the search covers the text string entered in the adjacent text box; this may be used to search for operations generated by several Users with similar User Names, for example.
Machine filter Frame	This frame specifies which machines will be included in the search for operations generated by the User(s) currently defined in the User filter frame.
Only this   machine:	The search will include only the machine specified in the adjacent text box.
Allow partial   match	When selected, the search covers the text string entered in the adjacent text box; this may be used to search several Machines with similar Names, for example.
 Related Topics


The Security Event Filter

The Security Event Filter searches for security events.

To select the Security Event Filter, either:

Click on the Filter Tree entry to which a filter is to be added, and select the Menu Bar Query, Event Type, Security command.

Or:

Right-click on the Filter Tree entry to which a filter is to be added, and select the Refine List, Event Type, Security command from the invoked menu.

In either case, the Query: Security Event dialog is invoked.

Severity Frame
Show LOW    severity actions    (green)	Searches for low severity security events, i.e. events that indicate changes occurring during normal operation, such as noting a setting adjustment in the MSM.
Show HIGH    severity actions    (red)	Searches for high severity security events, i.e. those that indicate critical items such as tamper detection and the deletion of audit log data.
User filter Frame	This frame specifies which Users will be included in the search, on the machines(s) currently defined in the Machine filter frame.
Only this user:	Searches for operations generated by the User specified in the adjacent text box.
Allow partial   match	When selected, the search covers the text string entered in the adjacent text box; this may be used to search for operations generated by several Users with similar User Names, for example.
Machine filter Frame	This frame specifies which machines will be included in the search for operations generated by the User(s) currently defined in the User filter frame.
Only this   machine:	The search will include only the machine specified in the adjacent text box.
Allow partial   match	When selected, the search covers the text string entered in the adjacent text box; this may be used to search several Machines with similar Names, for example.
 Related Topics


The Audit Path Filter

The Audit Path Filter searches an Audit Path (Trail).

To select the Audit, either:

Click on the Filter Tree entry to which a filter is to be added, and select the Menu Bar Query, Event Type, Audit command.

Or:

Right-click on the Filter Tree entry to which a filter is to be added, and select the Refine List, Event Type, Audit command from the invoked menu.

In either case, the Query: Audit Path dialog is invoked.

Partial Path Frame
Filter Path:	When selected, a filter path may be entered in the adjacent text box, see Audit Event for further details of filter paths.
User Frame
Filter User:	Searches for operations generated by the User specified in the adjacent text box.
Partial Match	When selected, the search covers the text string entered in the adjacent text box; this may be used to search for operations generated by several Users with similar User Names, for example.
Except	When selected, the search covers all Users except for that specified in the adjacent text box.
Machine Frame
Filter Machine	The search will include only the machine specified in the adjacent text box.
Partial Match	When selected, the search covers the text string entered in the adjacent text box; this may be used to search for operations generated by several Machines with similar Names, for example.
Except	When selected, the search covers all Machines except for that specified in the adjacent text box.
Date and Time Frame
Filter before	The Query will search data written to the Audit Log before the specified time and date.
Filter after	The Query will search data written to the Audit Log after the specified time and date.
Ignore filter	Disables the date and time filter. Note: The time and date can be entered in the same way as in the Date/Time Event Query: Parameters page dialog; see The Date/Time Event Query dialog: Parameters page.
Auditable operation type Frame
Filter	Enables the adjacent Auditable Operation List.
Auditable   Operation List	Select the required search option(s) in this list.
 Related Topics


Event Details

The details of any given Event may be viewed by double-clicking on that Event; the relevant Event Details dialog is invoked. Each dialog displays details such as the time and date of the Event, the User, the machine, etc.

Logged Time: and Logged Date: are the details as recorded on the Audit Log Server.

Client Time: and Client Date: are the details recorded on the local machine.

More:

Permission Check Event

Log In/Log Out Event

Audit Event


Permission Check Event

Typical Permission Check Event Details dialog


Log In/Log Out Event

Typical Log In/Log Out Event Details dialog


Audit Event

Typical Audit Event Details dialog

Saved File:	Displays the path and file name to which the Base File has been saved.
Base File:	Displays the path and file name for the Base (Source) file.
Audit trail	Displays the Audit Trail leading to the current Audit Event.
For each Event in an event Audit Trail, the corresponding file to the Event is analyzed, if possible, and the result reported in the Audit Trail Event details.

Descriptions of the possible results follow:

File VALID at recorded location

The file corresponding to this Audit Event has been analyzed and found to be valid within the MassLynx Secure System.

Unable to analyse file (access denied)

The current LogLynx User does not have the required permissions to access the file for analysis. If the file is on the same computer as the running LogLynx application, failure to analyze is the result of inadequate Windows file access permissions.

However, if the file exists on another PC, the LogLynx User must have administrative access to the remote PC where the file is held.

File INVALID at recorded location, unauthorised alterations made

The file has moved from a valid state, to an invalid state, as the content has been changed outside the MassLynx Secure System. This could be caused, for example, by editing an experiment method file (.EXP) in Notepad and saving the changes back to the same file. All alterations to secure files must be done through the MassLynx interface to ensure complete audit trailing exists for those changes.

File INVALID at recorded location, no checksum file present

The file does not have a corresponding checksum file, which is used to check the secure status of the main file. By default, these checksum files are hidden by Windows Explorer, so this result will not occur frequently. If the checksum file has been deleted, this result will occur.

File INVALID at recorded location, file properties changed

One or more of the file details that are used to check the secure status of the file, have changed, e.g. the timestamp or file owner.

File INVALID at recorded location, file has been moved outside MassLynx

The file was last altered within MassLynx at a different location to its current location. This typically occurs when the file, and its partner checksum file, have been moved with Windows Explorer.

File was deleted successfully within MassLynx

The file was deleted during an operation controlled by MassLynx, such as a BackLynx backup/remove.

File deleted WITHOUT AUTHORITY

The file no longer exists at the expected location, usually as a result of it being deleted outside MassLynx, e.g. by Windows Explorer or a Command Prompt dialog.

File subsequently changed after this time, still VALID

Each entry in the Audit Trail corresponds to a particular operation that happened at a specified time. Earlier Audit entries may report this result if the file has been subsequently altered by MassLynx since that Audit entry was generated, with a later Audit entry reporting the file as being valid. This is typical for Event Audit Trails where a file has been overwritten by a User with permission to overwrite files.

Unknown file status

The system was unable to analyze the file, for example, a network error may be preventing access to the file on a different PC.


Glossary of Terms

Password

Group

MSM

Account

Access Rights

Access Privileges

Access Permissions

MassLynx Administrator

System Administrator

Local Administrator

Audit Log

Audit Trail

Group Rights

Logon Identity

Logon Name

MassLynx Logon Identity

Right/Privilege/Permissions

Security Manager

User

User Name


Password

A Password is a text string set-up and uniquely known by the User who owns the Windows Account with which it is associated. No actions can be taken under any Account until Windows has validated that the password matches that stored where the Account is administered.


Group

A Group is a collection of MassLynx Users. A Group can have Access Rights assigned to it to restrict their movements within the data system. Groups provide a convenient way of managing the capabilities of Users (it is often easier to remember which Access Rights a particular Group has, rather than those of an individual User).

Note: The Administrators Group cannot be deleted.

The MassLynx Group is not to be confused with Windows Groups, which may have a more complicated structure.


MSM

MassLynx Security Manager


Account

An account is the unique combination of domain name and User Name


Access Rights

The Access Rights (or Access Privileges or Access Permissions) are the means by which Administrators can restrict the actions of a Group of Users. MassLynx Security Access Rights are assigned to Groups, and Users are members of a Group. Access Rights cannot be assigned directly to individual Users. Only Users who are members of a Group with the "Administer user accounts and groups" User Right (see ) can assign Access Rights to other Groups.


Access Privileges

The Access Rights (or Access Privileges or Access Permissions) are the means by which Administrators can restrict the actions of a Group of Users. MassLynx Security Access Rights are assigned to Groups, and Users are members of a Group. Access Rights cannot be assigned directly to individual Users. Only Users who are members of a Group with the "Administer user accounts and groups" User Right (see ) can assign Access Rights to other Groups.


Access Permissions

The Access Rights (or Access Privileges or Access Permissions) are the means by which Administrators can restrict the actions of a Group of Users. MassLynx Security Access Rights are assigned to Groups, and Users are members of a Group. Access Rights cannot be assigned directly to individual Users. Only Users who are members of a Group with the "Administer user accounts and groups" User Right (see ) can assign Access Rights to other Groups.


MassLynx Administrator

A MassLynx Administrator is any member of the MassLynx Administrators Group, which always has all possible MassLynx Privileges, i.e. they can add and remove Users and Groups, and assign Access Rights.

Note: A MassLynx Administrator need not be a member of a local Windows Administrator Group, although this is normally advisable.


System Administrator

A System Administrator is a User who knows the Passwords for the IT Department domain servers.


Local Administrator

A Local Administrator is a User who has an account in the "Administrators" group on the local PC.


Audit Log

The Audit Log contains a historical list of events showing which Users accessed, or attempted to access, objects controlled by MassLynx security. Auditing can be customized so that only certain categories of event are included, or it can be disabled completely.


Audit Trail

The Audit Trail is a combination of files on disk and Audit Log. It indicates the current and all past states of a file, i.e. when it was changed, who by, for what reason, and (implicitly in the case of MassLynx) what was changed.


Group Rights

See Access Rights, Access Privileges, Access Permissions.


Logon Identity

The Logon Identity is the Account with which a User is logged on (either to Windows or MassLynx).


Logon Name

The Logon Name is the User Name component of the account used to log on to either Windows or MassLynx.


MassLynx Logon Identity

The MassLynx Logon Identity is the Account by which a User is known to MassLynx Security. Each Logon Identity has been validated using the associated Windows Account Password.


Right/Privilege/Permissions

See Access Rights/Privileges/Permissions.


Security Manager

The Security Manager is the utility that allows administration of the MassLynx Security System. The Security Manager cannot be run at the same time as MassLynx.


User

A User is a person who uses MassLynx.

Note: A User should not be a member of the MassLynx Administrator Group.


User Name

A User Name is a simple mnemonic used as the first part of a Windows Account Identity, e.g. FredJ20.