Change Auditor 7.3 - User Guide

Origin tab

The Origin tab allows you to search for events based on the workstation or server where the event originated. When multiple ‘origin’ criteria is specified on this tab, Change Auditor uses the ‘OR’ operator to evaluate change events, returning events that originated from any of the specified workstations or servers.

The Origin tab contains the following information and controls:

Table 6. Origin tab: Field and control descriptions
Field and Control	Description
Runtime Prompt	Select this check box to prompt for the originating workstation or server whenever the search is run. That is, when Run is selected, the Add Origin dialog is displayed allowing you to enter the wildcard expression to locate a specific workstation or server. NOTE: When this check box is checked, Add is deactivated. NOTE: You cannot enable alerting for search definitions that use the Runtime Prompt option.
Exclude the Following Selection(s)	Select this check box to specify the workstations or servers to exclude from the search. That is, Change Auditor will return events originating from all workstations and servers except those listed in the Origin list.
Origin list	By default, all events regardless of where they originated are included in a new search and therefore this list box is initially empty. Once criteria is selected, this list box contains the wildcard expression used to locate the workstations and servers to include in the search (or excluded from the search if the Exclude the Following Selection(s) option is checked).

To search for events based on where they originated:


	NOTE: By default, all events regardless of the workstation or server from which it originated are included in the search.

Open the Origin tab.

Click Add.

Enter the wildcard expression to use to search for a workstation or server, based on its NetBIOS name or IP address:

•

Select the comparison operator to use: Like or Not Like.

•

In the field to the right, enter the pattern (character string and * wildcard character) to be used to search for a match. Use the * wildcard character to match any string of zero or more characters.

After entering the wildcard expression to use, click OK to close the dialog and add the wildcard expression to the ‘origin’ list.

When this search is run, Change Auditor searches for change events originating on workstations and servers whose name or IP address matches the specified wildcard expression.


	NOTE: You can use Add with Events (instead of Add) to select a workstation or server that already has an event associated with it in the database. The workstations and servers available for selection are based on the ‘when’ clause (When tab) and the search limit (Info tab) specified for the current search.

Alert tab

The Alert tab allows you to enable alerting and define how and where to dispatch alerts. See Alert tab (Search Properties tabs) for a detailed description of the contents of this tab.

Report tab

The Report tab allows you to enable reporting and define when and where to send a report. Reports can be sent to email addresses and shared folders. See Report tab (Search Properties tabs) for a detailed description of the contents of this tab.

Layout tab


	NOTE: In previous versions of Change Auditor, this tab was referred to as the Advanced tab.

Using the Layout tab, you can define the data (columns) to be retrieved from the database and displayed for the selected search. You can also define the column order, sort criteria and order, groupings and the format to use for displaying the retrieved data. The layout defined on this tab is used for both displaying the search results in the client and for the report layout when reporting is enabled on the Report tab.

The Layout tab contains the following information and controls:

Table 7. Layout tab: Table and Control descriptions

Table

Description

Unselected Columns

Displays the event details that can be retrieved from the database.

Selected Columns

Displays the event details that are being retrieved from the database. It also displays the order in which the columns will be presented, that is, the top entry will be the left-most column in the search results grid/report.

To add and remove columns from this table, use the buttons to the left of the table:

•

Right arrow adds the column selected in the Unselected Columns table to the Selected Columns table.

•

Left arrow removes the column selected in the Selected Columns table, moving it back to the Unselected Columns table.

To rearrange or sort the columns for display, use the buttons to the right of the table:

•

Up arrow moves the selected column up in the list.

•

Down arrow moves the selected column down in the list.

•

Right arrow adds the selected column to the Sort Criteria table. This column is placed after the column selected in the Sort Criteria table.

•

Left arrow removes the column selected in the Sort Criteria table from the sort criteria.

•

Arrow in a square resets the Selected Columns table back to the factory defaults.

Sort Criteria

Defines the criteria to use to sort the search results, including:

•

Order By — specifies the columns to use to sort the data. The primary sort criteria is listed first.

•

Direction — specifies whether to present the data in descending or ascending order

•

Group By — indicates whether to also use the column to group the data

To rearrange the sort criteria, use the buttons to the right of the table:

•

Up arrow moves the selected column up in the list.

•

Down arrow moves the selected column down in the list.

•

Arrow in a square resets the Sort Criteria and Display Results tables back to the factory defaults.

Search Results

Specifies the format to use dto display the search results on the Search Results page.

When a grouping is defined, select one of the following options:

•

In a Grid (default)

•

As a Pie Chart

•

As a Bar Graph

NOTE: These options are only available when a single level of grouping is defined (that is, only one column contains a Yes in the Group By column of the Sort Criteria table).

NOTE: The options in this table apply only to the search results in the client; they do not apply to reports.

To customize what is displayed for the selected search:

Open the Layout tab.

Review the columns listed in the Selected Columns table (second table from the left) to determine if it contains the information you want to display for the selected search.

To add a column, select the column from the Unselected Columns table and click the right arrow button (located between the first two tables) to move it to the Selected Columns table.

You can also ‘drag’ a column to the Selected Columns table.

To remove a column from display, select the column from the Selected Columns table and click the left arrow button (located between the first two tables) to move it back to the Unselected Columns table.

You can also ‘drag’ a column back to the Unselected Columns table.

The Selected Columns table also displays the order the columns will be presented. To rearrange the columns, in the Selected Columns table select the column to be moved and click the up or down arrow button (located to the right of the Selected Columns table) to move the selected column to the desired location. The top entry will be the left-most column in your display or report.

You can also ‘drag’ columns in this table to define the order.


	NOTE: To reset the column selection and arrangements in the Selected Columns table back to the factory defaults, click the restore button located next to the lower right-hand corner of this table.

The Sort Criteria table (third table) defines the order to use to sort the search results. To define the sort criteria for your search results, select a column in the Selected Columns table and click the right arrow button (located to the right of the Selected Columns table) to move it to the Sort Criteria table.

To specify secondary sort criteria, add the additional column to the Sort Criteria table. Use the arrow controls to the right of the Sort Criteria table to define the primary (first column in list) and subsequent sort criteria.

You can also ‘drag’ columns between the Selected Columns and Sort Criteria tables and within the Sort Criteria table to define the sort criteria.

To change the direction, ascending or descending, select a column in the Sort Criteria table, click in the Direction cell, and select either ascending (ASC) or descending (DESC) from the drop-down menu.

In addition, you can use the Group By column to define groupings. To group the selected search’s results, select the column to use for the grouping, click in the Group By cell and select Yes from the drop-down menu.

When a single level of grouping is defined (only one column contains a Yes in the Group By column of the Sort Criteria table), you can select one of the following options in the Display Results table to define the display format to use for the selected search:

•

In a Grid (default)

•

As a Pie Chart

•

As a Bar Graph


	NOTE: The settings in the Search Results table do not apply to reports.


	NOTE: To reset the settings in the Sort Criteria table and Search Results table back to the default settings, click the restore button located next to the lower right-hand corner of the Sort Criteria table.