Can you provide a little more context here?
Since packages that are of the "install automatically" type are configured as such in the Console, you should know about what gets pushed out automatically versus what's on offer?
Or is this a minor "ooops - didn't mean to have it be automatically deployed" type situation (in which case - why does it matter)?
The SDCLIENT-side logs won't tell you who initiated things, they'll just care about logging "how the install went".
For the rest, there may be some stuff - it'd just help having a bit more context about what/why you're after it ... and how your users do stuff (i.e. - do you use Workspaces or the older policy portal)?
... Policy-logs should tell you about required policies (there'll be a log entry along the lines of "running required" or so) ... would need to do some digging around specific "user kicked this one off" type stuff. I'm tempted to say "yes" (but it being a few minutes before I shut down for the weekend, I could be recollecting incorrectly) ... having some more info would be nice.
Hello, this is one of those MAYOR "ooops - didn't mean to have it be automatically deployed" type situation ... One package was deployed that didn't suppose to be.
I'm pretty sure the task is correct and it should not deployed the package, but it was, which leds me to think that someone clicked the package from the portal manager, but I need to be absolutely sure, you mention that "The SDCLIENT-side logs won't tell you who initiated things, they'll just care about logging "how the install went" so i wont be able to know how that happened?
I was rattling through the list of various logs involved (the two "sure fire" ones being SDCLIENT (which does the actual installing) and PolicySync (which checks what's targeted against the devices).
Can't really look at logs in detail (as my VM-s are locked out for a few hours running a bunch of upgrade type stuff that I can't stop now) ... is this OK to wait 'til next week, or is this super urgent? (Sod's law being that I only noticed this thread after effectively killing my machine for the next few hours).
So PortalManager has a log - "LANDeskPortalManager.log" in - "C:\ProgramData\LANDesk\Log\". You might check what that has to say for itself (my box doesn't have any policies targeted against it so I couldn't experiment, as I'm out of VM-s I can launch up).
The "PolicySync.exe.log" log should only have entries about X many policies being required & running them ... so that with date/time stamps from the SDCLIENT might be something.
On to the files in "C:\Program Files (x86)\LANDesk\LDClient\Data\"
- The "TaskHistory.xml" (Open it in IE for easier readability) doesn't list who kicked a task off.
- The SDCLIENT.TASK.### log(s) (where the ### is the TASK_IDN) could be of use (if you cross-check them against the policy logs)
OK - so here's an example POLICYSYNC.EXE.LOG extract of finding a new required policy & running it (note the bold line) - so that gives you that sort of time-stamp / string to search for:
07/22/2016 17:50:20 INFO 5100:1 RollingLog : Request: GetWebResponse ok 07/22/2016 17:50:20 INFO 5100:1 RollingLog : Request: Has 5 targeted policies 07/22/2016 17:50:20 INFO 5100:1 RollingLog : RunPolicySync: ProcessRequestedPolicies 07/22/2016 17:50:21 INFO 5100:1 RollingLog : LoadLocalPolicyInfo: load local machine 07/22/2016 17:50:21 INFO 5100:1 RollingLog : LoadLocalPolicyInfo: load user 07/22/2016 17:50:21 INFO 5100:1 RollingLog : HandleRunNow: has 1 run now policies 07/22/2016 17:50:21 INFO 5100:1 RollingLog : Exit PolicySync.exe with code 0 07/22/2016 17:50:21 INFO 1136:1 RollingLog :
Run PolicySync.exe /enforce
07/22/2016 17:50:21 INFO 1136:1 RollingLog : EnforcePolicies: check and run RunNow and Reoccurring policies
... and here's me installing a policy from the policy portal (myself "on demand" as a user) - check the "LANDeskPortalManager.exe.log"
07/22/2016 17:50:01 INFO 4916:1 RollingLog : PreservedViewName: Do not has saved view name, try default one 07/22/2016 17:52:25 INFO 4916:1 RollingLog : Start install: Notepad Via Batch 07/22/2016 17:52:41 INFO 4916:1 RollingLog : Downloading Finished for Notepad Via Batch 07/22/2016 17:52:42 INFO 4916:1 RollingLog : Installing Notepad Via Batch
So ... if "the policy name" shows up in the "LANDeskPortalManager.exe.log", then users installed it via the policy portal at their request / on-demand. The "required" policy didn't put any log-entries into that log.
That should make life easier for you no? .