Change Auditor for Fluid File System 7.2

Chat now with support

Introduction

Change Auditor provides built-in searches that can be run to retrieve FluidFS activity captured by deployed agents enabling you to retrieve valuable information from a variety of perspectives.


	NOTE: The terms ‘searches’ and ‘reports’ are used in conjunction to acquire the desired output. You run a ‘search’ and the results returned are referred to as a ‘report’.

You to create custom search definitions to search for file and/or folder changes to a specific volume. You will use the Search Properties tabs across the bottom of the Searches page to define new custom searches.

FluidFS built-in searches

and

To see a complete list of built-in reports, see the Change Auditor Built-in Reports Reference Guide.

To run a built-in search:

Click on the Searches tab.

Select Shared | Built-in | All Events to display the list of search definitions stored in the selected folder.

In the right-hand pane, locate the All FluidFS and click Run

A new Search Results Page will be displayed populated with the audited events that met the search criteria defined in the selected search definition.


	NOTE: To modify a built-in search, see the Change Auditor User Guide.

Create custom FluidFS searches

The following scenarios explain how to use the What tab to create custom FluidFS searches.

To search for all file system events including FluidFS events:

NOTE: If you wanted to, you can use the other search properties tabs to define additional criteria:

•

Who - allows you to search for events generated by a specific user, computer or group

•

Where - allows you to search for events captured by a specific agent or within a specific domain or site

•

When - allows you to search for events that occurred within a specific date/time range

•

Origin - allows you to search for events that originated from a specific workstation or server

Open the Searches page.

In the explorer view (left pane), expand and select the folder where you want to save your search.

Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all Change Auditor users.

Click New.

This enables the Search Properties tabs across the bottom of the Searches page.

On the Info tab, enter a name and description for the search.

Open the What tab, expand Add and select Subsystem | File System.

On the Add File System Path dialog, select the All File System Paths option.

Review the Actions section and select those that are to be included in the search.

By default, All Actions is selected meaning that all of the actions associated with the file system path will be included in the search.

Click OK to save your selection and close the dialog.

Once you have defined your search criteria, click Run to save and run the search.

When this search runs, Change Auditor searches for all file system events including FluidFS events and display the results in a new search results page.

To search for events performed against a specific FluidFS file or folder:

Open the Searches page.

In the explorer view (left pane), expand and select the folder where you want to save your search.

Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all users.

Click New.

This will activate the Search Properties tabs across the bottom of the Searches page.

On the Info tab, enter a name and description for the search.

Open the What tab, expand Add and select Subsystem | File System.

On the Add File System Path dialog, select one of the following scope options:

•

This Object - select to search only the selected object.

•

This Object and Child Objects Only - select to search the selected object and its direct child objects.

•

This Object and All Child Objects - select to include the selected object and all subordinate objects (in all levels)

In the Path field, enter or use the browse button to select the FluidFS path to be searched.

To search for events against a specific volume, enter the path as follows: \\<VolumeName>

To search for events against a specific folder, enter the path as follows: \\<VolumeName>\<FolderName>\

To search for events against a specific file, enter the path as follows: \\<VolumeName>\<FolderName>\<FileName>


	NOTE: If the scope of your search is This Object, you can use the * wildcard character to specify the FluidFS path. That is, use an asterisk (*) to substitute zero or more characters. When using the This Object option, be sure to select the appropriate Type option to define the type of path to be searched: Files or Folders.

Review the Actions section and select those that are to be included in the search.

By default, All Actions is selected meaning that all of the actions associated with the path will be included in the search.

When the scope includes child objects, All Types are selected by default meaning that all types of paths will be searched. If you selected the This Object scope option, Files is selected by default, which can be changed to Folders. Only one type can be selected.


	NOTE: The Transaction option does not apply to FluidFS events.

Click OK to save your selection and close the dialog.

Click Run to save and run the search. Click Save to save the search definition without running it.

When this search runs, Change Auditor searches for FluidFS events in the selected path and display the results in a new search results page.

To search for a specific FluidFS event class:

Open the Searches page.

In the explorer view (left pane), expand and select the folder where you want to save your search.

Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all Change Auditor users.

Click New.

This enables the Search Properties tabs across the bottom of the Searches page.

On the Info tab, enter a name and description for the search.

Open the What tab, click Add (or expand the Add tool bar button and select Event Class).

On the Add Facilities or Event Classes dialog, enter FluidFS in the filter field under the Facility heading to display all of the FluidFS events.

From this list, select one or more events and use the Add | Add This Event option to add the selected events to the list box at the bottom of the dialog. Click OK to save your selection and close the dialog.

Click Run to save and run the search. Click Save to save the search definition without running it.

When the search runs, Change Auditor searches for the FluidFS events based on the search criteria specified on the What tab and display the results in a new search results page.