How to Configure Alerts for Change Auditor Agent Connectivity and Health Events (4383629)

In Change Auditor, monitoring the health and connectivity of agents is critical to ensure continuous auditing and event collection.

Administrators can configure alerts for specific agent-related events to proactively detect issues such as disconnections, heartbeat failures, or service interruptions.

This article outlines the agent events available and provides step-by-step instructions to configure alert notifications.

By default, agent-related events may not trigger alerts unless a custom search with alerting is configured. This can result in delayed awareness of agent issues such as:

• Loss of communication with the coordinator
• Agent service stoppage or restart
• Failure to send events (lost heartbeat)

Agent Events Available for Alerting

The following Change Auditor events can be used to monitor agent health:

1. Change Auditor Agent connected
2. Change Auditor Agent disconnected
3. Change Auditor Agent lost heartbeat
4. Change Auditor Agent started
5. Change Auditor Agent stopped
6. Change Auditor Agent restarted

Steps to Configure Alerts

1. Open the Change Auditor Client.
2. Navigate to the Searches tab.
3. Right-click the desired folder and select New Search.
4. Go to the What tab.
5. Click Add → select Event Class.
6. In the Event Class filter, type:

   change auditor agent
   

7. Select the required agent events (e.g., disconnected, lost heartbeat) and click Add.
8. Click OK to confirm the selected events.
9. Navigate to the Alert tab.
10. Enable SMTP alerting.
11. In the To field, enter the recipient email address(es).
12. Click OK.
13. Enable Alert Enabled.

Outcome

Once configured, Change Auditor will send alerts when selected agent events occur, allowing administrators to:

• Detect agent disconnections in real time
• Identify systems that are no longer reporting events
• Proactively troubleshoot agent or communication issues
• Maintain auditing continuity and compliance