Change Auditor for VMWare 7.1.1

VMware Auditing page

The VMware Auditing page is displayed when VMware is selected from the Auditing task list in the navigation pane of the Administration Tasks page. From this page you can launch the VMware Auditing wizard to define templates specifying the VMware hosts to be audited. You can also edit existing templates, disable/enable templates and delete templates that are no longer being used.

The VMware Auditing page contains an expandable view of all the VMware Auditing templates that have been previously defined. To add a new template to this list, use the Add tool bar button. Once added, the following information is displayed for the template:

Template

Displays the name assigned to the template when it was created.

Status

Indicates whether the template is enabled or disabled. To enable/disable the template, place your cursor in this Status cell, click the arrow control and select the appropriate option from the drop-down menu.

Agent

Displays the name of the agent assigned to audit the selected VMware hosts.

User

Displays the name of the user being used to access the VMware hosts that are being audited.

VMware Hosts

This field is used for filtering data. Click the expansion box to the left of the Template name to expand this view and display additional details about an auditing template.

VMware Host

Displays the name or IP address of the vCenter Server™ or VMware host being audited, as entered on the first page of the wizard.

Status

Indicates whether auditing of the selected host is enabled or disabled.

Port

Displays the port number being used to access the selected vCenter Server or VMware host.


	NOTE: The cells directly under the main heading rows are used for filtering data. That is, as you enter characters into these cells, the client will redisplay the templates that meet the search criteria (For example, comparison operator and characters entered). For more details about using the data filtering function provided throughout Change Auditor, see the Change Auditor User Guide.

VMware Auditing templates

To enable VMware auditing, first create a VMware Auditing template which specifies the VMware hosts to audit and the agent used to monitor the selected VMware hosts.


	NOTE: If you add multiple machines (such as vCenter Servers and/or ESX hosts) to a single auditing template, all of these machines must use the same credentials. If you want to audit machines that use different credentials, you must create a different VMware Auditing template for each of these machines.

To create a VMware auditing template:

Open the Administration Tasks tab.

Click Auditing.

Select VMware (under the Applications heading in the Auditing task list) to open the VMware Auditing page.

Click Add to open the VMware Auditing wizard which will step you through the process of creating a VMware Auditing template.

On the first page of the wizard, enter the following information:

•

Template Name - Enter a name for the template.

•

VMware Host - Enter the IP address or name (the name entered must be resolvable) of the vCenter Server or of an individual host computer to be audited and click Add to add it to the VMware Host list.


	NOTE: To audit one or more hosts on a specific vCenter Server, use the Find ESX Hosts button to search for and select the ESX hosts to be audited. Clicking this button displays the Find ESX Hosts dialog, where you will be asked to enter the information/credentials for the vCenter Server for which you want to view ESX hosts. After entering the vCenter Server information/credentials, click Search to retrieve a list of hosts. Select one or more hosts from the list and click OK to save your selection and close the dialog. The selected hosts will now be displayed in the VMware Host list in the auditing wizard.

Repeat this step to add additional VMware hosts to the list.

Click Next to select the agent to be used for VMware auditing.

On the second page of the wizard, click Browse.

On the Eligible Change Auditor for VMWare Agents dialog, select the Change Auditor for VMWare agent to be used to monitor the selected VMware hosts.


	NOTE: The Change Auditor for VMWare agent must have access to the vCenter Server or VMware hosts selected on the first page of the wizard.

Once you have selected an agent, click OK to save your selection and close this dialog. Back on the wizard page, the agent information (Agent, Domain and Agent FQDN) is displayed for the selected Change Auditor for VMWare agent.

Click Set Credentials and enter the credentials to be used to access the selected vCenter Server or VMware hosts. After entering the credentials, click OK to close the credentials dialog.


	IMPORTANT: You can select an account with ‘Read-Only’ access or role (for restrictions) to properly audit VMware events. The credentials entered may be Active Directory or Linux credentials depending on the computer (vCenter Server vs. individual host computer) selected for auditing. If you specified multiple machines (for example, vCenter Servers and/or ESX hosts) in the auditing template, all of these machines must use the same credentials.

A desktop notification indicates whether access is granted or denied to the specified vCenter Server or VMware host based on the credentials entered.

When valid credentials are entered, a Certificate Notice is displayed for each computer selected for auditing. Click OK to accept the certificates. Once valid credentials are supplied and the certificates have been accepted, click Finish to close the wizard and create the template.

On the Administration Tasks tab, click Configuration. Select Agent in the Configuration task list to open the Agent Configuration page.

Select the agent assigned to the VMware Auditing template (Auditing appears in the VMware column) and click Refresh Configuration to ensure the agent is using the latest configuration.


	NOTE: If you do not refresh the agent’s configuration, the agent will automatically check for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.

To disable a VMware Auditing template:

On the Auditing page, use one of the following methods to disable an auditing template:

•

Place your cursor in the Status cell for the template to be disabled, click the arrow control and select Disabled.

•

Right-click the template to be disabled and select Disable.

The entry in the Status column for the template will change to ‘Disabled’.

To re-enable the auditing template, use the Enable option in either the Status cell or right-click menu.

To disable auditing for an individual VMware host:

On the VMware Auditing page, use one of the following methods to disable the auditing of a VMware host:

•

Place your cursor in the Status cell for the host to be disabled, click the arrow control and select Disabled

•

Right-click the host to be disabled and select Disable

The entry in the Status column for the host will change to ‘Disabled’.

To re-enable the auditing of a host, use the Enable option in either the Status cell or right-click menu.

To delete a VMware Auditing template:

On the Auditing page, select the template to be deleted and click Delete | Delete Template.

A dialog will be displayed confirming that you want to delete the selected template. Click Yes.

VMware Auditing wizard

The VMware Auditing wizard is displayed when you click Add or Edit on the VMware Auditing page. From this wizard, specify the VMware hosts to be audited and the Change Auditor for VMWare agent to be used to monitor the selected VMware hosts.

The following table provides a description of the fields and controls in the VMware Auditing wizard.


	NOTE: A red flashing icon indicates that you have not yet entered the required information. Hovering your cursor over this icon displays a tool tip explaining what needs to be entered.

Table 1. VMware Auditing wizard

Create or modify a VMware Auditing Template page

Use the first page of the wizard to enter a name for the template and select the VMware hosts to be audited.

Template Name

Enter a descriptive name for the VMware auditing template.

VMware Host

Enter the IP address or name (must be resolvable) of the vCenter Server or of a VMware host that is to be audited.

Add

After entering the IP address or name of a host in the VMware Host text box, click e Add to add the host to the VMware Host selection list.

Find ESX Hosts

Clicking this button displays the Find ESX Hosts dialog allowing you to search a vCenter Server to select the ESX hosts that are to be audited. On this dialog, enter the IP address or name (and port) of the vCenter Server for which you want to view ESX hosts. Click Search to retrieve a list of hosts on the selected vCenter Server. Select one or more hosts from the list and click OK to save your selection and close the dialog.

Remove

To remove a host from auditing, select it in the VMware Host selection list and click Remove to the right of the list box.

VMware Host selection list

This list box displays the following information about the VMware hosts selected for auditing.

•

VMware Host - Displays the IP address or name of the host selected for auditing.

•

Port - Displays the port to be used for communication. This will display the default SSL port (443). If this is not the correct port number for a host, use the arrow controls to change it.

Select Change Auditor for VMWare Agents page

Use the second page of the wizard to select the agent to be used to monitor the selected VMware hosts and to enter the credentials to be used to access the VMware hosts.

NOTE: If you select multiple hosts in an auditing template, all of the hosts selected must use common credentials.

Browse

Displays the Eligible Change Auditor Agents dialog allowing you to select an agent from the list of deployed agents.

NOTE: The Eligible Change Auditor for VMWare Agents dialog only lists eligible servers running .NET 4.5.2 Framework, which is a requirement for the agent selected to audit VMware.

Once an agent is selected the following details are displayed:

•

Agent

•

Domain

•