How to enable File System Auditing on File server using Change Auditor (4372967)

How to enable File System Auditing on File server using Change Auditor

This video provides a step-by-step guide on how to enable file system auditing in Quest Change Auditor. The steps include checking the availability of the license, verifying the agent status on the file server, creating a file system auditing template, creating a configuration and assigning it to the file server, and creating a search to define the audit scope and events to be monitored. The video also demonstrates these steps in a practical example.

File System Audit 

Please follow below steps to audit any File server:

1. Please make sure you have Change Auditor for File Server license is installed in Change Auditor.
2. Check if Change Auditor agent is installed on that server and Change Auditor agent service is up and running.
3. Next, we need to create File system audit template in which we specify the path we need to audit - that should be always local path to that server, which events we need to audit and any specific exclusions that we do not need to audit if any.
For this to achieve, follow below steps:
Go to Client - View - Administration and in opened Administration Task window, go to Auditing - Server - File System
Click Add.
In newly opened window, give your template name and select the local path of File server where Files are located.(If any specific file, select file and if files are located under specific folder, select folder button)
Click Add.
Under File system auditing Events
Next and in next screen, type *.* and click OK.
Click Next and Finish.
4. Nest step, we should create configuration by enabling the template that we created.
In order to do so. Go to Configurations, Add that configuration with any name. Go to right side on the same screen and click Yes instead of No for that template that you just created.

Click Apply and OK.

5. Assign this configuration to specific file server that we need to audit. Simply Right click File server - Assign and select that configuration and Refresh the screen.

6. Next, create search and Run it.
Go to Searches - New Search and under What - Add with down arrow - Subsystem - File systems and in newly opened window, give local path to that server and click OK.
Save this Search and Run.
As per your requirement, give time range for which you need report. You can simply go to When and select time range.
Please refer below video that can show you how to perform above steps:

For further details check out our product page.
https://www.quest.com/change-auditor/