POLICY EVENT DRIVEN REMOTE DESKTOP RECORDING ACROSS A DATA NETWORK

1 . A method of remotely recording events occurring on a managed machine, the method comprising:

identifying the managed machine operating in a communication network;

transmitting a connection establishment message to the managed machine over the communication network;

receiving an acceptance message from the managed machine;

transmitting a recording operation trigger to the managed machine; and

receiving recorded information from the managed machine after the recording operation trigger has been invoked.

2 . The method of claim 1 , wherein the recording operation trigger is transmitted to an agent application operating on the managed machine.

3 . The method of claim 2 , further comprising:

storing the recording operation trigger in the managed machine;

identifying at least one event performed by the managed machine that matches the recording operation trigger; and

initiating the recording operation responsive to identifying the at least one event performed by the managed machine.

4 . The method of claim 3 , wherein the recording operation trigger comprises at least one of a specific application, an amount of time elapsed, and a specific message transmitted from the managed device.

5 . The method of claim 1 , further comprising:

creating a log file that comprises recorded information that occurred after the recording operation trigger has been invoked; and

storing the log file in a remote database.

6 . The method of claim 5 , further comprising:

identifying at least one event of interest;

retrieving the log file; and

searching the content of the log file for the at least one event of interest.

7 . The method of claim 6 , wherein the at least one event of interest is based on a particular application that was executed on the managed machine during a duration of the recording operation.

8 . An apparatus configured to remotely record events occurring on a managed machine, the apparatus comprising:

a processor configured to identify the managed machine operating in a communication network;

a transmitter configured to transmit a connection establishment message to the managed machine over the communication network; and

a receiver configured to receive an acceptance message from the managed machine, wherein the transmitter is further configured to transmit a recording operation trigger to the managed machine, and wherein the receiver is further configured to receive recorded information from the managed machine after the recording operation trigger has been invoked.

9 . The apparatus of claim 8 , wherein the recording operation trigger is transmitted to an agent application operating on the managed machine.

10 . The apparatus of claim 9 , further comprising:

a memory configured to store the recording operation trigger in the managed machine, and wherein the processor is further configured to identify at least one event performed by the managed machine that matches the recording operation trigger, and initiate the recording operation responsive to identification of the at least one event performed by the managed machine.

11 . The apparatus of claim 10 , wherein the recording operation trigger comprises at least one of a specific application, an amount of time elapsed, and a specific message transmitted from the managed device.

12 . The apparatus of claim 8 , wherein the processor is further configured to create a log file that comprises recorded information that occurred after the recording operation trigger has been invoked, and wherein a memory is further configured to store the log file in a remote database.

13 . The apparatus of claim 12 , wherein the processor is further configured to identify at least one event of interest, retrieve the log file, and search the content of the log file for the at least one event of interest.

14 . The apparatus of claim 13 , wherein the at least one event of interest is based on a particular application that was executed on the managed machine during a duration of the recording operation.

15 . A non-transitory computer readable storage medium configured to store instructions that when executed cause a processor to perform remotely recording events occurring on a managed machine, the processor being further configured to perform:

identifying the managed machine operating in a communication network;

transmitting a connection establishment message to the managed machine over the communication network;

receiving an acceptance message from the managed machine;

transmitting a recording operation trigger to the managed machine; and

receiving recorded information from the managed machine after the recording operation trigger has been invoked.

16 . The non-transitory computer readable storage medium of claim 1 , wherein the recording operation trigger is transmitted to an agent application operating on the managed machine.

17 . The non-transitory computer readable storage medium of claim 16 , wherein the processor is further configured to perform:

storing the recording operation trigger in the managed machine;

identifying at least one event performed by the managed machine that matches the recording operation trigger; and

initiating the recording operation responsive to identifying the at least one event performed by the managed machine.

18 . The non-transitory computer readable storage medium of claim 17 , wherein the recording operation trigger comprises at least one of a specific application, an amount of time elapsed, and a specific message transmitted from the managed device.

19 . The non-transitory computer readable storage medium of claim 15 , wherein the processor is further configured to perform:

creating a log file that comprises recorded information that occurred after the recording operation trigger has been invoked; and

storing the log file in a remote database.

20 . The non-transitory computer readable storage medium of claim 15 , wherein the processor is further configured to perform:

identifying at least one event of interest;

retrieving the log file; and

searching the content of the log file for the at least one event of interest, and wherein the at least one event of interest is based on a particular application that was executed on the managed machine during a duration of the recording operation.