Chatta subito con l'assistenza
Chat con il supporto

Change Auditor - For Advanced Users 7.1.1 - Technical Insight Guide

Change Auditor Services Change Auditor licensing processes Component Start-up Considerations Change Auditor network communications Coordinator internal tasks Registry Settings Change Auditor built-in fault tolerance Change Auditor protection Database Considerations Account exclusions best practices

How to estimate the required SQL server disk space

The Change Auditor 6.x database can grow indefinitely without a decrease in performance. This makes it unnecessary to create periodic archives.

Adequate disk space should be reserved to accommodate the volume of events dictated by your compliance and retention policies. Testing shows that events take approximately 8,000 bytes per event.

•
Example 1: 1,000 events = 8 MB estimated disk size required
•
Example 2: 30,000 events = 240 MB estimated disk size required

In addition to the volume of events, the type of events and the volume of alerting also affect disk consumption. To predict disk consumption for your intended retention period, configure Change Auditor as you intend to use it in your environment for a period sufficient to project long-term space requirements.

How SQL Server Autogrow affects Change Auditor

How SQL Server Autogrow affects Change Auditor

The Change Auditor 6.x database is created with SQL Server Autogrowth set to 10%. This may cause issues for large databases that require an extended amount of time to grow the database.

If you begin to see frequent timeouts in the coordinator log, check the SQL Errorlog for “Autogrow of file ‘ChangeAuditor’ in database ‘ChangeAuditor’ was cancelled by user or timed out after 30121 milliseconds.” to confirm that it is related to Autogrowth. If you see this error, consider changing the Autogrowth setting to a smaller value or implementing “Instant File Initialization” on the SQL server hosting the Change Auditor database. You can also pre-allocate a larger size for the Change Auditor database manually.

How to query an archive database

To query an archive (6.x) database, you need to:

1
Create a connection profile for your archive databases.
2
Connect to an archive database.
3
Create and run searches and reports as you normally would.
To create and connect to a connection profile for an archive database:
1
Open the client.
2
On the Connection Profile screen, select Manage.
3
On the Manage Connection Profiles dialog, select Add to start the Connection wizard.
4
On the first page of the wizard, select Database Direct and Next.
5
Select the name of your SQL Server and enter the name of the archive Change Auditor database you want to connect to.
6
On the last page of the wizard, name your profile and select Finish to save it.
7
On the Connection Profile screen, use the Profile drop-down to select the archive database to use and click Connect.
8
After you connect to an archive database, you can create and run searches and reports as you normally would.
 
* 
NOTE: When users connect to an archive database, they are bypassing the coordinator service and making a direct connection to the SQL Server so they need the appropriate permissions on these archive databases.

An easy way to configure the appropriate SQL security for all users is to add them to the appropriate Change Auditor database role that is created during the coordinator installation. Essentially you will use the Change Auditor security groups that were created during the coordinator installation. Create corresponding SQL logins for these two groups, and then assign each of those logins the appropriate database role for each of the archive databases:

•
ChangeAuditor Administrator group to ChangeAuditor_Administrator role
•
ChangeAuditor Operator group to ChangeAuditor_Operator role

For more information about adding accounts to the Change Auditor database role, see the Change Auditor Installation Guide.

 

 

Account exclusions best practices

Some administrative user accounts are responsible for large amounts of Exchange Server utilization, but are trusted accounts and do not need to be audited. In particular, users of BlackBerry Enterprise Server will find that the BES background processes on the Exchange Server Mailbox role (Exchange 2013 and higher) consumes significant resources, particularly when the agent is running. Other such accounts may be used for mailbox backup and archiving, spam filtering, and anti-virus protection.

To limit Change Auditor’s utilization and unwanted audit events, by default the BlackBerry Enterprise Server administrative accounts, and accounts with similar special Active Directory permissions, are excluded automatically from auditing. This feature can be turned off if necessary (contact Quest Technical Support); however, utilization may increase unacceptably as a result when those accounts are active.

Other trusted user accounts can be manually excluded from auditing. If you find that trusted accounts are generating large numbers of unwanted audit events, or if Exchange Server utilization is unusually high when such accounts are active and Change Auditor is running, Quest recommends that you exclude the accounts as described here to reduce overhead and improve performance of the agent.

To exclude user accounts from Exchange Mailbox auditing:
1
Select View | Administration to open the Administration Tasks tab.
2
Click Auditing.
3
Select Excluded Accounts (under the Configuration heading) to open the Excluded Accounts Auditing page.
4
Click Add to start the Excluded Accounts wizard.
5
On the first page of the wizard, enter the following information:
•
Template Name — enter a descriptive name for the template. For example, Exclude BlackBerry Service Account.
•
Facility/Event Class list (middle pane) — scroll and locate the Exchange Mailbox Monitoring events. Select one of these events, click Add, and select Add All Events in Facility.
 
* 
NOTE: Using the Add All Events in Facility option is important because excluding the entire facility allows Change Auditor to ignore all Exchange activity for this account, reducing CPU utilization in the Exchange store or client access service. Excluding some or all individual mailbox monitoring events using the Add This Event option disables those events, but does not reduce utilization.
Click Next.
6
On the Select Accounts to Exclude page, use the Browse or Search pages to locate and select the BES Administrative account (for example, BESAdmin, or as named by the administrator). After you have located and selected this account, click Add to add the selected account to the list box.
7
Click the down-arrow on the Finish button and select Finish and Assign to Agent Configuration to assign the template to the configuration that applies to the agents on the Exchange Servers hosting the Exchange Server Mailbox role (Exchange 2013 and higher).
8
On the Configuration Setup dialog, locate the Excluded Account template you just created (it is listed in the Auditing and Protection Templates section across the bottom of the dialog). Select it and then drag it onto the correct agent configuration in the left pane. The Assigned cell for the template should now display ‘Yes’.
9
Click OK to save the changes and close the dialog.
10
On the Agent Configuration page, confirm that each Exchange Server agent has Auditing in the Exclude Account column.
If an Exchange Server agent does not have ‘Auditing’ in the Exclude Account column, select that agent from the list and click Assign. On the Agent Assignment dialog, select the correct configuration and click OK.
11
After confirming that your Excluded Account template is assigned to the correct agent configuration and is enabled, open the Deployment page (View | Deployment) to deploy an agent to the Exchange Servers.
* 
NOTE: When the Change Auditor agent initially starts up, CPU utilization briefly increases in the RPC Client Access service (Exchange 2013 and higher mailbox role). This is a normal effect of agent initialization as it forces reconnection of any open Outlook connections so they can be audited. After Outlook reconnections have finished, processor utilization should stabilize.

To minimize the disruption on networks with many Outlook users, Quest recommends that scheduled installations, upgrades, and starting and stopping of agents on Exchange servers be performed during periods when relatively few users are connected.

 

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione