Change Auditor 7.5 - User Guide

Deployment requirements

Deployment requirements

For a successful deployment, ensure that your environment meets the minimum system requirements. For information about system requirements, see the Change Auditor Release Notes. For details on installing Change Auditor, see the Change Auditor Installation Guide.

To audit EMC, you need to:

•	Install EMC Event Enabler Framework

•	Create EMC Auditing template

Install EMC Event Enabler Framework

Install EMC Event Enabler Framework

NOTE: This guide outlines the installation steps that are required for Change Auditor to integrate with the EMC Event Enabler Framework. For detailed installation steps, see the appropriate guides from EMC Corporation. See the EMC Corporation website (http://www.emc.com/) for information about downloading EMC product executables.

1	Download the Common Event Enabler (CEE) Framework compatible with your device from the EMC website and install on one or more Windows servers where you want to monitor activity. The server must also have an agent installed.

2	Install the EMC Common Event Publishing Agent (CEPA) Auditing which enables Change Auditor to monitor the file system activity on EMC.

NOTE: For Isilon or Unity NAS servers, the installation process is complete. Skip the next two steps. NOTE: Change Auditor for EMC does not support automatic Isilon of Unity auditing configuration. See EMC Isilon Auditing and EMC Unity Auditing for more information about the manual configuration required.

3

Create a configuration file (cepp.conf file) before using the CEPA auditing feature. The cepp.conf file contains the information to connect Data Movers to the Windows computers where the CEE software is installed. You can either manually create the cepp.conf file or use Change Auditor to create this configuration file later.

4	If you manually created the cepp.conf file, start the CEPA facility and then verify that it has started. Use the following command syntax to start the CEPA facility and to check its status:

▪	$ server_cepp <DataMoverName> -service -start

▪	$ server_cepp <DataMoverName> -service -status

Create EMC Auditing template

Create EMC Auditing template

You need to define an EMC auditing template for each EMC file server (CIFS) to be audited. In addition to defining the EMC file server (CIFS) to audit and the agents to receive these events, completing this step also installs the Shared EMC Connector service (QCeeService). This service enables auditing of EMC devices by multiple Quest software products. This service is required because EMC supports only one auditing pool at a time.

NOTE: The cepp.conf file contains the information to connect Data Movers to the Windows computers where the CEE is installed and stores the auditing configuration. If you manually created the cepp.conf, you can update the configuration file during template creation. More specifically, it adds a ‘quest servers’ pool name entry to the existing configuration file specifying the Change Auditor agents assigned to receive the EMC events.

NOTE: Ensure that the servers that you deploy agents to have CEPA Auditing installed.

Client components and features

Client components and features

The following table lists the client components and features that require a valid Change Auditor for EMC license. You are not prevented from using these features; however, associated events are not captured unless the proper license is applied.

NOTE: To hide unlicensed Change Auditor features from the Administration Tasks tab (including unavailable audit events throughout the client), select Action | Hide Unlicensed Components. This command is only available when the Administration Tasks tab is the active page.

 

Table 1. Change Auditor for EMC client components and features

Client page	Feature
Administration Tasks Tab	Agent Configuration Page: • Event Logging - enable/disable EMC event logging NOTE: See EMC event logging for information about enabling EMC event logging. • Configuration Setup Dialog - File System Tab ▪ Discard duplicates that occur within nn seconds ▪ Audit all configured, including duplicates (Not Recommended) NOTE: See File System events settings for details about these File System Events settings. Audit Task List: • EMC NOTE: See EMC auditing templates for information about creating templates to define EMC auditing.
Event Details Pane	What Details: • Path • Process
Events	Facilities: • EMC
Search Properties	What Tab: • Subsystem | File System NOTE: See Create custom EMC searches for information about using the What tab to create custom EMC search queries.
Searches Page	Built-in Reports: • Reports that include EMC events