Note that on Microsoft Windows, you cannot import CA certificates from a shared drive. In this case, copy the certificate to a local folder and import it from there. Also, the Safeguard Desktop Player application must be installed locally, you cannot start the player.exe file from a shared drive.
Summary of changes
Features and limitations
First steps
Thank you for installing the Safeguard Desktop Player
Getting started with the Safeguard Desktop Player
Validate audit trails
Replay audit trails
Replay encrypted audit trails
Replay encrypted audit trails from the command line
Replay audit files in follow mode
Search in the content of the current audit file
Search query examples
Export the audit trail as video
Sharing an encrypted audit trail
Replay X11 sessions
Export transferred files from SCP, SFTP, HTTP, and RDP audit trails
Export files from an audit trail after RDP file transfer via clipboard
Export transferred files from SCP, SFTP, HTTP and RDP audit trail using the command line
Export raw network traffic in PCAP format
Export raw network traffic in PCAP format using the command line
Export raw network traffic in PCAP format using the GUI
Export screen content text
Troubleshooting the Safeguard Desktop Player
Determine your Safeguard Desktop Player version
.zat, .zatx, and .srs files are not opened automatically
Problems in VirtualBox
Force software rendering
Cannot import CA certificate
Logging
Install Safeguard Desktop Player
Safeguard Desktop Player system requirements
Install Safeguard Desktop Player on Windows
Install Safeguard Desktop Player on Linux
Install Safeguard Desktop Player on Mac
Keyboard shortcuts
Cannot import CA certificate
Logging
The Safeguard Desktop Player application displays important log messages on the Warnings tab. If you increase the log level of the application above the default, additional log messages are also displayed.
Figure 1: Warnings and logs
You can use the following command-line parameters to specify the log level of the Safeguard Desktop Player application.
- -l or --log-level <number>
-
Set the log level of Safeguard Desktop Player. The default is 3, 0 completely disables logging, 7 is the most verbose, used for debugging. For example:
Windows: player.exe --log-level 5
Linux: ./player --log-level 5
- -o or --log-output <path-to-logfile>
-
Specify the path and filename of the log file. For example:
Windows: player.exe --log-output desktop-player.log
Linux: ./player --log-output /tmp/desktop-player.log
- -s or --log-spec <log-spec>
-
Specify different log levels for certain components of Safeguard Desktop Player. For example:
Windows: player.exe --log-level 3 --log-spec "bdp.core:5"
Linux: ./player --log-level 3 --log-spec "bdp.core:5"
Install Safeguard Desktop Player
Install Safeguard Desktop Player
To install the Safeguard Desktop Player application, read the following sections.
Safeguard Desktop Player system requirements
The Safeguard Desktop Player application supports the following platforms:
-
Microsoft Windows:
64-bit version of Windows 7 or newer. Install the appropriate driver for your graphic card.
-
Linux:
RHEL 6, CentOS 6, or newer. The Safeguard Desktop Player application will probably run on other distributions as well that have at least libc6 version 2.12 installed.
-
Mac:
macOS High Sierra 10.13, or newer.
Installing the Safeguard Desktop Player application requires about 120MB disk space, and a temporarily used disk space to store the audit trails that are replayed. The size of the temporary files depends on the size of the replayed audit trails.
You can install the Safeguard Desktop Player application with user privileges.