• ポータルについて詳しく知る
• ダウンロード
• 印刷
• MY ダウンロード ()

• サポート
• 技術文書
• Change Auditor 7.4
• Change Auditor 7.4 - User Guide

Change Auditor 7.4 - User Guide

コンテンツのナビゲーション  

Change Auditor Overview

Available Change Auditor auditing modules

Agent Deployment

Deployment page Using group Managed Service Accounts (gMSA) Deploy agents Connect to a different foreign forest/update credentials Change the agent installation location and system tray option Enable auto deployment Refresh or clear Deployment page information

Change Auditor Client Overview

Starting the Change Auditor client Accessing Change Auditor news and updates Managing connection profiles

Connection wizard

Client components Customize table content

Sort data Resize or move columns Add or remove columns Group data

Filter data

Using custom filters

Directory object picker

Overview Page

Overview My Favorite Search Define a favorite search Overview panes

Top Agent Activity Recent Event Activity Count of Events By Agent Status Coordinator Status

Event Details pane

Searches

Introduction Searches page

Explorer view Searches list Search Properties tabs

View a list of available searches Run searches Run a quick search

Search Results and Event Details

Introduction Search Results page

Search Results grid Search Properties tabs Event Details pane

View search results

Display results in different formats

Preview search results Compare results side-by-side View event details or search properties Copy event details Email event details Add comments View user context and run related searches Protect critical objects, mailboxes, files and folders Add search properties to existing event queries

Custom Searches and Search Properties

Introduction Create a custom search Search Properties tabs

Info tab Who tab What tab Where tab When tab Origin tab Alert tab Report tab Layout tab SQL tab XML tab

Enable Alert Notifications

Introduction Alert tab (Search Properties tabs) Enable alerts Disable alerts Alert History page View alert history View event details or alert properties

Administration Tasks

Administration Tasks tab Administration Task lists Export/import Administration Task settings

Agent Configurations

Introduction Agent Configuration page Define agent configurations Assign agent configurations to server agents Enable event logging

Coordinator Configuration

Coordinator Configuration page Configure email alert notifications/reports Customize alert email content Shared Folder Configuration Group Membership Expansion Add groups to Group Membership Expansion list Agent Heartbeat Check Disconnect client after 30 minutes of inactivity Scheduled Task Handling

Purging and Archiving your Change Auditor Database

Introduction Planning your jobs Purge and Archive page Create and maintain jobs Purge and Archive wizard Purge selected records

Disable Private Alerts and Reports

Introduction Private Alerts and Reports page Disable private alerts and reports

Generate and Schedule Reports

Schedule reports for distribution

Create global report template Define report content and layout Enable and schedule reporting

Launch Report Designer Publish reports Print or save a page's contents

SQL Reporting Services Configuration

Introduction SQL Reporting Services Page SQL Reporting Services Templates SQL Reporting Services Wizard

Change Auditor User Interface Authorization

Introduction Application User Interface Authorization page Add task definition Add role definition Add application group Remove a task definition

Client Authentication

Introduction Client Authentication Page

Changing authentication methods

Certificate authentication for client coordinator communication

Introduction

Installation settings Deployment Coordinator configuration Windows client configuration

Integrating with On Demand Audit

Managing a Quest On Demand Audit integration

Creating an On Demand Audit configuration Working with an On Demand Audit configuration

Enable/Disable Event Auditing

Introduction Audit Events page Enable/disable event auditing Modify event's severity level or event class description Define events to be captured based on results View event information

Account Exclusion

Introduction Excluded Accounts Auditing page Excluded Accounts templates Excluded Accounts wizard

Registry Auditing

Introduction Registry Auditing page Registry Auditing templates Registry Auditing wizard

Service Auditing

Introduction Services Auditing page Service Auditing templates Service Auditing wizard

Agent Statistics and Logs

Introduction Agent Statistics page

Agent Statistics grid Resource Properties pane

Machine Info page Processors page Drives page Shares page Services page Exchange Mailboxes page

Agent system tray icon

Change Auditor Agent Status dialog

View agent status/statistics Manage Change Auditor agents Agent Log page View and save agent trace logs

Coordinator Statistics and Logs

Introduction Coordinator Statistics page Coordinator system tray icon

Change Auditor Coordinator Status dialog Coordinator Configuration tool

View coordinator status and statistics Manage Change Auditor coordinators Coordinator Log page View and save coordinator trace logs

Change Auditor Commands

Menu commands Tool bar buttons Right-click commands

Change Auditor Email Tags

• Viewing Topics 105 - 108 of 203

×

Purging and Archiving your Change Auditor Database

•	Introduction

•	Planning your jobs

•	Purge and Archive page

•	Create and maintain jobs

•	Purge and Archive wizard

•	Purge selected records

Introduction

Change Auditor provides several options to schedule both the purging of events from your database and archiving older data to an archive database. Automating database cleanup allows you to keep critical and relevant data online and current while eliminating or archiving events that are no longer required. This not only prevents your database from growing in size, but it increases overall operational efficiency by speeding up searches and data retrieval from the database.

Using the purge options, you can define and schedule jobs that will eliminate events from the database based on the following criteria:

•	All events older than a specific number of days.

•	Selected events based on:

•	Who - purge events generated by a specific user, computer or group.

•	What - purge events based on subsystem, event class, object class, severity or results.

•	Where - purge events captured by a specific agent, domain or site.

•	Origin - purge events originating from a specific workstation or server.

Using the archive options, you can select to create a yearly archive database for older events that are no longer required to be represented in your reports.

Table 1. Archive and purge options

Job type	Description
	This deletes events from the production database. You can create and run multiple purge jobs. When scheduling a purge job, you can choose a batch limit. This limit tells the job how many events to delete from the production database before pausing and running another job. Choosing too large of a batch limit may slow your purge jobs down. If you find that they are slow reduce the batch limit.
Archive	This moves events from the production database to an archive database (on the same database server). The archive process removes the events from the production database during the move. Archive events do not need to be purged separately. You can only create and run one “archive” job or one “purge and archive” job. When scheduling an archive job for the first time it may take a long time to complete (depending on how many years of data you are asking to be archived). Batch limit does not apply to an archive type job. When running an archive job, you need to pay attention to disk space growth on the SQL server.
Purge and archive	This deletes events (purge job) from the production database, then immediately performs an archive job to move the remaining records in the time period specified for the job from the production database to an archive database. You can only create and run one “purge and archive” job or one “archive” job. If you select a batch limit, it will only apply to the purging portion of the job. When the batch limit is reached, the job will immediately run again ensuring this job type runs to completion before the archive job begins.

Planning your jobs

Planning your jobs

Planning your jobs before scheduling them will help ensure they run as expected. Keep in mind, all jobs can take a significant time to run depending on the amount of data in your environment.

Scheduling a job

When scheduling your jobs, consider the following:

•	Only one job can run at a time.

•	Only one archive type job (archive only, purge/archive) can exist. However, multiple purge only jobs can be scheduled.

•	Purge only jobs run until they reach the batch limit. When the batch limit is encountered the job pauses (runs again later) to give another job a chance to run. Archive type jobs will not pause to give other jobs the opportunity to run until they are complete.

•	If you have multiple coordinators, only one coordinator will run the job.

•	Use “purge and archive” job to ensure deletion of unwanted events completes before archiving begins.

•	The first time the job is run it may be working with a large amount of data and therefore may take a significant amount of time to run.

•	It is recommended to run jobs frequently so that they are working with less data and complete faster. Start with one job to see how long it takes to complete, then add more jobs as needed.

•

If an archiving job is created to archive large amounts of data over multiple calendar years, it may take a significant amount of time to finish. If you have multiple calendar years of data to archive, select to archive the oldest calendar year first. When the first archive job finishes, update the job settings to archive the next calendar year and so on until all the data has been archived.

•	Enable notification on the purge and archive internal events to monitor job performance.

•

Starting with version 6.9, Change Auditor the Next Run of the reports, archive and purge jobs based on the master time zone. For new deployments, the maser time zone is set to the time zone of the server where the first coordinator is being installed. During an upgrade, the master time zone is set to UTC. You can manually change the master time zone, using the set-CAScheduleMaserTimeZone and get-CAScheduleMasterTimeZone commands. See the Change Audit PowerSell Command User Guide for details.It is recommended to set the master time zone to the time zone where the majority of the users are located.

NOTE: Due to the fact that Daylight Saving Time changes on different dates worldwide, Change Auditors schedules will follow the time change of that specific time zone.

When multiple jobs types are scheduled to run close together the following behavior will occur:

•	A list of jobs is created and ordered by next run time. If two jobs have the same run time the archive type will run first.

NOTE: Because of this the “purge” jobs may not complete before the “archive” or “purge and archive” jobs run if you do not plan properly.

•	Multiple “Purge” jobs will be run based on the next run time order.

•	The “purge” job type runs until the batch limit is reached (batch limit is the total number of events to delete) and then pauses to give another “purge” job a chance to run.

During a job

During a purge and/or archive job, consider the following:

•	Use internal events to monitor job performance .

•	Monitor disk space on the SQL server while archiving is in progress. (No Shrink is performed)

Post job considerations

After the purge and/or archive job completes, consider the following:

•	The physical database size is not changed. (Shrink operation is not performed). Once the archive database has been created, you should perform a database cleanup (shrink) on the production database as required to free up disk space.

For information on how to perform a database shrink, see https://msdn.microsoft.com/en-us/library/ms189035.aspx.

•	Multiple archive databases may be created (1 database per archived year).

•	Archive databases for previous years can be detached and moved to a backup storage if needed.

Purge and Archive page

The Purge and Archive page is displayed when Purge and Archive is selected from the Configuration task list in the navigation pane of the Administration Tasks page. From here you can specify the settings for the purge and archive jobs.

Before creating your jobs, ensure that you have reviewed Planning your jobs.

Once a job is defined, the page displays the following details:

Table 2. Purge and Archive page: Field descriptions

Column	Description
Job Name	Displays the name assigned to the job when it was created using the Purge and Archive wizard.
Last Run	Displays the date and time the job last ran. NOTE: Based on the client’s current local date and time. The format used to display this date and time is determined by the local computer’s regional and language setting.
Next Run	Displays the date and time the job is scheduled to run next. NOTE: Based on the client’s current local date and time. The format used to display this date and time is determined by the local computer’s regional and language setting.
Status	Indicates whether the job is enabled or disabled.
Schedule	Displays the schedule defined for running the job.

You will also see information regarding the status of reach job including:

•	When the job was run.

•	The duration of the job.

•	The number of events processed.

•	The coordinator involved in the process.

•	Informational messages as to the status if the job:

Immediately continuing job: Displays when the purge portion of a ‘purge and archive’ job continues.

Archive database not found. Recreating archive database: Displays if an archive database has been moved or deleted.

Starting job: Displays when the purge, archive, or purge and archive job is beginning.

Successfully finished job: Displays when the purge and archive, purge, or archive job is finished.

New archive database created: Displays when the new archive database has been created for the calendar year.

Events archived: Displays the progression of the number of events being archived.

Total events archived: Displays the total number of archived events when archiving is finished.

Continue purge job: Displays when re-queued purge jobs run again.

•  前回
• Viewing Topics 105 - 108 of 203
• 次へ 

この文書を検索 この製品バージョンに対応するすべての文書を検索 この製品に対応するすべての文書を検索 すべての文書を検索

×

 サポートへようこそ

Quest *product*のオンラインサポートヘルプは、関連会社のサポートサイトで参照できます。「Continue（続行）」をクリックすると、*product*の適切なサポートコンテンツとアシスタンスへ移動します。

関連ドキュメント

The document was helpful.

評価を選択

I easily found the information I needed.

評価を選択

© 2024 Quest Software Inc. ALL RIGHTS RESERVED. 利用規約 プライバシー Cookie Preference Center