Tchater maintenant avec le support
Tchattez avec un ingénieur du support

Change Auditor 7.3 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Introduction

In addition to the overview information provided in the Coordinator Status pane on the Overview page, you can obtain coordinator status and statistics through the following options:

•
The Coordinator Statistics page which provides a global view of all installed coordinators, including the current status and other usage statistics for each coordinator.
•
The Change Auditor Coordinator Status dialog, which is accessed using the coordinator system tray icon, provides the status and usage statistics for a single coordinator.

You can also view or retrieve coordinator trace logs from the Coordinator Statistics page or by using the coordinator system tray icon.

Coordinator Statistics page

Use the View | Statistics | Coordinator menu command to display the Coordinator Statistics page, which provides a global view of all installed coordinators, including the current status of the coordinators.

The Coordinator Statistics page may contain the following information for each coordinator. The following table identifies the fields that are displayed by default. To display different fields, click the Field Chooser button located to the far left of the column headings and select the required columns:

 
* 
NOTE: All dates and times are based on the client’s current local date and time. The format used to display the date and time is determined by the local computer’s regional and language setting.
Table 1. Coordinator Statistics page: Field descriptions
Column
Default
Description

Agents Connected

Yes

Displays the number of agents to which this coordinator is connected.

Alerts Last 24 Hours

No

Displays the number of alerted event entries in the last 24 hours of the coordinator operation.

The value in this field is a hypertext link and when selected displays the alerts generated in the last 24 hours.

Alerts Last Hour

No

Displays the number of alerted event entries in the last 60 minutes.

The value in this field is a hypertext link and when selected displays the alerts generated in the last 60 minutes.

Alerts Today

Yes

Displays the number of alerted event entries since local midnight today.

The value in this field is a hypertext link and when selected displays the alerts generated since local midnight today.

Alerts Total

No

Displays the number of alerted events found in the coordinator database.

The value is this field is a hypertext link and when selected displays the alerts in the coordinator database.

Alerts Yesterday

No

Displays the number of alerted event entries from local midnight today to local midnight yesterday.

The value in this field is a hypertext link and when selected displays the alerts generated yesterday.

Architecture

No

Displays whether the coordinator is installed in a 32-bit (x86) or 64-bit (x64) environment.

Client Port

Yes

Displays the port number assigned to the coordinator Service Connection Point (SCP).

Coordinator

Yes

Displays the computer name of the coordinator.

Coordinator FQDN

No

Displays the fully qualified domain name of the coordinator.

Coordinator ID

Yes

Displays the ID of the coordinator that processed the event.

DB Catalog

Yes

Displays the name assigned to the coordinator database during the coordinator installation.

DB Instance

No

Displays the name of the SQL instance that is being used for the coordinator database.

DB Size

Yes

Displays the size of the coordinator database, in kilobytes.

Domain

Yes

Displays the name of the domain where the coordinator is located.

Events Last 24 Hours

No

Displays the number of event entries received from all agents in the last 24 hours of coordinator operation.

The value in this field is a hypertext link and when selected launches a quick search to display the events generated in the last 24 hours.

Events Last Hour

No

Displays the number of event entries received in the last 60 minutes of the coordinator operation.

The value in this field is a hypertext link and when selected launches a quick search to display the events generated in the last 60 minutes.

Events Today

Yes

Displays the number of events encountered since 12:00 a.m. of the current day (based on the relative coordinator computer's time).

The value in this field is a hypertext link and when selected launches a quick search to display the events generated today.

Events Total

No

Displays the number of entries found in the coordinator events database.

The value in this field is a hypertext link and when selected launches a quick search to display all events encountered since the agent was started.

Events Yesterday

No

Displays the number of events encountered between 12:00 a.m. yesterday and 12:00 a.m. of the current day (based on the relative coordinator computer's time).

The value in this field is a hypertext link and when selected launches a quick search to display the events generated yesterday.

Forest

No

Displays the name of the forest where the coordinator resides.

Startup Time

No

Displays the date and time when the coordinator was last initialized.

Status

Yes

Displays the current status of the coordinator:

•
running
•
initializing
•
stopped
•
failed

Uptime

Yes

Displays how long the coordinator has been running.

Version

Yes

Displays the current coordinator version installed on the server.

Coordinator system tray icon

During the coordinator installation process, Change Auditor automatically loads an icon in the system tray of each coordinator. This system tray icon allows you to enable/disable the coordinator, display the status of the coordinator installed on the current machine, and to change the database instance and service accounts used to access the database. Whenever a coordinator is not active, a status indicator will appear in the lower left corner of this icon to represent its current status:

•
Red - inactive
•
Yellow - initializing

By right-clicking on the coordinator icon in the system tray, a context menu is displayed which consists of the following commands:

 
Table 2. Coordinator system tray icon: Right-click commands
Command
Description

Coordinator Status

Displays the Coordinator Status dialog which assists you in determining if the coordinator is running, what version is installed and how active the coordinator is.

See Change Auditor Coordinator Status dialog for a full description of this status dialog.

Enable/Disable Coordinator

Starts or stops the coordinator.

View Coordinator Log

Opens the log viewer to review the events recorded in the coordinator log (ChangeAuditor.ServiceLog.nptlog).

For example: %ProgramFiles%\Quest\ChangeAuditor\Service\Logs\ChangeAuditor.ServiceLog.nptlog

Coordinator Configuration

Starts the Coordinator Configuration Tool which allows you to:

•
modify the credentials used to access the coordinator database
•
specify a ‘static’ port to be used for communication with the coordinator
•
specify where the Active Directory/GPO protection templates are to be stored: SQL (default) or Active Directory

See Coordinator Configuration tool for a description of how to use this utility.

Load On Startup

Automatically loads the system tray application when the coordinator starts.

About

Display information about Change Auditor including the installed version number and licensing information.

Exit

Closes the system tray application.

Change Auditor Coordinator Status dialog

The Change Auditor Coordinator Status dialog helps you determine if the coordinator is running and what version is installed on the server. The other status information on the dialog is broken down into the following sections:

•
Coordinator Information - displays the status, version number, SCP port and installation name for the coordinator
•
Database Information - displays the coordinator database server, name and size
•
Agent Connections to this Coordinator - displays the total number of agents that are connected to the coordinator
•
Events and Alerts on this Coordinator - displays status information regarding events, alerts, and search activities for this particular coordinator
•
Agent Ports on this Coordinator - displays all ports used for communication.

The Change Auditor Coordinator Status dialog contains the following information:

 
Table 3. Change Auditor Coordinator Status dialog: Status information
Field
Description
Coordinator Information

Coordinator Status

Displays the current status of the coordinator:

•
Running
•
Initializing
•
Stopped
•
Failed

This value will normally be ‘Running’. If the credentials supplied for the database access during the coordinator installation are incorrect or have expired, this field will display ‘Not Running’ indicating that the coordinator did not successfully start. If this happens, use the Database Configuration Utility to change the permissions trying to access the database.

Installation Name

Displays the installation name assigned to the coordinator during installation.

Version

Displays the current version of the coordinator installed on the server.

Database Information

SQL Server

Displays the name of the server where the coordinator resides.

Database Catalog

Displays the name assigned to the coordinator database during the coordinator installation.

Database Size

Displays the size of the coordinator database, in megabytes.

Database Free Space

Displays the available free space in the coordinator database.

Agent Connections to This Coordinator

Agents Connected (Total)

Displays the total number of agents connected to this coordinator.

Events and Alerts on This Coordinator

Total Events

Displays the number of events this coordinator has received since it was last started.

Events in Receive Buffer

Displays the number of events that have not yet been processed by this coordinator and forwarded to the client.

Average Events Per Second

Displays the average number of events processed by this coordinator per second.

Agent Ports on This Coordinator

Client SCP Port

Displays the port number assigned to the coordinator Service Connection Point (SCP).

Public SDK Port

Displays the port number assigned for external applications to access the coordinator.

Agent Port

Displays the port number assigned to the agents to communicate with the coordinator.

Documents connexes

The document was helpful.

Sélectionner une évaluation

I easily found the information I needed.

Sélectionner une évaluation