17.3.4. Searching in graphical streams

The Remote Desktop Protocol (RDP), Virtual Network Computing (VNC), and X11 protocols transfer most texts displayed by the remote applications as graphical data. To make these texts searchable, AP automatically processes the opened audit trails and performs optical character recognition (OCR) on the streams.

During installation, AP creates a database from the fonts installed on the system, and uses these fonts for the OCR process. This means that the fonts used by the servers and applications accessed using RDP must be installed on the host running AP. Otherwise AP might not correctly recognize every font type, and miss parts of the text.


Fonts installed after AP has been installed are not automatically used in the OCR process. To include newly installed fonts, complete Procedure 17.3.5, Adding a new font to the OCR database.

Fonts for non-Latin alphabets and symbols, such as Japanese, Chinese, or Webdings can slow down the OCR process, so by default they are excluded from the font database even if these fonts are installed on the host. To enable OCR-ing such fonts, complete Procedure 17.3.5, Adding a new font to the OCR database.


For optimal performance and text recognition in graphical protocols, disable antialiasing on your servers. Antialiased text in the audit trails of RDP, VNC, and X11 connections is not recognized by the OCR engine of the Audit Player. The indexer service recognizes antialiased text, but its accuracy depends on the exact antialiasing settings. Disable antialiasing in order to properly index the trails of these connections. Note that antialiasing is enabled by default on Windows Vista and newer. Antialiasing is also called font smoothing. ClearType is an antialiasing technology used on Microsoft Windows, and should be disabled for optimal performance.

If you are using Audit Player (AP) to OCR graphical audit trails, configure your servers to use the Tahoma or MS Sans Serif fonts on the user interface for optimal performance.