Change Auditor 7.5 - User Guide

Audit Events page

Audit Events page

The Audit Events page is displayed when Audit Events is selected from the Auditing task list in the navigation pane of the Administration Tasks tab, and lists all of the events available for auditing. It also displays the facility and subsystem to which the event belongs, the severity assigned to each event, if the event is enabled or disabled and the type of license that is required.

NOTE: Changes made on this page are global and will apply to all Change Auditor agents.

The Audit Events page contains an alphabetical list of all the Change Auditor events, including the following information:

 

Table 1. Audit Events page: Field descriptions

Column	Description
Severity	Indicates the severity level assigned to each event: • Low • Medium • High When your cursor is placed in this cell, a drop-down arrow is added allowing you to change an event’s severity setting.
Facility Name	Displays the name of the facility to which each event belongs.
Event Class	Displays a descriptive title for each event.
Status	Indicates whether the event is enabled or disabled. When your cursor is placed in this cell, a drop-down arrow is added allowing you to either enable or disable the event.
License Type	Displays the type of Change Auditor license required for each event: • Any License • Active Directory • AD Query • EMC • Exchange • File System • Logon Activity • NetApp • SharePoint • SQL
Results	Displays the result criteria used to capture change events. That is, you can use the options in this column to specify if an event is to be captured based on the results of the operation mentioned in the event. • All Results (default) • Success Only • Success and Failed Only • Success and Protected Only For example, if you only want to capture successful events where the operation occurred as stated in the event, you would set this to Success Only. Then, if the change was prevented from occurring as stated in the event (because the object was protected by Change Auditor or the operation was prevented due to a factor/setting outside of Change Auditor’s control) the associated event would not be captured.
Subsystem	Displays the name of the subsystem to which each event belongs.

Enable/disable event auditing

Enable/disable event auditing

You can enable or disable events to best suit your organization. To view or modify the current event auditing settings, use the Audit Events page, which is accessible through the Administration Tasks tab.

NOTE: If event logging is enabled, enabling or disabling events in Change Auditor does not impact this setting and events will continue to be sent to the appropriate Windows event log.

To disable/enable individual events:

1	Open the Administration Tasks tab and click Auditing.

2	Select Audit Events (under the Configuration heading in the Auditing task list) to display the Audit Events page.

3	To disable an event, select one or more enabled events and click Disable. (Use the Shift or Ctrl keys to select multiple events.)

4	To enable an event,select one or more disabled events and click Enable. (Use the Shift or Ctrl keys to select multiple events.)

NOTE: You can also disable or enable an event using the Disable/Enable tool bar button at the top of the Event Details pane on a Search Results page.

Modify event's severity level or event class description

Modify event’s severity level or event class description

Each event has been assigned a severity level and a description, which can also be changed based on your organization’s operation. To view or modify the current event auditing settings, use the Audit Events page, which is accessible through the Administration Tasks tab.

To modify an event’s severity level:

1	Open the Audit Events page.

2	Select one or more events and click the appropriate Severity (High, Medium or Low) tool bar button. Use the Shift or Ctrl keys to select multiple events.

3	To reset an event’s severity to the factory default, select one or more events and click Default.

To modify an event class description:

1	Open the Audit Events page.

2	Select the event from the list and click Edit.

This displays the Rename dialog listing the existing description and allowing you to enter a new description for the selected event.

3	In the New field, enter the new description for the selected event and click OK.

Define events to be captured based on results

Define events to be captured based on results

The Results column on the Audit Events page allows you to specify if an individual event is to be captured by Change Auditor based on the results of the operation performed in the event. That is, you can specify to capture an individual event based on the following results:

•	All Results - capture event regardless of the result returned.

•	Success Only - capture event only if the operation occurred as stated in the event.

•	Success and Failed Only - capture event if the operation occurred as stated in the event or if it was prevented due to a factor/setting outside of Change Auditor’s control.

•	Success and Protected Only - capture event if the operation occurred as stated in the event or if it was prevented because the object was protected using Change Auditor’s protection feature.

To change the results criteria for capturing an event:

1	Open the Audit Events page.

2	Locate the event to modify.

3	Place your cursor in the Results cell for that event, click the arrow control and select one of the following options:

▪	All Results (default)

▪	Success Only

▪	Success and Failed Only

▪	Success and Protected Only

4	Change Auditor will now only capture and return the event if the operation mentioned if the event meets the results criteria selected.