What is the difference between the WHO and the WHAT tabs in a Search?
Who and What section doesn't have any similarities because they may be used in combination to obtain a result. The details of the Who and What are listed below.
Who Tab
Use the Who tab to view or define the users, computers and/or groups to be included in (or excluded from) the search definition. When multiple ‘who’ criteria is specified on this tab, Change Auditor uses the ‘OR’ operator to evaluate events, returning events for activity performed by any of the users, computers or groups listed.
NOTE: You can add a Group to a search to find all events made by the members of that group. Change Auditor must expand and store the membership of the group before all expected events are returned when the search is executed. When the search is saved, Change Auditor will expand the Group if it has not already been expanded. This may take several minutes, depending on your environment.
NOTE: Activity performed by any accounts specified in an Excluded Accounts template will not be captured for the agents to which this template is assigned. Thus, Change Auditor will not return any events for these excluded accounts even if you specify them in the ‘who’ search criteria.
What tab
Use the What tab to define 'what' entities are to be included (or excluded) in the search. More specifically, using this tab you can create a search for events based on:
When criteria is specified on the What tab, Change Auditor will retrieve only those events that match the criteria listed on the What tab. When multiple ‘what’ criteria is specified on this tab, Change Auditor uses the ‘AND’ operator to evaluate an event and returns only those events that meet all the specified criteria. However, when multiple subsystems (for example, Active Directory, ADAM and Exchange) are specified, Change Auditor uses the ‘OR’ operator to evaluate these entities, returning events that meet any of the specified subsystem criteria. This also applies when multiple event classes are specified. That is, when multiple event classes are specified, Change Auditor uses the ‘OR’ operator and returns any of the specified events.
By default, all events will be included in a new search definition and therefore the list box on the What tab will be empty. Once criteria is added, the list box contains an expandable view displaying the criteria defined for the search definition.
