Change Auditor 7.5 - User Guide

Troubleshooting steps

Troubleshooting steps

If the SharePoint events do not appear as expected, check the following:

•	Review the SharePointPluginCA.Log.nptlog for any errors and to verify that the SharePoint plug-in process is running.

•	Verify that a SharePoint Web Front End server is assigned to audit the farm.

•	If you are not getting some events (e.g., restore events, permission events, etc.) from a specific site, verify that system provided auditing is enabled for that SharePoint site. See System provided auditing.

•	If you are not getting versioning events, verify that versioning is enabled for that type of object in SharePoint. See Versioning.

•	Verify that the user account being used to access the SharePoint farm has the following permissions:

▪	Local Administrator on the Change Auditor Agent\SharePoint Central Administration server

▪	SharePoint Farm Administrator

▪	The following mappings on the SQL Server that contains the SharePoint databases:

▫	SharePoint_Config

-	SharePoint_Shell_Access

-	SPDataAccess

▫	WSS_Content

-	SPDataAccess

▫	SharePoint_AdminContent

-	SPDataAccess

•	If you get an access denied error when attempting to add a personal site to the SharePoint Auditing wizard, verify that the account being used by the selected agent has been added to the User Web Policy for the site. See MySite Site Collection.

•	Verify that you have included the correct SharePoint paths for auditing. (Paths listed across the middle of the first page of the SharePoint Auditing wizard.)

•	Verify that you have not excluded the specified paths from auditing. (Paths listed at the bottom of the first page of the SharePoint Auditing wizard.)

•	Verify that you have selected those types of events in the SharePoint auditing template. (Facilities and/or event classes specified in the SharePoint Auditing wizard.)

•	Verify that the events selected for auditing are enabled. (Use the Audit Events page on the Administration Tasks tab.)

•	Verify that the Change Auditor SharePoint Solution has been successfully deployed. See Verify deployment status of Change Auditor SharePoint Solution.

•	Refresh the specified agent configuration on the Agent Configuration page to ensure the latest SharePoint auditing template is being used. See Verify auditing template is applied.

SharePoint Auditing

SharePoint Auditing

•	Introduction

•	SharePoint Auditing page

•	SharePoint Auditing templatesSharePoint Auditing wizard

•	SharePoint event logging

Introduction

Introduction

The SharePoint Auditing page on the Administration Tasks tab displays details about each SharePoint auditing template created and allows you to add new auditing templates or modify and delete templates.

NOTE: Each SharePoint farm to be audited requires its own SharePoint Auditing template.

SharePoint Auditing page

SharePoint Auditing page

The SharePoint Auditing page displays when SharePoint is selected from the Auditing task list in the navigation pane of the Administration Tasks tab. From this page, you can start the SharePoint Auditing wizard to specify the SharePoint farm and paths to audit. You can also edit existing templates and remove templates that are no longer being used.

 

NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on this page, see the Change Auditor User Guide for more information about how to gain access.

The SharePoint Auditing page contains an expandable view of all the SharePoint Auditing templates that have been defined. To add an template to this list, use the Add toolbar button. Once added, the following information is provided for each template:

Farm

Displays the name and GUID of the SharePoint farm specified in the wizard.

Status

Indicates whether the auditing template is enabled or disabled.

Operations

Displays the events selected for auditing on the second page of the wizard. Hover your mouse over this cell to view all the events included in the template.

Agent

Displays the name of the agent assigned to audit the SharePoint farm.

Paths

This field is used for filtering data.

Click the expansion box to the left of the Farm name to expand this view and display the following details for each template:

Title

NOTE: The cells directly under the main heading rows are used for filtering data. That is, as you enter characters into these cells, the client redisplays the templates that meet the search criteria (that is, comparison operator and characters entered). For more details about using the data filtering function provided throughout the client, see the Change Auditor User Guide.

Displays the name assigned to the SharePoint component being audited.

Status

Indicates whether auditing for the selected audit path is enabled or disabled.

Path

Displays the audit path of each SharePoint component to be audited.

Exclude

Displays the SharePoint paths that have been excluded from auditing as specified at the bottom of the first page of the wizard.