Introduction to security

Security

MassLynx can be installed with one of two levels of security – Basic or Full. The following table outlines the differences between the two.

MassLynx Security levels:

Feature | Basic | Full
Limit system access to specific users | X | X
Configure restricted access to certain functions or areas | X | X
Record all events in audit logs | X | X
Control the directories the user can access through MassLynx |  | X
Detect any files that have been modified outside MassLynx |  | X
Record signatures or reasons when data created, modified, or processed |  | X

Exception: Signatures can be recorded for QuanLynx actions in Basic Security mode.

Basic Security is ideal for situations where you need to control who uses MassLynx, and what they can use it for.

Full Security is appropriate for situations where it is important for you to have absolute confidence that your settings and data have not been tampered with, and where a complete audit log is needed to record the changes that are made.

This help explains the features available when using security for your system. Most of these features apply both to Basic and Full Security – it is clearly indicated when a feature applies only to one or the other.

Regulated environments

Support for application managers

What is Security Manager?


Copyright

Copyright © Waters Corporation 2005

All Rights Reserved.

This document contains information that is proprietary to Waters Corporation. The original recipient of this document may duplicate this document in whole or in part for internal business purposes only, provided that this entire notice appears in all copies. In duplicating any part of this document, the recipient agrees to make every reasonable effort to prevent the unauthorized use and distribution of the proprietary information.

The information in this Help system is subject to change without notice and should not be construed as a commitment by Waters Corporation. Waters Corporation assumes no responsibility for any errors that may appear in this Help system. This Help system is believed to be complete and accurate at the time of publication. In no event shall Waters Corporation be liable for incidental or consequential damages in connection with, or arising from, the use of this document.

Micromass and Waters are registered trademarks, ChromaLynx, FractionLynx, MarkerLynx, MassLynx, MetaboLynx, MicrobeLynx, i-FIT, OpenLynx, ProfileLynx, QuanLynx and TargetLynx, are trademarks of Waters Corporation.

Microsoft and Windows are registered trademarks of Microsoft Corporation.

All other trademarks or registered trademarks are the sole property of their respective owners.

Online Information System overview

Product documentation overview

Contact information


contactinfo

Waters Corporation contact information

Technical support

If you have enhancement requests or technical questions regarding the use of any Waters Corporation product, contact us as follows:

Internet | http://www.waters.com
Standard mail | 34 Maple Street Milford, MA 01757
Telephone | 508 478-2000 or 800 252-4752 (In the USA or Canada) Refer to http://www.waters.com for complete telephone listings according to geographic location.

Your comments

We welcome your feedback on this online information system documentation or any other Waters Corporation product or document. We are also interested in your suggestions for any additional topics you want included in our product documentation. Please contact us at the following email address with your comments:

Tech_Comm@waters.com

Online Information System overview

Product documentation overview

Copyright information


accessinfo

Welcome to our Online Information System

This MassLynx Security topic database is part of the Waters Corporation Online Information System. This system is designed to answer your questions while you work with Waters Corporation products and the MassLynx Security product suite. You can easily resize this information system window, move it, and hide or show the navigation pane as required.

Viewing information in this window

Use standard window-operating procedures to manipulate this window. For example, you can drag a corner of this window to resize it or click the Minimize button in the top-right corner to temporarily shrink it into a button at the bottom of your screen. Once you find the task-related information you need, click the Hide icon in the top-left corner of the window to close the navigation panel on the left, keeping only the contents of the topic displayed. After using the information to help you complete your task, you can then click the Show icon to redisplay the navigation panel if desired.

Navigating to a topic for complete details

When you select the Contents tab, the navigation pane on the left side of the Help window contains a list of topics based on the common tasks you perform with this product suite.

  • Click the plus sign to show the sections within a topic

  • Click the minus sign to hide the sections within a topic

  • Double-click a topic entry to display the related information in place of the text you are now reading

You can also click the Index or Search tab in this navigation bar to locate a specific piece of information in this online information system based on a key word or phrase

Printing topic content

To print a single topic, click the Print toolbar button or right-click within the topic, and then click Print.

To print multiple topics simultaneously, click the Contents tab within the navigation pane of the Help window, navigate to the folder that contains the topics you want to print, and then click Print to print the selected topic or the selected heading and all its subtopics.

Tip: The header and footer information that appears at the top and bottom of the pages when you print a topic from the Help system is controlled by the same print settings you have defined for Internet Explorer. From Internet Explorer's File menu, click Page Setup to specify what you want to print in the headers and footers of your topics. In the Page Setup dialog box, enter the appropriate code strings for the header and footer text that will print on your pages. You can click the What's This? Help button from within the dialog box to view a description of the available codes.

Copying information contained in a topic

To copy information from one of the topics in this online information system into another file:

  1. In the topic window, select the text you want to copy, right-click, and then select Copy from the shortcut menu that appears.

  2. Open the file in which you want to copy the information, and position the cursor where desired.

  3. From the Edit menu, click Paste.

Searching for information

When you want to quickly find information, you can check the index for this online information system or conduct a search for specific word(s).

To use the index in this online information system:

  1. In the left-hand navigation pane, click the Index tab.

  2. Scroll through the index or in the text box on the Index tab, type the word(s) you want to find within the index, and then click Display to show the topic contents.

To search for words in this online information system:

  1. In the left-hand navigation pane, click the Search tab.

  2. In the first text box on the Search tab, type the word(s) you want to find, and then click List Topics.

  3. When the list of topics that contain the word you want to find appears, double-click a title or click Display to show the topic contents.

Result: The topics listed contain the word(s) specified, though the words may not appear in the topic title. When you display the topic, the word(s) are highlighted where they appear within the topic contents.

Product documentation overview

Contact information

Copyright information


docoverview

MassLynx Security and LogLynx documentation

This product documentation is part of the Waters Corporation Online Information System for MassLynx Version 4.1. The material presented here is for any user configuring, administering, or reviewing MassLynx Security.

Documentation conventions

Instructions in this documentation adhere to the following conventions.

> | Denotes the path for selecting menu commands, for moving from one menu to another, or for performing a task. Example: Click File > Open
< > | Indicates that you must enter variable information, such as a path or filename. Example: Enter open <filename>

Online Information System overview

Contact information

Copyright information


Regulated environments

If you operate in a regulated environment you will probably wish to use Full Security.

If there are specific regulatory requirements that you would like MassLynx to help you fulfill, common regulatory requirements highlights features that can be used to assist with achieving compliance in some of the most common areas.

Caution: MassLynx cannot satisfy regulatory requirements by itself: it is only a component of the processes and procedures you need to have in place. You must consider carefully what the regulations require of you, and configure and operate MassLynx in a manner compatible with your understanding.

Introduction to security

Support for application managers

Common regulatory requirements


Support for application managers

Application Managers are additional software components that can optionally be installed to extend the functionality of MassLynx.

Basic Security provides control over whether users can access the various application managers you may have installed.

The additional features (as shown in Introduction to security) provided in Full Security mode are only available for the QuanLynx and TargetLynx application managers.

Introduction to security

Regulated environments


Starting Security Manager - What is Security Manager?

What is Security Manager?

Security Manager is an application that enables the MassLynx administrator to perform security-related tasks, including creating and managing users and groups, controlling access to various parts of the MassLynx system, and configuring signature and reason policies.

Introduction to security

Starting Security Manager

The Security Manager window

Understanding MassLynx groups

Understanding MassLynx users

What are signatures and reasons?


Starting Security Manager

To start Security Manager:

  1. Close any MassLynx applications that are running.

  2. Click Start > All Programs > MassLynx > MassLynx Security Manager.

  3. Type the Windows user name of a MassLynx administrator in the Logon Name box.

Tip: If MassLynx security was installed with the default settings, the first time you run Security Manager you will need to use the local PC Administrator user name – normally ‘Administrator’.

  4. Type the Windows password for the user in the Password box.

  5. In the Domain list, click the domain for which the user name is valid.

  6. If there is a Role list, click Regulated.

  7. Click OK.

  8. If a warning message appears, read the message. If you do not understand the message or are not happy to continue, close the Security Manager window as soon as it appears and consult your system administrator. Click OK.

Tips:

  • To log in to MassLynx, the user must always be both a valid Windows user and a MassLynx user.

  • The domain, user name, and password are authenticated against the Operating System. If a user’s password is changed in the Operating System, the new password will also be required to access MassLynx.

  • To log on to Security Manager, the user must be specified as a MassLynx administrator. They do not need to be a Windows administrator.

What is Security Manager?

The Security Manager window

Introduction to security


The Security Manager window

When you have successfully logged in to Security Manager, the Security Manager window will be displayed.

What is Security Manager?

Starting Security Manager


Creating groups - Understanding MassLynx groups

Understanding MassLynx groups

Groups are the building blocks of MassLynx Security – groups are assigned rights to access areas of MassLynx and perform operations. Users derive their rights from the group they belong to.

The groups you will need for your system will depend on the type of users you have. Take some time to consider the roles of different people within your organization, and create a group for each set of users with similar needs.

Built-in groups

Regulated and Non-Regulated groups

Creating or modifying a group

Understanding MassLynx users


Built-in groups

Some groups are supplied with the MassLynx installation. Two of these are permanent groups that cannot be deleted; the others are example groups to give you an idea of how MassLynx groups can be used.

The example groups may not be present if you retained or imported security settings during the install.

Permanent groups

Administrators – Members can access and fully administer MassLynx and Security Manager.

Disabled – Members have no access to MassLynx. New users are assigned by default to this group.

Example groups

The example groups illustrate some of the possible roles that users might have. You can review the rights that these groups have been assigned and modify them to fit your needs – creating new groups for additional roles – or delete these groups and start afresh.

Caution: You should not begin adding users to these groups without thoroughly reviewing the rights assigned to them and confirming that they are appropriate for your needs.

Example groups supplied:

Analysts

Maintenance

Method Developers

Reviewers

Understanding MassLynx groups

Regulated and Non-Regulated groups

MassLynx group rights

Creating or modifying a group


Regulated and Non-Regulated groups

Full Security only: This section only applies to Full Security systems.

When MassLynx is installed with Full Security, the option to make groups Regulated or Non-Regulated is available.

Regulated groups operate under the normal Full Security model, including file modification detection, signatures, and reasons.

Non-regulated groups are not prompted for signatures or reasons, and do not have checksums checked or created for the files they use.

Why would Non-Regulated groups be used?

Some systems operate in environments where the instrument is being used for regulated work some of the time and for non-regulated, experimental, work at other times. It may be that different people perform different types of work on the machine, or perhaps a single person has a variety of goals to achieve.

Operating under the Full Security system can be time-consuming for users whose work is not subject to official review.

Allowing this type of user to be a member of a Non-Regulated group – or allowing the user to choose whether they should login using their Regulated or Non-Regulated group – enables your system to be used as efficiently as possible without compromising your ability to enforce the strictest security where appropriate.

Understanding MassLynx groups

Creating or modifying a group


Creating or modifying a group

Security Manager > Create > New Group
Security Manager > Right-click group > Edit

To create a group:

  1. Click Create > New Group.

Alternative: Click

  2. Type a name for the group.

  3. Type a short description of the role of the users who will be in this group.

  4. Full Security only: Select whether the group will be Regulated.

  5. A warning can be displayed when a member of this group logs on. Click Warning to view or modify the warning given.

  6. Click OK.

To modify a group:

  1. In the group list, double-click the group you wish to modify.

Alternative: Right-click the group, then click Edit.

  2. In the Manage Group dialog box, modify the settings as required.

  3. Click OK.

To delete a group:

Caution: If you delete a group, its members will not be able to log in to MassLynx unless they are already a member of another group with rights assigned, or until they are added to another group. As all the settings, rights, and policies configured for the group will be lost, deletion should only be performed after careful consideration.

  1. In the group list, click the group you wish to delete.

  2. Click Create > Delete.

Alternative: Click

  3. Click Yes to confirm that you want to delete the group.

Understanding MassLynx groups

Built-in groups

Regulated and Non-Regulated groups

Adding users to groups

Assigning rights to groups


Adding users to groups

Security Manager > Right click user > Edit
Security Manager > Right click group > Edit > Assign Members

Users inherit rights from the group they have membership of. MassLynx will only allow a user to be a member of one group.

Exception: If Full Security is being used, a user may be a member of one Regulated and one Non-Regulated group.

Users can be added to groups either through the Manage User dialog box or through the Manage Group dialog box.

To add a single user to a group:

  1. In the user list, double-click the user you wish to add.

Alternative: Right-click the user, then click Edit.

  2. In the Group Membership frame, select the group you want the user to be a member of.

Full security only: You can select a Regulated group and a Non-Regulated group.

  3. Click OK.

To add users to a group:

  1. In the group list, double-click the group you wish to add users to.

Alternative: Right-click the group, then click Edit.

  2. Click Assign Members.

  3. Select the check box beside each user you wish to add. Clear the check boxes beside any users you wish to remove.

Tip: If a user is already a member of another group, you will not be able to select them in the list. Remove them from the group they are currently a member of before trying to add them to this group.

  4. Click OK to return to the Manage Group dialog box.

  5. Click OK.

Understanding MassLynx groups

Regulated and Non-Regulated groups

Assigning rights to groups

Understanding MassLynx users


Assigning rights to groups

Security Manager > Right click group > Edit > Assign Rights

Groups need to have rights assigned to them before their members are able to perform actions in MassLynx.

Definitions of the rights available can be found in MassLynx group rights.

Recommendation: It is often important, especially in regulated environments, that when any new data or support files – such as method files, tuning files, calibration files and so on (collectively known as metadata) – are created, all the old information is retained rather than being overwritten.

To ensure that this is the case, grant rights to create new files, but not to alter or overwrite files.

To assign rights to groups:

  1. In the group list, double-click the group you wish to assign rights to.

Alternative: Right-click the group, then click Edit.

  2. Click Assign Rights.

  3. Select the check box beside each right you wish to add. Clear the check boxes beside any rights you wish to remove.

Tip: Select multiple rights by clicking a right, then holding the Ctrl key while clicking other rights. Select blocks of rights by clicking the first right in the block, holding the Shift key, then click the last right in the block. Press the space bar to select or clear the check boxes of the selected rights.

  4. Click OK to return to the Manage Group dialog box.

  5. Click OK.

MassLynx group rights

Adding users to groups

Understanding MassLynx groups

Built-in groups

Understanding MassLynx users


MassLynx group rights

Security Manager > Right click group > Edit > Assign Rights

This section contains all the rights that can be allocated to MassLynx groups, and descriptions of what these rights control.

The rights are listed in alphabetical order. Click one of the letters below to jump to that part of the list.

A B C F G L M N O P Q S T

MassLynx group rights:

Right | Allows the user to
ACE Inlet Editor – Enter editor | Enter the Acquisition Control Editor (ACE) inlet control and method editor window.
ACE Inlet Editor – Create new file on disk | Create new ACE inlet method files.
ACE Inlet Editor – Alter existing file on disk | Overwrite existing ACE inlet method files.
ACE Inlet Editor – Allow instrument configuration | Access the Tools > Configuration settings in the inlet editor window.
Acquisition – Start from tune page | Acquire data from the Tune window.
Acquisition – Start from sample list | Start data acquisitions from the Sample List within the main MassLynx window.
Acquisition – Start calibration acquisitions | Start the calibration process to create new calibration acquisitions from the tune calibration window.
Acquisition – Overwrite raw data | Acquire raw data to a filename which already exists.
Acquisition – Access the sample queue | Access the MassLynx sample queue.
Acquisition – Access another person’s sample queue items | Access and delete currently scheduled sample batches belonging to another user.
Acquisition – Allow priority samples | Alter the priority of sample batches.
Administrative – Administer user accounts and groups | Create, modify and delete MassLynx users and groups and assign MassLynx rights to groups. Restriction: This right cannot be assigned to any group except Administrators.
Administrative – Override current MassLynx login | Log on to a locked MassLynx session in place of the current user.
Administrative – Validate import options | Act as second signatory on import operations requiring dual authorization. Restriction: This right cannot be assigned to any group except Administrators.
Administrative – Allow reasons to be added at the point of signing | Add new reasons to the list of available reasons at the point where a reason is requested.
Administrative – Allow entry to the Security Manager | Access Security Manager. Restriction: This right cannot be assigned to any group except Administrators.
BackLynx – Enter BackLynx | Access the BackLynx window.
BackLynx – Overwrite old target | Overwrite destination files which are older than the source files.
BackLynx – Overwrite any target | Overwrite all target files.
BackLynx – Delete source | Delete source files.
BackLynx – Remove task from queue | Delete BackLynx tasks.
BioLynx – Use BioLynx | Access BioLynx features.
ChromaLynx – Use ChromaLynx | Access ChromaLynx features.
File Browser – Delete file | Delete raw data on disk from within MassLynx.
FractionLynx – Use FractionLynx | Access FractionLynx features.
General – Import legacy projects | Import data or metadata into MassLynx in Full Security mode.
General – Modify fonts and colors | Change the fonts and colors used by MassLynx.
General – Modify sample list format | Change the columns displayed in the sample list within the main MassLynx window.
General – Customize MassLynx system globals | Change MassLynx global settings in the main MassLynx window.
Library – Use Library functions | Access the Library features.
LogLynx – Enter log viewer | Open the LogLynx audit log viewer.
LogLynx – Delete log | Delete sections of the MassLynx event log. After deletion, the log will contain an entry noting when the contents were deleted and by whom.
LogLynx – Import log | Import sections of a MassLynx event log from a file.
LogLynx – Export log | Export sections of the MassLynx event log to a file.
MS Calibration – Enter instrument calibration window | Enter the Calibration window for the mass spectrometer.
MS Calibration – Create new file on disk | Create new MS Calibration files.
MS Calibration – Alter existing file on disk | Overwrite existing MS Calibration files.
MS Calibration – Recalibrate a raw file | Apply a calibration file to a raw data file, in either the Spectrum window or the Calibration window.
MS Method – Enter editor | Enter the MS Method/Experiment Setup window.
MS Method – Create new file on disk | Create new MS acquisition method files.
MS Method – Alter existing file on disk | Overwrite existing MS acquisition method files.
MarkerLynx – Use MarkerLynx | Access MarkerLynx features.
MetaboLynx – Use MetaboLynx | Access MetaboLynx features.
MicrobeLynx – Use MicrobeLynx | Access MicrobeLynx features.
NeoLynx – Use NeoLynx | Access NeoLynx features.
NeoLynx – Modify test tables | Modify NeoLynx test tables.
NeoLynx – Modify browser schemes | Modify NeoLynx browser schemes.
OpenLynx – Use OpenLynx functions | Use OpenLynx functions.
Post Source Decay – Use PSD MX functions | Access the Post Source Decay option.
ProfileLynx – Use ProfileLynx | Access ProfileLynx features.
ProteinLynx – Use ProteinLynx | Access ProteinLynx features.
Quan Optimize – Use QuanOptimize | Access QuanOptimize features. In Full Security mode, this option will only be available for Non-Regulated groups.
QuanLynx – Enter QuanLynx | Access QuanLynx features.
QuanLynx – Save new calibration curves to disk | Create new quantitation calibration curves.
QuanLynx – Alter existing calibration curves on disk | Manually alter points on quantitation calibration curves.
QuanLynx – Re/Integrate samples | Create integrated peaks.
QuanLynx – Add/Modify/Delete peaks | Add new peaks and modify or delete existing peaks.
QuanLynx – Quantify samples | Apply the quantitation step in processing to form concentrations.
QuanLynx – Use calculated calibration | Calculate a calibration curve from the data and perform the calibration step in processing.
QuanLynx – Include/Exclude calibration points | Include or exclude points in the calibration curve in QuanLynx or TargetLynx.
QuanLynx – Change individual curve fitting | Change the fit for a calibration curve in QuanLynx or TargetLynx.
QuanLynx – Export LIMS file | Export LIMS-format files.
QuanLynx – Export XML file | Export XML-format files.
QuanLynx – Export current summary | Export the summary information for the currently selected sample or compound.
QuanLynx – Export complete summary | Export complete QuanLynx Summary Reports.
QuanLynx – Export all groups summary | Export the All Groups summary from the QuanLynx Summary Report.
QuanLynx – Print report | Print reports from QuanLynx.
QuanLynx – Modify layout | Save a QuanLynx layout.
QuanLynx – Modify report format | Modify the format of the printed quantitation report.
QuanLynx Dataset – Save new dataset to disk | Create a new QuanLynx or TargetLynx Dataset.
QuanLynx Dataset – Alter existing dataset on disk | Overwrite an existing QuanLynx or TargetLynx Dataset on disk.
QuanLynx Dataset – Accept a dataset | “Accept” a QuanLynx or TargetLynx Dataset.
QuanLynx Dataset – Review a dataset | “Review” a QuanLynx or TargetLynx Dataset.
QuanLynx Dataset – Unaccept a dataset | “Unaccept” a QuanLynx or TargetLynx Dataset.
QuanLynx Method – Enter editor | Enter the QuanLynx method editor window.
QuanLynx Method – Create new file on disk | Create new quantitation method files.
QuanLynx Method – Alter existing file on disk | Overwrite existing quantitation method files.
QuanLynx Method – Internal alteration | Alter the quantitation method within a QuanLynx dataset (but not save the method to disk).
QuanLynx Method – Internal RT auto adjustment | Automatically alter retention times in the quantitation method in a QuanLynx dataset.
QuanLynx Method – Alter format of editor | Configure which fields are visible in the QuanLynx or TargetLynx quantitation method editor.
SDMS – Configure SDMS options | Set or change the SDMS configuration options.
SDMS – Use Send Tool | Use the facility to send files to SDMS.
SDMS – Allow file removal when using Send Tool | Remove files when they have been sent to SDMS.
SDMS – Use Retrieve Tool | Use the facility to retrieve files from SDMS.
Sample List – Create new file on disk | Create new sample list files.
Sample List – Alter existing file on disk | Overwrite sample list files.
Setup – Modify lab and user info | Adjust the MassLynx lab and user information to be stored with acquired or quantified data.
Shutdown Method – Enter startup/shutdown editor | Enter the startup/shutdown editor window.
Shutdown Method – Create new file on disk | Create new startup/shutdown files.
Shutdown Method – Alter existing file on disk | Overwrite startup/shutdown files.
TargetLynx – Enter TargetLynx | Access TargetLynx features.
Tools – Enter ChroTool | Access the ChroTool feature in the Chromatogram window.
Tools – Enter DDATool | Access the DDATool feature in the Chromatogram window.
Tools – Enter Strip Datafile | Access the Strip Datafile feature.
Tools – Enter Accurate Mass Measure | Access the All File Accurate Mass Measure (AFAMM) feature.
Tools – Enter Combine Functions | Access the Combine Functions feature.
Tools – Enter Combine All Files | Access the Combine All Files feature.
Tools – Enter Molecular Weight Calculator | Access the Molecular Weight Calculator feature.
Tools – Enter Molecule Viewer | Access the Molecule Viewer feature.
Tune Page – Edit lock masses | Add or alter Lock Mass mass entries. Restriction: This feature is not available for all instruments.
Tune Page – Enter tuning window | Enter the Tune window.
Tune Page – Enable tune page during acquisitions | Access the Tune window while an Tune window acquisition is in progress.
Tune Page – Access engineering settings | Access the engineering pages in Tune window. Restriction: Engineering pages are not available for all instruments.
Tune Page – Create tune file | Create a tune parameter file.
Tune Page – Alter tune file | Overwrite the contents of a tune parameter file.
Tune Page – Enter Autotune | Use the Autotune wizard. Restriction: The Autotune wizard is not available for all instruments.
Tune Page – Alter Machine Name | Change the instrument name from the Tune window.

Assigning rights to groups

Understanding MassLynx groups

Creating or modifying a group

Adding users to groups


Creating users - Understanding MassLynx users

Understanding MassLynx users

Every user who wishes to use MassLynx must have their own MassLynx user created.

It is only possible to create a MassLynx user if an Operating System user account already exists for that user name as, when a login is attempted, MassLynx authenticates the user’s domain, user name, and password with the Operating System.

Users are not themselves allocated rights, but inherit them from the group of which they are made a member. Rights can easily be configured for a group – sample analysts, for example – and users added or removed from that group. This simplifies administration by removing the need to allocate rights to individual users.

Recommendations:

  • Standard MassLynx users are created automatically when MassLynx security is installed with default settings. Once other users have been created, these users should be disabled by adding them to the Disabled group. See Adding users to groups for information on how to do this.

Caution: It is essential that the ‘Micromass’ Operating System user account is not deleted on the PC controlling the instrument. If the user is deleted from the Operating System, your instrument will no longer operate.

It is always safe to disable the ‘Micromass’ MassLynx user account. On PCs other than the PC controlling the instrument, it is also safe to delete the ‘Micromass’ Operating System account.

  • One of the new users you create will need to be made a member of the MassLynx Administrators group in order to log on to Security Manager. See Adding users to groups for information on how to do this.

Creating or modifying a user

Understanding MassLynx groups

Adding users to groups

Assigning rights to groups


Creating or modifying a user

Security Manager > Create > New User
Security Manager > Right-click user > Edit

To create a new user:

  1. Click Create > New User.

Alternative: Click

  2. In the Domain list, select the domain for which the user is valid.

  3. In the User Name list, select the user name. If you cannot see the user’s name in the list, but you are sure that the domain is set correctly, type the name into the User Name box.

Tip: The list of user names will usually be available if the user logged in to Security Manager is a member of the relevant domain.

  4. In the Full Name box, type the user’s full real name

Tip: This field is used by MassLynx to annotate security events. It does not have to be the same as the user’s Windows Full Name.

  5. In the Description box, type a description of the user – their role, for example.

  6. Click OK.

To modify a user:

  1. In the user list, double-click the user you wish to modify.

Alternative: Right-click the user, then click Edit.

  2. Modify the available settings as desired. Some of the settings for a user cannot be changed once the user has been created.

  3. Click OK.

To delete a user:

Caution: Users should never be deleted in regulated environments, and it is inadvisable whatever your situation. As MassLynx actions are recorded in the audit log with the name of the user who performed them, it is beneficial for all users to be retained in the system for future reference.

Users should be added to the Disabled group (see Adding users to groups) rather than be deleted.

  1. In the user list, click the user you wish to delete.

  2. Click Create > Delete.

Alternative: Click

  3. Click Yes to confirm that you want to delete the user.

Understanding MassLynx users

Understanding MassLynx groups

Adding users to groups

Assigning rights to groups


Configuring directory policies - What are directory policies?

What are directory policies?

Full Security only: Directory policies only apply to Full Security systems.

Directory policies are used to control which directories users can access through MassLynx.

Configuring directory policies correctly ensures that different types of work are kept separate, that users do not access inappropriate information, and that there is no chance of Non-Regulated work accidentally crossing into Regulated areas.

Directory policies are configured by specifying the directories that a particular group can access. The users who are members of that group will then be able to use MassLynx to open and save files in those directories, subject to them having rights to do so.

There are two rights that can be granted for a directory:

  • Allowed – Members of a group with this right will be able to access this directory and its subdirectories through MassLynx, and load files from and save files to them.

  • Import – Members of a Regulated group with this right will be able to import files from this directory and its subdirectories.

Tips:

  • All users have access to the installation directory and its subdirectories. For this reason, these directories should never be used as locations for saving projects.

  • Regulated and Non-Regulated groups should not be able to access the same directories through MassLynx.

  • If Imported is checked and Allowed is not, then users in the group will not be able to load or save files to that directory, but will be able to import files into one of their allowed directories and modify them.

This is ideal for Regulated groups who need to utilize information, such as method files, created by Non-Regulated groups.

Setting directory policies

What are security policies?

Regulated and Non-Regulated groups


Setting directory policies

Security Manager > Policies > Directory Policy

To set directory policies:

  1. Click Policies > Directory Policy.

Result: The Directories window is displayed.

  2. Select a group in the left side of the window.

Result: In the right side of the window, the check boxes indicate which directories the group has access to.

  3. To add a directory, click the [image] button.

  4. In the Add Directory dialog box, enter the directory you wish to grant access to.

  5. Click OK.

Result: The directory you have added is displayed in the right side of the window.

  6. Select the Allowed check box on the line for the directory you have added.

  7. Repeat steps 4 to 7 for other directories you want to allow access to.

  8. Click OK.

The Directories window provides a number of additional features to help you administer directory policies.

Directories window features:

To do this

Do this

Edit a directory

  1. In the right side of the window, click the directory you want to edit.

  2. Click the [image] button.

  3. Edit the directory, then click OK.

Delete a directory

  1. In the right side of the window, click the directory you want to delete.

  2. Click the [image] button.

Apply actions to more than one group

  1. Select all the groups you want the action to apply to.

To select a number of adjacent groups, click the first group, hold the Shift key, then click the last group.

To select a number of non-adjacent groups, click the first group, hold the Ctrl key, then click each of the other groups.

  2. Perform the action – selecting the Allowed check box, for example – that you wish to apply to the groups.

Allow files to be imported from a directory

  1. In the left side of the window, click the group you want to apply the policy to.

  2. In the right side of the window, select the Imported check box for the directory you want to allow files to be imported from.

Show the groups that can access a directory

  1. In the right side of the window, click the directory you are interested in.

  2. Click Show Groups.

Result: The groups that are allowed to access or import from that directory are highlighted in the left side of the window.

What are directory policies?

Regulated and Non-Regulated groups


Setting security policies - What are security policies?

What are security policies?

Security Manager > Policies

Security policies affect the way in which security-enabled MassLynx runs. There are a number of settings that control:

  • which information a user must enter to access and use MassLynx.

  • how long a user must be inactive for before MassLynx locks automatically.

  • whether users’ personal preferences will be remembered.

  • how attempts to tamper with files are reported.

  • what MassLynx should do in the event of unexpected termination.

  • which information should be stored in the audit logs, and where the log should be stored.

  • how users can export data to LIMS systems.

When configuring the security for a MassLynx system, go through each of the policies in turn, deciding which settings best meet the needs of your organization.

MassLynx Security enabled

Critical error protection

Use individual INI files

Forget last username

Tamper detection

Audit policy

Dual authorization

Timeout

LIMS policy

What are signatures and reasons?


MassLynx Security enabled

Security Manager > Policies > MassLynx Security enabled

Basic Security only: This section only applies to Basic Security systems.

Security enabled settings:

Setting | Implication
Enabled | Users are only able to log on if they are set up as MassLynx users and supply the correct user name and password details. Rights control, and all other Security Manager settings, will be enforced.
Not enabled | MassLynx users can access the system without supplying their credentials. No rights control will be exercised.

To toggle the option, click Policies > MassLynx Security Enabled. A tick will appear alongside MassLynx Security Enabled if security is currently enabled.

What are security policies?

Critical error protection

Use individual INI files

Forget last username

Tamper detection

Audit policy

Dual authorization

Timeout

LIMS policy

What are signatures and reasons?


Critical error protection

Security Manager > Policies > Critical Error Protection

Critical error protection closes all MassLynx applications if a critical error – an abnormal program termination – occurs in any MassLynx component.

This ensures that no inconsistencies can be caused by parts of the program continuing to run, and that there is no chance that security can be compromised.

To toggle the option, click Policies > Critical Error Protection. A tick will appear alongside Critical Error Protection if it is currently enabled.

Recommendation: For Full Security systems, critical error protection should always be turned on.

What are security policies?

MassLynx Security enabled

Use individual INI files

Forget last username

Tamper detection

Audit policy

Dual authorization

Timeout

LIMS policy

What are signatures and reasons?


Use individual INI files

Security Manager > Policies > Use Individual INI files

If you choose to use individual INI files, many of the user’s preferences – such as the current project and location and size of application windows – will be retained.

Enabling this option is likely to enhance the user’s experience, but if you want to apply any changes made to every user who logs on – regardless of who they are – choose to disable this feature.

Recommendation: Use individual INI files should usually be enabled for Full Security systems.

To toggle the option, click Policies > Use Individual INI files. A tick will appear alongside Use Individual INI files if it is currently enabled.

What are security policies?

MassLynx Security enabled

Critical error protection

Forget last username

Tamper detection

Audit policy

Dual authorization

Timeout

LIMS policy

What are signatures and reasons?


Forget last username

Security Manager > Policies > Forget Last Username

This option allows to you specify whether a user should have to enter their domain and username every time they access the software.

If this option is selected, the details of the last user to log on will be cleared from the login dialog box, and all the details will need to be re-entered.

If the option is not selected, the username and domain of the last user to log on will be automatically filled in when the login dialog box is displayed – only the password will need to be entered.

Recommendation: Forget last username should usually be enabled for Full Security systems.

To toggle the option, click Policies > Forget Last Username. A tick will appear alongside Forget Last Username if it is currently enabled.

What are security policies?

MassLynx Security enabled

Critical error protection

Use individual INI files

Tamper detection

Audit policy

Dual authorization

Timeout

LIMS policy

What are signatures and reasons?


Tamper detection

Security Manager > Policies > Tamper Detection

Full Security only: This section only applies to Full Security systems.

In Full Security mode, MassLynx will always ensure file integrity by detecting that files have been tampered with if an attempt is made to open them.

This option determines whether attempts to open files that have been tampered with will generate warning messages on the local machine, in the audit log, and (optionally) on a remote machine.

Requirements: For alerts to be sent to a remote machine, the Remote Alert settings must be configured in the Audit policy, and the Windows Alerter and Messenger services must be running on both the local and remote machines. For assistance on setting up Alerter and Messenger, refer to Microsoft Windows help.

Recommendation: Tamper detection should usually be enabled for Full Security systems.

To toggle the option, click Policies > Tamper Detection. A tick will appear alongside Tamper Detection if it is currently enabled.

What are security policies?

MassLynx Security enabled

Critical error protection

Use individual INI files

Forget last username

Audit policy

Dual authorization

Timeout

LIMS policy

What are signatures and reasons?


Audit policy

Security Manager > Policies > Audit

The Audit Policy determines what type of events (such as users logging on or off, or accessing certain parts of MassLynx) should be recorded in the audit log, and where audit log information and alerts should be sent.

To set your Audit Policy, click Policies > Audit. The Audit Policy dialog box is displayed. There are four parts to the dialog box:

Audit

Auditable events

Remote Logging

Remote Alerts

In Full Security mode, only the Remote Logging and Remote Alert settings are available – all events will be always be recorded.

In Basic Security mode, both the events to be recorded and the Remote Logging and Remote Alerts settings can be configured.

What are security policies?

MassLynx Security enabled

Critical error protection

Use individual INI files

Forget last username

Tamper detection

Dual authorization

Timeout

LIMS policy

What are signatures and reasons?


Audit policy - Audit

Audit – Turning event logging on and off

Security Manager > Policies > Audit

Basic Security only: This section only applies to Basic Security systems.

To turn logging on for the selected event types, select Enabled in the Audit group box.

To turn logging off for the selected event types, select Disabled in the Audit group box.

To only log failed events, select Failures Only in the Audit group box.

Audit policy

Auditable events

Remote logging

Remote alerts


Auditable events

Auditable events – Selecting event types to log

Security Manager > Policies > Audit

Basic Security only: This section only applies to Basic Security systems.

To choose event types to log, select or clear the Auditable events check boxes.

Logon and Logoff

Users logging on to and off from MassLynx applications on each workstation in a secure MassLynx system.

Policy changes

Changes to Security Manager settings.

Object access

Permissions checks to verify that users have the relevant group rights to perform a particular operation. Includes dual authorizations.

Other events

Security events

  • Attempts to compromise MassLynx security.

  • LogLynx delete, import, and export & delete operations.

  • Changes made within QuanLynx.

Audit events

  • File signing operations.

  • Starting and completing data acquisitions.

  • Creating and altering metadata or results files.

Audit policy

Audit

Remote logging

Remote alerts


Remote logging

Remote Logging – Using a remote computer as a log server

Security Manager > Policies > Audit

To use a remote computer as a log server:

  1. Select the Remote Logging Enabled check box.

  2. Type the NetBIOS name, DNS name, or IP address of a reachable remote computer in the Store On box.

Requirements:

  • The remote computer must have MassLynx installed, with security, if it is to be used as a log server.

  • Some firewall configurations, such as the default settings for Windows XP Service Pack 2, may require alteration for remote logging to work successfully. For further information, see the Release Notes.

Audit policy

Audit

Auditable events

Remote alerts


Remote Alerts

Security Manager > Policies > Audit

Immediate alerts of serious security problems (file tampering, attempts to log on using a disabled account, and so on) can be sent to a remote computer or user.

To enable remote alerts:

  1. Select the Remote Alerts Enabled check box.

  2. In the Send To box, do one of the following:

  3. Type the name of a remote computer.

  4. Type the NetBIOS name, DNS name, or IP address of a remote computer.

  5. Type a user name.

Tip: Alerts will appear on the remote computer’s screen, so they should not be sent to a computer that normally runs without a logged-on user.

Requirement: For remote alerts to work, the Windows Alerter and Messenger services must be running on both the local and remote machines. For assistance on setting up Alerter and Messenger, refer to Microsoft Windows help.

Audit policy

Audit

Auditable events

Remote logging


Dual authorization

Security Manager > Policies > Dual Authorization

Full Security only: This section only applies to Full Security systems.

There are certain actions in MassLynx that have the potential to jeopardize the security of the system, but which need to be allowed in some circumstances.

To protect MassLynx security you can require both a MassLynx user and a MassLynx administrator to enter their passwords to authorize these actions. This is known as dual authorization.

To configure the dual authorization settings:

  1. Select Policies > Dual Authorization.

  2. Select or clear the check boxes for the actions for which dual authorization will be required.

  3. Click OK.

Requirement: When MassLynx prompts for dual authorization of an action, it must be the currently logged-in, non-administrator user and an administrator user who perform the authorization. Two administrator users cannot authorize an action.

What are security policies?

MassLynx Security enabled

Critical error protection

Use individual INI files

Forget last username

Tamper detection

Audit policy

Timeout

LIMS policy

What are signatures and reasons?


Timeout

Security Manager > Policies > Timeout

If a user is inactive for a certain period of time they will have to re-enter their password before they can continue using MassLynx. You can specify how long they can be inactive for without needing to re-authenticate themselves.

To set the timeout:

  1. Click Policies > Timeout.

  2. Type the length of inactivity after which the login dialog box should be displayed. The value should be between 0.5 and 60 minutes.

Tip: A user is deemed to be inactive if they are not performing any activity on the computer. The activity does not need to be in MassLynx applications.

  3. Click OK.

What are security policies?

MassLynx Security enabled

Critical error protection

Use individual INI files

Forget last username

Tamper detection

Audit policy

Dual authorization

LIMS policy

What are signatures and reasons?


LIMS policy

Security Manager > Policies > LIMS Policy

You can configure the settings used when exporting LIMS (Laboratory Information Management System) files from QuanLynx, TargetLynx or other MassLynx applications:

To configure LIMS export file settings, click Policies > LIMS Policy. In the LIMS Export File Settings dialog box you can set values for the properties described in the table below.

LIMS export file settings:

Use Fixed LIMS File Location | Only export LIMS files to the folder specified in the Location field. This can be useful for integration into third-party LIMS systems which monitor a specific folder.
Location | When Use Fixed LIMS File Location is selected, this is the location that LIMS files are exported to.
Naming Style
Naming Style - LIMS.txt | Exported LIMS files are always named LIMS.txt.
Naming Style - <SampleList>.txt | Exported LIMS files always use the name of the Sample List used to create the dataset.
Naming Style - *.txt | The user will be able to specify the name of the exported LIMS file (but not the folder or the file extension).

What are security policies?

MassLynx Security enabled

Critical error protection

Use individual INI files

Forget last username

Tamper detection

Audit policy

Dual authorization

Timeout

What are signatures and reasons?


Signatures - What are signatures and reasons?

What are signatures and reasons?

MassLynx provides an audit log to electronically record who performed actions – acquiring data, creating MS methods, altering quantitation curves, and so on – and when they were carried out.

In addition to this, however, you can specify certain actions that request or require the user to “sign” what they have done by supplying their authentication credentials, to enter a reason explaining why they have done it, or both.

Signatures and reasons are normally used in situations where it is important to be able to step through the entire process that led to a set of results. This may be part of an internal audit process, or it may be required by a regulatory authority which is reviewing your work.

While it might be essential to require signatures or reasons at some times, it may be unnecessarily time-consuming at others. MassLynx lets you choose the type of actions to apply the check to, and allows you to set whether signatures or reasons should be requested or required.

Basic Security and Full Security

With Basic Security, signatures and reasons can only be applied to internal modifications. Internal modifications are actions within QuanLynx and TargetLynx that do not result in a file (whether new or modified) being saved to disk.

With Full Security, signatures and reasons can be applied to a wide range of actions that save or change a file on disk, as well as to internal modifications.

Deciding whether signatures and reasons are required

Choosing the actions that require a signature or reason

Setting the available reasons

Entering signatures and reasons

Viewing file signatures and reasons

Adding signatures or reasons to existing files


Deciding whether signatures and reasons are required

Security Manager > Policies > Signatures and Reasons

There are two different types of actions which can have signature and reason policies applied:

  • Electronic Records – These actions result in files being saved to disk (or files on disk being modified). Signature and reason policies can only be specified for these actions on Full Security systems.

  • Intermediate Modifications – These actions are operations performed within QuanLynx or TargetLynx that do not result in a file being saved to disk.

The policies are set in the Signature and Reason Policy dialog box, accessed by clicking Policies > Signatures and Reasons.

For each of these types of action (Electronic Records and Intermediate Modifications), a policy can be set for signatures and a policy set for reasons using the drop-down lists.

Signature and reason policy options:

None | The user will not be asked to provide a signature or reason (as applicable).
Don’t Force | The user will be asked to provide a signature or reason, but they are free not to do so.
Warn | The user will be asked to provide a signature or reason, and they will be warned if they choose not to.
Force | The user must provide a signature or reason before being able to continue with the action.

Give careful consideration to the needs of your organization before deciding what the signature and reason policy should be. Consider the use that the system will be put to, what will be done with the results, and who might examine your processes.

Tip: In most situations it is not normally very useful to have signatures without reasons, as only the person who performed the action will be recorded, not why they did it.

Click Actions to select the actions that will result in your signatures and reasons policy being applied. For details, see Choosing the actions that require a signature or reason.

Click Reasons to set the reasons that will be available for the actions you have chosen. For details, see Setting the available reasons.

Signatures and reasons entered by users will be recorded in the audit logs. For file modifications this is the LogLynx log. For QuanLynx modifications it is the QuanLynx log; for TargetLynx modifications it is the TargetLynx log. For details, see What are the audit logs?

Forcing users to enter full signature information

When a signature is prompted for, MassLynx can automatically fill in the user name and domain of the currently logged-in user. While this is a useful feature for many, you may wish to require users to enter all their signature information each time they perform a signature.

To force all signature components to be used, clear the Default to use of current user name when signing check box.

What are signatures and reasons?

Choosing the actions that require a signature or reason

Setting the available reasons

Entering signatures and reasons

Viewing file signatures and reasons

Adding signatures or reasons to existing files

What are the audit logs?


Choosing the actions that require a signature or reason

Security Manager > Policies > Signatures and Reasons > Actions

Once you have decided that signatures or reasons are required, you need to select the actions that will need a signature or reason.

To select the actions requiring a signature or reason:

  1. Click Policies > Signatures and Reasons.

  2. If you want any Electronic Record actions to prompt for a signature or reason, click the Actions button in the Electronic Records Policy frame.

  3. In the Signatures/Reasons Actions dialog box, select or clear the check boxes for the actions for which signatures or reasons will be required.

  4. Click OK.

  5. If you want any Intermediate Modification actions to prompt for a signature or reason, click the Actions button in the Intermediate Modifications Policy frame, then repeat steps 3 and 4.

Tip: A signature indicates that the user approves that the item they are signing is correct. When deciding which actions need signatures, you should determine the stages of your process that require this type of confirmation.

What are signatures and reasons?

Deciding whether signatures and reasons are required

Setting the available reasons

Entering signatures and reasons

Viewing file signatures and reasons

Adding signatures or reasons to existing files


Setting the available reasons

Security Manager > Policies > Signatures and Reasons > Reasons

For each action that you have decided should have a reason associated with it, the list that user can choose from can be configured. You can also allow the user to type their own reason – this is known as freeform entry.

Tip: Additional reasons can be added at the point of signature/reason entry if the user is a member of a group with the right - Administrative – Allow reasons to be added at the point of sign. A dual authorization may be required, depending on your dual authorization policy settings.

To configure the reasons:

  1. Click Policies > Signatures and Reasons.

  2. To configure the list of reasons for Electronic Record actions, click the Reasons button on the Electronic Records Policy frame.

Result: The Reasons for Change window is displayed, with actions on the left side of the window and possible reasons on the right side.

  3. To add a new reason, click [image].

  4. In the Add Reason dialog box, enter the reason you wish to add, and a description.

  5. Click OK.

Result: The reason you have added is displayed in the right side of the window.

  6. Click an action in the left side of the window that you want the reason to be available for.

  7. Select the check box next to the reason.

  8. Repeat steps 3 to 7 for other reasons you want to add.

  9. Click OK.

To configure the list of reasons for Intermediate Modification actions, click the Reasons button on the Intermediate Modifications Policy frame, then repeat steps 3 to 9.

The Reasons for Change window provides a number of additional features to help you configure reasons.

Reasons for Change window features:

To do this

Do this

Allow freeform entry of reasons

  1. In the left side of the window, click the action you want to allow freeform reason entry for.

  2. Ensure that the Freeform check box is selected.

Edit a reason

  1. In the right side of the window, click the reason that you want to edit.

  2. Click the [image] button.

  3. Edit the reason, then click OK.

Delete a reason

  1. In the right side of the window, click the reason that you want to delete.

  2. Click the [image] button.

Apply reasons to more than one action at once

  1. Select all the actions you want the reason to be available for.

To select a number of adjacent actions, click the first action, hold the Shift key, then click the last action.

To select a number of non-adjacent actions, click the first action, hold the Ctrl key, then click each of the other actions.

  2. Select or clear the reason check boxes as required.

Change the order of reasons

  1. Click the reason you wish to move.

  2. Click the [image] or [image] buttons to move the reason higher or lower in the list. You can also move the reason to the top or bottom of the list.

Tip: You can highlight and move multiple reasons at the same time by holding down the Ctrl or Shift keys while clicking the reasons you want to move.

What are signatures and reasons?

Deciding whether signatures and reasons are required

Choosing the actions that require a signature or reason

Entering signatures and reasons

Viewing file signatures and reasons

Adding signatures or reasons to existing files

Dual authorization


Entering signatures and reasons

If actions have been specified as requiring signatures or reasons, MassLynx will prompt you to enter the appropriate information when you try to perform the action.

Enter the information in the Sign Record dialog box.

Sign Record dialog box:

The dialog box consists of several parts. The signature and reason sections will only appear if a signature or reason is required for this action.

The header, containing the padlock image, tells you what you need to do. What is required may change between systems, or between different parts of the same system.

The signature section contains boxes in which you need to enter your user name (it may already have been filled in for you), your password, and your domain. By signing a change you are confirming that you accept responsibility for it. If you do not want to do this, click Cancel.

The reason section contains a list from which you can choose a reason that explains why you are performing the action. Depending on how the system is configured, you may be able to type a reason of your own. You may also be able to enter new reasons to be added to the list if you have permissions to do so.

Adding signatures or reasons to existing files

Viewing file signatures and reasons

What are signatures and reasons?

Deciding whether signatures and reasons are required

Choosing the actions that require a signature or reason

Setting the available reasons


Viewing file signatures and reasons

Signatures and reasons associated with an open file can be viewed in the main MassLynx interface. The option to do so will only be available if your system has been configured to request or require signatures or reasons.

To view the signatures and reasons for a file:

  1. Open the window associated with the file.

Example: To view the signatures and reasons for a Sample List, open the main MassLynx window. To view the signatures and reasons for MS Method files, open the Experiment Setup (MS Method) window.

  2. Click File > Properties.

Result: A Properties dialog for the file is displayed, containing information on the signatures associated with the file (if the file is signed) and the reason (if present).

Entering signatures and reasons

Adding signatures or reasons to existing files

What are signatures and reasons?

Deciding whether signatures and reasons are required

Choosing the actions that require a signature or reason

Setting the available reasons


Adding signatures or reasons to existing files

If MassLynx has been configured to request (but not require) signatures or reasons for certain actions, you can add signatures or reasons to files at any time through the MassLynx interface.

Caution: By adding a signature or reason, you will replace any existing signature or reason associated with the file. For instance, if a reason is added to a file that already has a signature, the file will not then be signed unless a signature is provided at the same time as the reason. All the signatures and reasons will be recorded in the audit log.

To add signatures or reasons to a file:

  1. Open the window associated with the file.

Example: To add a signature or reason to a Sample List, open the main MassLynx window. To add a signature or reason to MS Method files, open the Experiment Setup (MS Method) window.

  2. Click File > Sign <type of file>

Rule: If a file has been modified, it must be saved before it can be signed.

  3. Add your signature or reason as required.

  4. Click OK.

To add signatures or reasons to a raw data file:

  1. In the main MassLynx window, click File > Open Data File.

  2. Browse to the directory containing the file you wish to sign.

  3. Click the file you wish to sign.

  4. Click Sign.

  5. Add your signature or reason as required.

  6. Click OK.

Entering signatures and reasons

Viewing file signatures and reasons

What are signatures and reasons?

Deciding whether signatures and reasons are required

Choosing the actions that require a signature or reason

Setting the available reasons


Saving security settings

Security Manager > File > Save

Once your security settings have been configured in Security Manager, they must be saved. Your settings will not take effect until they have been saved.

To save your settings:

Click File > Save.

Alternative: Click

Printing security settings

Exporting and importing security settings

Introduction to security


Printing security settings

Security Manager > File > Print

You can print the Security Manager settings as a record of the site policy implemented on a MassLynx machine, either to allow other machines to be set up appropriately or to provide a record for inspection by an auditor.

To print your settings:

  1. Click File > Print.

Alternative: Click

  1. In the Print dialog box, click OK.

Tips:

  • Security settings can only be printed once they have been saved. If the settings have recently been changed, save them before you try to print.

  • As security settings are also recorded in the audit log whenever an alteration is made, it is possible to print them by viewing the event in LogLynx. For information on using LogLynx, see Viewing the LogLynx log.

Exporting and importing security settings

Saving security settings

What are the audit logs?


Exporting and importing security settings

Security Manager > File > Export
Security Manager > File > Import

So that you do not have to configure all the security settings on every system, MassLynx enables you to export your security settings – and import security settings from elsewhere – by using Security Rollout files.

Tip: If you want to replicate the security settings from another MassLynx system, select a Security Rollout file during installation to import the settings automatically.

To export the current Security Manager settings:

  1. Click File > Export.

  2. In the Save As dialog box, choose a directory to save the rollout file into, and enter a name.

  3. Click Save.

Result: A Security Rollout file, with the name you specified and the extension .srf, will be created.

To import a Security Rollout file:

  1. Select File > Import.

  2. In the Open dialog box, browse to the Security Rollout file (*.srf) that you want to import.

  3. Click Open.

Result: The Security Manager settings are imported. They will only be applied when the security settings are saved.

Caution: When security settings are imported, the current MassLynx users will be replaced by the users defined in the Security Rollout file.

Before importing a Security Rollout File, you should check that both the user and administrator accounts defined in the file, and any log server specified, are on accessible domains. If you are not sure how to do this, contact your system administrator.

Printing security settings

Saving security settings

Introduction to security


Viewing logs - What are the audit logs?

What are the audit logs?

Audit logs are created by MassLynx to record system operations. Items recorded in the logs include users logging on, failed login attempts, access to various parts of the interface, and files being saved, among many others.

If you are using Basic Security, the contents of the audit log will depend on your Audit policy. If you are using Full Security, all information will always be logged.

Most operations are recorded in the main audit log, accessed through a dedicated viewer called LogLynx. Intermediate Modifications – operations which do not result in a file being saved to disk – performed in QuanLynx or TargetLynx are stored in their own audit logs, accessed through the QuanLynx and TargetLynx viewers.

LogLynx – which is only accessible to users with appropriate rights – enables you to view the log, filter the log (so that only the items you are interested in are displayed), print the log, and export it to file.

Introduction to security

Starting LogLynx

Viewing the LogLynx log

Filtering the LogLynx log

Backing up, exporting, and clearing the LogLynx log

Printing the LogLynx log


Starting LogLynx

To start LogLynx:

  1. Click Start > All Programs > MassLynx > LogLynx.

Result: If you are not already logged in to MassLynx, the MassLynx Login dialog appears.

  1. Type your Windows user name in the Logon Name field.

  2. Type your Windows password in the Password field.

  3. From the Domain list, select the domain for which your Windows user name is valid.

  4. Click OK.

Tip: You will need to be a member of a group with rights to access LogLynx in order to log in.

  2. If a warning message appears, read the message. If you do not understand the message or are not happy to continue, close the LogLynx window as soon as it appears and consult your system administrator. Click OK.

What are the audit logs?

The LogLynx window

Viewing the LogLynx log

Starting Security Manager


The LogLynx window

When you have successfully logged in, the LogLynx window will be displayed.

The tree pane shows the filters that are being, or can be, applied to the log. More information on this can be found in Filtering the LogLynx log.

The events pane contains a list of events with a row of details for each event.

What are the audit logs?

Starting LogLynx

Viewing the LogLynx log

Filtering the LogLynx log

Backing up, exporting, and clearing the LogLynx log

Printing the LogLynx log


Viewing the LogLynx log

The audit log is displayed when LogLynx is opened. The events are listed in date and time order, with the most recent at the top.

When you first open LogLynx, all the events are shown. If you have created filters , click All Events in the tree pane to revert to seeing all the events.

To view details of a specific event:

  1. Double-click the event in the events pane.

Result: The Event Details are displayed.

  2. When you have finished with the details, click File > Exit.

Tip: If you need a hard copy, you can print the details from the Event Details dialog box by clicking File > Print.

To modify the columns displayed:

  1. Click View > Choose Columns.

  2. Select the check boxes beside the columns you want to display.

  3. Clear the check boxes beside the columns you want to hide.

  4. Click OK.

To modify the column order:

Drag the column to the desired location.

To reset the column display to the defaults:

  1. Click View > Choose Columns.

  2. Select the Select Default Columns check box.

  3. Click OK.

To change column widths:

Drag the edges of a column headings until the column is the desired width.

To reset the column widths to the defaults:

  1. Click View > Choose Columns.

  2. Select Reset Column Widths.

  3. Click OK.

What are the audit logs?

Starting LogLynx

Filtering the LogLynx log

Backing up, exporting, and clearing the LogLynx log

Printing the LogLynx log


Importing audit logs

If audit log information has previously been exported from LogLynx you can view the information in LogLynx by importing the file.

To import an audit log:

  1. Click File > Import.

  2. Browse for the file you want to import.

  3. Click Open.

  4. In the File Import dialog box, click OK.

Result: The selected audit log will be imported and integrated into the audit log information displayed.

What are the audit logs?

Starting LogLynx

Filtering the LogLynx log

Backing up, exporting, and clearing the LogLynx log

Printing the LogLynx log

Viewing the LogLynx log


Filtering the LogLynx log

There may be many thousands, perhaps millions, of events in an audit log. You can reduce the number of events displayed, making it easier to find the information you need, by creating a filter – also known as an event query.

Event queries are based on one or more of the following:

  • Date/time range

  • User or machine that caused the event

  • Event type

Tip: Queries are not saved if LogLynx is closed down and re-opened. If you want to keep the results of a query, you can print them from LogLynx.

To delete an event query:

  1. Click the event query in the tree pane.

  2. Right-click, then click Close List.

Creating a date/time range query

Creating an event origin query

Creating event type queries

Viewing the LogLynx log

Printing the LogLynx log


Creating a date/time range query

LogLynx > Query > Date/Time Range

You can filter the audit log so that only events written during specified periods are displayed. To do this, create a date/time range query.

To create a date/time range query:

  1. In the tree pane, click the list you want to filter by date and time.

Tip: If this is the first query you have created, click All Events.

  2. Click Query > Date/Time Range.

Result: The Date/Time Event Query dialog box is displayed.

  3. Select the settings to apply to your query. Information on the individual parameters available is given below.

  4. Click OK.

Result: The query will be added to the tree pane. Click the query to see the filtered results.

The Date/Time Event Query dialog box has two tabs:

  • Query Type – Defines the query.

  • Parameters – Specifies the dates and/or times that the query applies to.

Date/time range query - Query Type

Date/time range query - Parameters

Creating an event origin query

Creating event type queries

Viewing the LogLynx log

Printing the LogLynx log


Date/time range query - Query Type

LogLynx > Query > Date/Time Range > Query Type tab

Query Type tab:

Method

Fast Query (no event search required)

Performs a fast search; only Event indexing information is referenced, giving virtually instantaneous results.

Tip: Where possible, perform a Fast query first on large databases before performing subsequent queries on the restricted dataset; this should speed up the search.

Full Query (event search required)

Performs a full search; every Event between the specified times is read and passed through the filter. This may take several minutes for large databases.

Day Filter

Enables the Weekday options in the Parameters tab, and some additional options on the Query Type tab. This option is only available when the Full Query option is selected.

Query Options

Before given time and date

Specifies that the query will filter by events before the time and date set on the Parameters tab.

Between given Times/dates

Specifies that the query will filter by events between the times and dates set on the Parameters tab.

After given time/date

Specifies that the query will filter by events after the time and date set on the Parameters tab.

Before given time

Specifies that the query will filter by events before a given time of day, set on the Parameters tab.

Between given times

Specifies that the query will filter by events between the times of day set on the Parameters tab.

After given time

Specifies that the query will filter by events after a given time of day, set on the Parameters tab.

This week

Confines the search to the current week.

Last week

Confines the search to the previous week.

This month

Confines the search to the current month.

Last month

Confines the search to the previous month.

Day Filter Only

Confines the search to the days of the week selected on the Parameters tab.

Today

Confines the search to the current day.

Last…days

Confines the search to the specified number of most recent days.

Creating a date/time range query

Date/time range query - Parameters


Date/time range query - Parameters

LogLynx > Query > Date/Time Range > Parameters tab

The options available on the Parameters tab will vary, depending on the options selected on the Query Type tab.

Parameters tab:

From….To | The query will filter by events between the times and dates specified.
Weekday | The search will be confined to the days of the week selected.

Creating a date/time range query

Date/time range query - Query Type


Creating an event origin query

LogLynx > Query > Origin

You can filter the audit log so that only events that originated with specified users or machines are displayed. To do this, create an event origin query.

To create an event origin query:

  1. In the tree pane, click the list you want to filter by event origin.

Tip: If this is the first query you have created, click All Events.

  2. Click Query > Origin.

Result: The Query: Event Origin dialog box is displayed.

  3. Select the settings to apply to your query. For details on the individual parameters available, see the Event Origin dialog box.

  4. Click OK.

Result: The query will be added to the tree pane. Click the query to see the filtered results.

Event Origin dialog box

Creating a date/time range query

Creating event type queries

Viewing the LogLynx log

Printing the LogLynx log


Event Origin dialog box

Query : Event Origin dialog box

LogLynx > Query > Origin

Query : Event Origin dialog box:

User Filter
All Users | Searches for events generated by any user.
Only this user | Searches for events generated by the user specified in the User box.
All users except | Searches for events generated by any user except the user specified in the User box.
Accept partial match | User names that contain the text specified in the User box will be included in the results of the query. If this option is not selected, only user names that are exactly the same as the specified text will be included. Tip: This option can be used to search for a number of users with similar user names.
Machine Filter
All machines | Searches for events generated by any machine.
Only this machine | Searches for events generated by the machine specified in the Machine box.
All Machines except | Searches for events generated by any machine except the machine specified in the Machine box.
Accept partial match | Machine names that contain the text specified in the Machine box will be included in the results of the query. If this option is not selected, only machine names that are exactly the same as the specified text will be included. Tip: This option can be used to search for a number of machines with similar names.

Creating an event origin query


Creating event type queries

LogLynx > Query > Event Type

You can filter the audit log so that only events of a specified type are displayed. You do this by creating event type queries. A number of different event type queries are available:

  • Permission check – whether actions were allowed or denied.

  • Log In/Out – successful or unsuccessful logins or logouts.

  • Security – modifications to MassLynx security settings.

  • Audit path – events relating to a specified path on disk and/or limited to certain types of event.

  • Information event – events giving information that does not fall into other categories.

  • Verification event – actions that required dual authorization, either successful or unsuccessful.

Creating a date/time range query

Creating an event origin query

Viewing the LogLynx log

Printing the LogLynx log


Permission check event

LogLynx > Query > Event Type > Permission Check

A Permission Check event query enables you to filter the audit log to show only actions that were allowed or denied.

To create a permission check event query:

  1. In the tree pane, click the list you want to filter.

Tip: If this is the first query you have created, click All Events.

  2. Click Query > Event Type > Permission Check.

Result: The Query: Permission Check Event dialog box is displayed.

  3. Select the settings to apply to your query. Information on the individual parameters available is given below.

  4. Click OK.

Result: The query will be added to the tree pane. Click the query to see the filtered results.

Query: Permission Check Event dialog options::

Outcome
Show ALLOWED operations | Searches for Allowed operations (shown as Allowed in the audit log Outcome column).
Show DENIED operations | Searches for Denied operations (shown as Denied in the audit log Outcome column).
User Filter
Only this user | Searches for events generated by the user specified in the adjacent text box.
Allow partial match | User names that contain the text specified in the adjacent box will be included in the results of the query. If this option is not selected, only user names that are exactly the same as the specified text will be included. Tip: This option can be used to search for a number of users with similar user names.
Machine Filter
Only this machine | Searches for events generated by the machine specified in the adjacent text box.
Allow partial match | Machine names that contain the text specified in the adjacent box will be included in the results of the query. If this option is not selected, only machine names that are exactly the same as the specified text will be included. Tip: This option can be used to search for a number of machines with similar names.

Creating event type queries

Log In/Out event

Security event

Audit path event

Information event

Verification event


Log In/Out event

LogLynx > Query > Event Type > Log In/Out

A Log In/Out event query enables you to filter the audit log to show only login and logout events.

To create an log in/out event query:

  1. In the tree pane, click the list you want to filter.

Tip: If this is the first query you have created, click All Events.

  2. Click Query > Event Type > Log In/Out.

Result: The Query: Log In/Out Event dialog box is displayed.

  3. Select the settings to apply to your query. Information on the individual parameters available is given below.

  4. Click OK.

Result: The query will be added to the tree pane. Click the query to see the filtered results.

Query: Log In/Out Event dialog box options:

Outcome
Log in ALLOWED | Searches for allowed logins.
Log in DENIED | Searches for login attempts that were denied.
Log Out | Searches for logouts.
User Filter
Only this user | Searches for logins and logouts by the user specified in the adjacent text box.
Allow partial match | User names that contain the text specified in the adjacent box will be included in the results of the query. If this option is not selected, only user names that are exactly the same as the specified text will be included. Tip: This option can be used to search for a number of users with similar user names.
Machine Filter
Only this machine | Searches for logins and logouts originating on the machine specified in the adjacent text box.
Allow partial match | Machine names that contain the text specified in the adjacent box will be included in the results of the query. If this option is not selected, only machine names that are exactly the same as the specified text will be included. Tip: This option can be used to search for a number of machines with similar names.

Creating event type queries

Permission check event

Security event

Audit path event

Information event

Verification event


Security event

LogLynx > Query > Event Type > Security

A Security event query enables you to filter the audit log to show only security-related events.

To create a security event query:

  1. In the tree pane, click the list you want to filter.

Tip: If this is the first query you have created, click All Events.

  2. Click Query > Event Type > Security.

Result: The Query: Security Event dialog box is displayed.

  3. Select the settings to apply to your query. Information on the individual parameters available is given below.

  4. Click OK.

Result: The query will be added to the tree pane. Click the query to see the filtered results.

Query: Security Event dialog box options:

Severity
Show LOW severity actions (green) | Searches for low severity security events – events that indicate changes occurring during normal operation, such a setting adjustment in Security Manager.
Show HIGH severity actions (red) | Searches for high severity security events – events that indicate critical items such as tamper detection or the deletion of event log data.
User Filter
Only this user: | Searches for security events generated by the user specified in the adjacent text box.
Allow partial match | User names that contain the text specified in the adjacent box will be included in the results of the query. If this option is not selected, only user names that are exactly the same as the specified text will be included. Tip: This option can be used to search for a number of users with similar user names.
Machine Filter
Only this machine: | Searches for security events originating on the machine specified in the adjacent text box.
Allow partial match | Machine names that contain the text specified in the adjacent box will be included in the results of the query. If this option is not selected, only machine names that are exactly the same as the specified text will be included. Tip: This option can be used to search for a number of machines with similar names.

Creating event type queries

Permission check event

Log In/Out event

Audit path event

Information event

Verification event


Audit path event

LogLynx > Query > Event Type > Audit

An audit path query enables you to filter the audit log to show only events relating to a specified path on disk and/or limited to certain types of event.

To create an audit path query:

  1. In the tree pane, click the list you want to filter.

Tip: If this is the first query you have created, click All Events.

  2. Click Query > Event Type > Audit.

Result: The Query: Audit Path dialog box is displayed.

  3. Select the settings to apply to your query. Information on the individual parameters available is given below.

  4. Click OK.

Result: The query will be added to the tree pane. Click the query to see the filtered results.

Query: Audit Path dialog box options:

Partial Path

Filter Path

Searches for events that relate to a file on this path. This is a partial match search, so any event relating to a file whose path contains the text entered in this box will be included in the results.

Example: If the Filter Path was set to “default”, events relating “c:\myfiles\defaults\projects...” and “c:\masslynx\quantify.pro\default.exp” would both be returned.

Except

Only events that relate to files whose path does not contain the Filter Path will be included.

User

Filter User

Searches for events generated by the user specified in the adjacent text box.

Partial Match

User names that contain the text specified in the adjacent box will be included in the results of the query. If this option is not selected, only user names that are exactly the same as the specified text will be included.

Tip: This option can be used to search for a number of users with similar user names, or (in combination with the Except option) to exclude users with similar user names.

Except

Events for all users except the user specified in the adjacent box will be included.

Machine

Filter Machine

Searches for events generated by the machine specified in the adjacent text box.

Partial Match

Machine names that contain the text specified in the adjacent box will be included in the results of the query. If this option is not selected, only machine names that are exactly the same as the specified text will be included.

Tip: This option can be used to search for a number of machines with similar names, or (in combination with the Except option) to exclude machines with similar names.

Except

Events for all machines except the machine specified in the adjacent box will be included.

Date and Time

Filter before

The query will only include events that occurred before the time and date specified.

Filter after

The query will only include events that occurred after the time and date specified.

Ignore filter

Disables the date and time filter.

Auditable Operation Type

Filter

Only events of the types selected in the adjacent list will be included in the results.

Event types indicated as legacy can only be created by MassLynx versions prior to 4.1.

Creating event type queries

Permission check event

Log In/Out event

Security event

Information event

Verification event


Information event

LogLynx > Query > Event Type > Information

An Information event query enables you to filter the audit log to show only entries that give information not falling into other categories.

To create an information event query:

  1. In the tree pane, click the list you want to filter.

Tip: If this is the first query you have created, click All Events.

  2. Click Query > Event Type > Information.

Result: The Query: Information Event dialog box is displayed.

  3. Select the settings to apply to your query. Information on the individual parameters available is given below.

Tip: To create an information event query that contains the events for all users and machines, do not select any settings.

  4. Click OK.

Result: The query will be added to the tree pane. Click the query to see the filtered results.

Query: Information Event dialog box options:

User filter
Only this user: | Searches for information events generated by the user specified in the adjacent text box.
Allow partial match | User names that contain the text specified in the adjacent box will be included in the results of the query. If this option is not selected, only user names that are exactly the same as the specified text will be included. Tip: This option can be used to search for a number of users with similar user names.
Machine filter
Only this machine: | Searches for information events originating on the machine specified in the adjacent text box.
Allow partial match | Machine names that contain the text specified in the adjacent box will be included in the results of the query. If this option is not selected, only machine names that are exactly the same as the specified text will be included. Tip: This option can be used to search for a number of machines with similar names.

Creating event type queries

Permission check event

Log In/Out event

Security event

Audit path event

Verification event


Verification event

LogLynx > Query > Event Type > Verification

A Verification event query enables you to filter the audit log to show only events that required dual authorization, whether they were successful or unsuccessful.

To create a verification event query:

  1. In the tree pane, click the list you want to filter.

Tip: If this is the first query you have created, click All Events.

  2. Click Query > Event Type > Verification.

Result: The Query: Verification Event dialog box is displayed.

  3. Select the settings to apply to your query. Information on the individual parameters available is given below.

Tip: To create a verification event query that contains the events for all users and machines, do not select any settings.

  4. Click OK.

Result: The query will be added to the tree pane. Click the query to see the filtered results.

Query: Verification Event dialog box:

User Filter
Only this user: | Searches for verification events generated by the user specified in the adjacent text box.
Allow partial match | User names that contain the text specified in the adjacent box will be included in the results of the query. If this option is not selected, only user names that are exactly the same as the specified text will be included. Tip: This option can be used to search for a number of users with similar user names.
Verifier Filter
Only this verifier: | Searches for verification events where the second user involved (the verifier) had the user name specified in the adjacent text box.
Allow partial match | User names that contain the text specified in the adjacent box will be included in the results of the query. If this option is not selected, only user names that are exactly the same as the specified text will be included.
Machine Filter
Only this machine: | Searches for information events originating on the machine specified in the adjacent text box.
Allow partial match | Machine names that contain the text specified in the adjacent box will be included in the results of the query. If this option is not selected, only machine names that are exactly the same as the specified text will be included. Tip: This option can be used to search for a number of machines with similar names.

Creating event type queries

Permission check event

Log In/Out event

Security event

Audit path event

Information event


Backing up the LogLynx log

Recommendation: You are strongly advised to make regular backups of the complete audit log in case of disaster.

The audit log can be difficult to back up using normal archiving utilities due to its large size – it may contain gigabytes of data – and the fact that it is a “live” file.

MassLynx is supplied with a utility called sectiontool which you can use to divide the audit log into manageable sections.

Restriction: Sectiontool can only be run on the machine on which the log is actually stored. If the log is stored on a remote machine, sectiontool must be run on that machine.

To divide the audit log into sections:

  1. Open a command prompt.

  2. Type sectiontool -d [UNC path to the directory to write the sections to]

Example: If the machine is called logserverPC, you could type

sectiontool -d \\logserverPC\c$\log\section\

Result: The sections would be written to the c:\log\section\ directory.

The sections will be written with numbered filenames, beginning at 00001. If you type text after the final slash of UNC path, that text will be used as a base for the filenames.

Example: If the machine is called logserverPC, you could type

sectiontool -d \\logserverPC\c$\log\section\log

Result: Output files, named log00001, log00002, and so on, would be written to the c:\log\section\ directory.

The sectiontool utility has a number of additional features. For information on the options available and the syntax to use, open a command prompt and type:

sectiontool -h

To join the event log sections:

As sectiontool divides the audit log into binary chunks, all that is required is that the binary chunks are combined together in the correct order.

Requirement: Ensure that binary mode is used when the chunks are combined.

The “copy” utility provided with Windows, and accessible from the command prompt, is one method that might be used to join the sections.

For information on how to use the copy command, open a command prompt and type:

copy /?

Tip: If you have a large number of sections, it may be easier to combine them if they share a common base to their filename.

Exporting log file entries

Clearing the LogLynx log

Audit policy


Exporting log file entries

LogLynx > File > Export

You can archive log file entries by exporting them to a file. The entries can be merged in to the log file again at a later date (see Importing audit logs).

A permanent entry in the audit log (which cannot be removed by subsequently exporting or clearing the audit log) will be generated by an export or import event. Therefore, it will always be clear that an export/import has taken place, even if the same events are merged back into the log at a later date.

To archive events from the event log:

  1. Click File > Export.

  2. Enter the time and date range of the events you want to archive.

  3. Select one of:

  4. Export Only, to archive the events and leave them in the audit log.

  5. Export and Remove, to archive the events and remove them from the audit log after archiving.

Caution: Before removing events from the audit log, you should ensure that you have appropriate policies to store and protect the event archive files produced. Failure to do this may result in the permanent loss of audit log information.

  4. Click Export.

  5. Read the Event Export message, then click Yes if you want to continue.

  6. Click OK.

Result: The Save As dialog box is displayed.

  7. Enter a name for the file to export the entries to.

  8. Click Save.

Backing up the LogLynx log

Clearing the LogLynx log

Importing audit logs


Clearing the LogLynx log

LogLynx > File > Delete All

Caution: You should only clear entries from the LogLynx log if you are confident that they have been successfully archived, or if you are certain that the information will not be required in the future.

You can clear all the events from the audit log, except for audit events that indicate actions on the audit log itself.

A permanent entry in the audit log (which cannot be removed by subsequently exporting or clearing the audit log) will be generated by a clearing event.

To clear the log:

  1. Click File > Delete All.

  2. Read the warning message, then click Yes if you want to continue.

  3. Click OK.

Backing up the LogLynx log

Exporting log file entries


Printing the LogLynx log

LogLynx > File > Print

You can print out audit log information if you need a hard copy.

You can print:

  • All of the audit log

  • Audit log entries resulting from a query

  • Details of a single event

Tip: You may wish to examine the Print Setup options to make sure that your print-outs are as good as possible. To do this, click File > Print Setup. Selecting Landscape rather than Portrait orientation can often help improve clarity.

To print all of the audit log:

  1. In the tree pane on the left of the screen, click All Events.

  2. Click File > Print.

  3. Check the settings in the Print dialog box.

  4. Click OK.

Tip: The audit log may contain many thousand, or even million, events. Only print out the whole audit log if you are sure that it is what you need – often it will be more useful to create a query to filter your results first.

To print audit log entries resulting from a query:

  1. In the tree pane on the left of the screen, click the appropriate query.

  2. Click File > Print.

  3. Check the settings in the Print dialog box.

  4. Click OK.

To print the details of a single event:

  1. In the events pane on the right of the screen, double-click the appropriate event.

  2. In the Event Details window, click File > Print.

  3. Check the settings in the Print dialog box.

  4. Click OK.

Viewing the LogLynx log

Filtering the LogLynx log


Using MassLynx in regulated environments - Recommendations

Recommendations for using MassLynx in regulated environments

Evaluate and test review and disaster recovery procedures

You should evaluate and test your review and disaster recovery procedures at an early stage, and at regular intervals afterwards. Failure to do so could result in irrevocable loss of data or audit information.

Use a forensic PC for auditing

When archived data and log information is being audited, it is advisable to use a forensic PC – a dedicated machine that is separate from the PC used to operate the instrument or process data.

Using a forensic PC avoids events that are caused by the audit process and are unrelated to your work (such as the importing and exporting of log entries, for example) being generated in your live audit log.

If the data and log information being audited is still actively being used in your MassLynx system, it will not be possible to use a forensic PC.

Common regulatory requirements

Introduction to security

Regulated environments


Common regulatory requirements

MassLynx Security has been designed with regulatory requirements in mind, and provides many features that help you operate successfully in regulated environments.

Each one of the following items refers to a common regulatory requirement and provides information on the MassLynx features available to help you fulfill it.

Caution: MassLynx cannot satisfy regulatory requirements by itself: it is only a component of the processes and procedures you need to have in place. You must consider carefully what the regulations require of you, and configure and operate MassLynx in a manner compatible with your understanding

Common regulatory requirements:

Discern invalid or altered records | Details
View, copy, and print electronic records | Details
Protect and back up records | Details
Limit system access to authorized individuals | Details
Generate time-stamped audit trails | Details
Allow only specified individuals to perform actions | Details
Assure the validity of source data | Details
Hold individuals accountable for actions performed under their electronic signature | Details
Include the name, date, time, and meaning with electronic signatures | Details
Ensure that electronic signatures are associated with the correct record | Details
Ensure electronic signatures are unique to one individual | Details
Confirm that at least two distinct identification components exist for an electronic signature | Details
Force all signature components to be used whenever a signature is performed | Details
Maintain the uniqueness of the identification, and ensure periodic revision of passwords | Details
Notify management of any attempted unauthorized use of the system | Details

Introduction to security

Regulated environments

Recommendations


Discern invalid or altered records

MassLynx is designed to ensure that the data produced is accurate and reliable, and is tested thoroughly to confirm that this is the case.

If you install MassLynx with Full Security, checksums are applied to:

  • All the data files acquired.

  • All the metadata files (that is, files that control how data is acquired, such as inlet or MS methods).

  • Data processed using QuanLynx or TargetLynx.

If records are altered or renamed, the checksums ensure that MassLynx detects the unauthorized changes. Users will not be permitted to open the invalid or altered records, appropriate warnings will be displayed, and information will be written to the audit log.

Only authorized alterations that take place within MassLynx result in valid records.

Introduction to security

MassLynx checksums

What are the audit logs?

Common regulatory requirements

Recommendations


View, copy, and print electronic records

You can:

  • View, copy, and print MassLynx files

  • View, copy, and print audit log entries


Protect and back up records

It is important that your data, metadata, and audit log information are regularly backed up. You will need to consider your needs carefully, and implement appropriate procedures.

Recommendation: You should evaluate and test your disaster recovery procedures at an early stage, and at regular intervals afterwards. Failure to do so could result in irrevocable loss of data.

Using BackLynx

MassLynx is supplied with BackLynx – a utility that provides one possible method you may wish to use to backup MassLynx files. BackLynx is specially designed for copying MassLynx files, but you should evaluate whether it fits your needs before deciding to use it.

Copying files using another method

When Full Security is being used, MassLynx checksums ensure that files that have been tampered with cannot be opened, and that they can only be changed within MassLynx. The way in which checksums work, however, means that files can be copied to other locations as long as you make sure that:

  • The associated checksum file is also copied.

  • Neither the filename nor contents are changed.

Backing up the audit log

When you are deciding how to back up the audit log, bear in mind both that the file may be extremely large and that it is live (that is, it is held open by MassLynx).

A utility called sectiontool is provided with MassLynx to help break the audit log into smaller pieces without affecting the integrity of the event entries contained in the file. This utility, or a similar alternative, is ideal for regular backups for disaster recovery purposes.

Groups of audit log entries, or the entire log, can be archived to separate files from within the LogLynx interface. These exported audit log entries can then be imported into LogLynx on other PCs for viewing.

MassLynx checksums

Backing up the LogLynx log

BackLynx

Common regulatory requirements

Recommendations


Limit system access to authorized individuals

Only users who have valid Operating System accounts and have been designated as MassLynx users by the system administrator are permitted to login to MassLynx.

When a user attempts to login, MassLynx authenticates the details supplied with the Operating System, thereby ensuring that the user has a currently valid user account on the domain indicated and that their password is correct.

Valid Operating System users who have not had a MassLynx user account created for them in Security Manager will not be able to access the system, regardless of their Operating System privileges.

Understanding MassLynx users

Common regulatory requirements

Recommendations


Generate time-stamped audit trails

When MassLynx is installed with Full Security, all events – including logins, logouts, data acquisition, saving and signing files, and accessing parts of the interface – are recorded in the audit log.

The details of each action are recorded, along with the date, the time, the user who performed the action, and the machine the action was performed on. This information can be viewed, printed, and exported using the LogLynx log viewer.

Information on internal modifications in QuanLynx and TargetLynx (which do not result in a file being saved to disk) is recorded in the QuanLynx and TargetLynx audit logs.

In addition to being able to see what was done and when, you can prevent old files from being overwritten by setting appropriate rights for user groups (allowing them to create new files but not to amend existing ones). This ensures that the previous versions of files – tuning parameters, for example – are always available for inspection, and comparison with newer versions.

What are the audit logs?

Assigning rights to groups

Common regulatory requirements

Recommendations


Allow only specified individuals to perform actions

Only users who have valid Operating System accounts and have been designated as MassLynx users by the system administrator are permitted to login to MassLynx.

Once a user has logged in, the parts of MassLynx that they have access to and the actions they can perform can be closely controlled. This is done through assigning rights to the groups that they are a member of.

Understanding MassLynx groups

Understanding MassLynx users

Assigning rights to groups

MassLynx checksums

Common regulatory requirements

Recommendations


Assure the validity of source data

Data is acquired into MassLynx directly from the instruments to which it is connected, and over which it has control.

MassLynx communicates with the instruments using a proprietary, binary format – over a dedicated link – helping to provide a high level of confidence in the validity of source data.

Common regulatory requirements

Recommendations


Hold individuals accountable

Hold individuals accountable for actions performed under their electronic signature

It is the responsibility of your organization to implement appropriate policies to ensure that individuals are accountable for the actions they perform, and procedures to make sure that the policies are adhered to.

MassLynx can assist you by presenting a warning message when a user logs on, reminding them of their responsibilities. The user must OK this message before they can proceed to any part of the MassLynx, LogLynx, or Security Manager interface.

The message can be configured to contain any text you wish, and can be varied from group to group depending on your requirements.

Recommendation: Displaying a warning message is highly unlikely, in isolation, to be deemed sufficient to meet regulatory requirements; you should consider carefully the policies and procedures required.

Creating or modifying a group

Common regulatory requirements

Recommendations


Include the name, date, time, and meaning

Include the name, date, time, and meaning with electronic signatures

It is possible to configure a policy so that an electronic signature associated can be prompted for, or required, for a range of different actions that the user might perform.

Where an electronic signature or reason (explaining why the change has been made) is entered by the user, the following details are recorded:

  • Full name of the user

  • Domain and user name of the user

  • Date of signature or reason

  • Time of signature or reason

  • Action performed (the meaning)

  • Reason for the change (if appropriate)

If the action has resulted in a file being saved to disk, these details are stored with the file. The same information (with the exception of the full name) is also recorded in the audit log.

If a user has appropriate permissions, a file can be re-signed and a new reason specified. The original information will always be retained in the audit log.

What are signatures and reasons?

Viewing file signatures and reasons

What are the audit logs?

Common regulatory requirements

Recommendations


Ensure that electronic signatures are associated

Ensure that electronic signatures are associated with the correct record

If configured, MassLynx automatically prompts for an electronic signature at the time that an action is performed on a record, thereby forcing a signature for the creation or modification of each record.

The signature is stored with the relevant record, and cannot be transferred to any other record. Any modification of the record will result in the signature being removed.

The signature is also recorded in the audit log. Subsequent signatures on the same file do not obscure previous signatures in the log, providing a clear audit trail that identifies the files that have been signed along with the identity of the signatory and the time and date of the signature.

Deciding whether signatures and reasons are required

Entering signatures and reasons

What are the audit logs?

Common regulatory requirements

Recommendations


Ensure electronic signatures are unique

Ensure electronic signatures are unique to one individual

When electronic signatures are configured for an action, MassLynx prompts the user for a signature when they perform the action. In order to sign the action the user must, as a minimum, provide their password in order to confirm their identity.

MassLynx can also be configured to require the user to enter their user name, the domain on which their user name is valid, and their password every time they are prompted for a signature.

Whichever method is used, if you are to be certain that each signature is unique to a single individual, your organization will need appropriate policies to ensure that only one individual can use each Operating System account which has access to MassLynx.

Deciding whether signatures and reasons are required

Entering signatures and reasons

Common regulatory requirements

Recommendations


Confirm at least two distinct identification components

Confirm that at least two distinct identification components exist for an electronic signature

When an electronic signature is made in MassLynx, three identification components are required:

  • User name

  • Domain on which the user name is valid

  • Password

This information is authenticated with the Operating System every time that a signature is attempted.

Depending on your MassLynx configuration, some of this information may be automatically filled in for the user. If you not want this to happen, MassLynx must be configured to force all the signature components to be entered on every occasion.

Deciding whether signatures and reasons are required

Entering signatures and reasons

Force all signature components to be used

Common regulatory requirements

Recommendations


Force all signature components to be used

Force all signature components to be used whenever a signature is performed

MassLynx can be configured so that the user name and domain last used for a signature are automatically completed when a user attempts a signature, requiring them only to enter their password.

Alternatively, all the signature components (user name, domain, and password) can be cleared every time the user is prompted for a signature, forcing them to enter all the information on every occasion.

Requirement: You will need to set up appropriate Signature and Reason policies before any users will be prompted to perform signatures.

Deciding whether signatures and reasons are required

Entering signatures and reasons

Common regulatory requirements

Recommendations


Maintain the uniqueness of the identification

Maintain the uniqueness of the identification, and ensure periodic revision of passwords

Your organization will need to put appropriate policies in place to ensure that user names and passwords remain unique to one individual, and to ensure that revisions are made as required.

MassLynx simplifies the process for you, however, by authenticating using Operating System user names and passwords. By doing this, MassLynx authentication automatically benefits from policies put in place to ensure the uniqueness of Operating System user accounts and the periodic revision of Operating System passwords.

Understanding MassLynx users

Common regulatory requirements

Recommendations


Notify management

Notify management of any attempted unauthorized use of the system

When MassLynx is installed with Full Security all events, including attempts to access restricted areas of the system, login with disabled user accounts, or open invalid files, are recorded in MassLynx’s audit log.

The log – which can be viewed using LogLynx – can be stored either on the MassLynx PC or on a remote machine, and can be accessed by any user with appropriate permissions. Events where access was denied are highlighted, and queries can be run that restrict the display to only these events.

In addition, MassLynx can be configured to send messages to a remote machine (that of an authorized manager, for example) if any serious security problems – such as file tampering or unauthorized attempts to log on – are detected. Whether messages are sent, and where to, depends on your tamper detection and audit policy settings.

Tamper detection

Audit policy

What are the audit logs?

Common regulatory requirements

Recommendations


MassLynx checksums

Full Security only: Checksums only apply to Full Security systems.

In Full Security mode, MassLynx applies checksums to all data and metadata files. This ensures that the files created in MassLynx cannot be modified or renamed except through security-controlled and audit logged actions within MassLynx itself.

The checksum ensures that the following properties of the file have not been altered:

  • Filename

  • Size

  • Contents

It will not be possible to open the file in MassLynx if any of these properties have been changed. A warning can be displayed and an entry will be made in the log file.

In addition, MassLynx can be configured to send messages advising of file tampering to another machine, such as that of a senior manager who wishes to be notified of attempts to breach security.

Raw data checksum

For raw data, a checksum file called protected is created in each raw data directory.

Other file checksums

For each file, a .csm file is created.

Example: For a Sample List called acquisition1.spl a checksum file called acquisition1.spl.csm is created.

Copying files

MassLynx checksums have been designed so that MassLynx files can easily be copied (for backup purposes, for instance) without becoming invalid. As long as neither the filename nor the file contents are changed, files can be copied to another location – along with their checksums – and successfully opened in MassLynx. Raw data can be copied so long as the whole raw data directory – including the protected file – is copied.

Introduction to security

Backing up the LogLynx log

Tamper detection


Viewing, copying, and printing audit log entries

Most operations are recorded in the main audit log, accessed through a dedicated viewer called LogLynx. Internal Modifications – operations which do not result in a file being saved to disk – performed in QuanLynx or TargetLynx are stored in their own audit logs, accessed through the QuanLynx and TargetLynx viewers.

Individual events, the whole log, or part of the log, can be printed from LogLynx. Log files can be copied to other locations so long as they are not changed.

What are the audit logs?

Generate time-stamped audit trails

Common regulatory requirements

Recommendations


Viewing, copying, and printing MassLynx files

Data acquired can be viewed in MassLynx – most commonly by using the Chromatogram and Spectrum windows – from where it can also be printed if necessary. The signatures or reasons associated with data can be displayed within the Chromatogram and Spectrum windows by adding the information to the display header. For more information, refer to the MassLynx online Help.

Results from QuanLynx and TargetLynx can be viewed in the browsers within those application managers. In both cases it is possible to print the data, or to export it in LIMS or XML format.

If electronic distribution is required, data can be printed to third-party print drivers that produce files in electronic formats, such as PDF.

Metadata (such as inlet methods, tune files, and MS methods) can also be viewed and printed by opening the appropriate window from the main MassLynx window.

MassLynx checksums (which secure files when Full Security is being used) allow files to be copied to other locations so long as neither the filename nor the contents of the file are altered.

Viewing, copying, and printing audit log entries

MassLynx checksums

MassLynx

Common regulatory requirements

Recommendations