Change Auditor 7.3 - User Guide

Use the View | Statistics | Agent menu command (or Ctrl+F11) to display the Agent Statistics page, which provides a global view of all installed agents. This page contains the following components:

•

Agent Statistics grid, located at the top of the page, consists of a list of agents and their current status and usage statistics.

•

Resource Properties pane, located across the bottom of the page, displays additional information about the selected agent.

Agent Statistics grid


	NOTE: When agents are connected or disconnected, an Agent Status message will be displayed in the lower right corner of your screen. You can use the View Agent Statistics link in this message box to display the Agent Statistics page.

The Agent Statistics grid may contain the following information for each agent. The default column identifies the fields that are displayed by default. To display different fields, click the Field Chooser button located to the far left of the column headings and select the columns to be displayed:


	NOTE: All dates and times are based on the client’s current local date and time. The format used to display the date and time is determined by the local computer’s regional and language setting.

Table 1. Agent Statistics page: Field descriptions

Indicates whether custom Active Directory auditing or protection has been defined.

ADAM

Indicates whether custom ADAM (AD LDS) auditing or protection has been defined.

Agent

Yes

Displays the NetBIOS name of the server that hosts a Change Auditor agent.

Agent FQDN

Displays the fully qualified domain name of the agent.

Architecture

Displays whether the agent is installed in a 32-bit (x86) or 64-bit (x64) environment.

Configuration

Displays the agent configuration assigned to the agent.

Coordinator

Displays the computer name of the Change Auditor coordinator(s) to which the agent is connected.

DB Size

Yes

Displays the size of the agent database.

Domain

Yes

Displays the name of the domain where the agent is located.

EMC

Indicates whether the agent is assigned to an EMC Auditing template to capture EMC events.

Events Last 24 Hours

Displays the number of events encountered on the agent during the past 24 hours from when the dialog is initially opened during the current client session.

The value in this field is a hypertext link and when selected launches a quick search to display the events generated in the last 24 hours.

Events Last Hour

Displays the number of events encountered on the agent in the last 60 minutes from when the dialog is initially opened during the current client session.

The value in this field is a hypertext link and when selected launches a quick search to display the events generated in the last 60 minutes.

Events Today

Yes

Displays the number of events encountered on the agent since 12:00 a.m. of the current day (based on the relative coordinator computer's time).

The value in this field is a hypertext link and when selected launches a quick search to display the events generated today.

Events Total

Yes

Displays the number of events encountered since the agent was started.

The value in this field is a hypertext link and when selected launches a quick search to display all events encountered since the agent was started.

Events Yesterday

Displays the number of events encountered between 12:00 a.m. yesterday and 12:00 a.m. of the current day (based on the relative coordinator computer's time).

The value in this field is a hypertext link and when selected launches a quick search to display the events generated yesterday.

Exchange

For agents hosting Exchange, this column indicates whether Exchange Mailbox auditing or Exchange Mailbox protection has been defined.

Exchange Server

Indicates whether the server is an Exchange Server.

Exclude Account

Indicates whether an Excluded Accounts Auditing template has been assigned to the agent’s configuration.

File System

Indicates whether a File System Auditing template or File System Protection template has been assigned to the agent’s configuration.

Forest

Displays the name of the forest where the agent resides.

Group Policy

Indicates whether Group Policy protection has been defined.

IP Address

Displays the IP address of the agent.

Last Update

Yes

Displays the date and time when the agent configuration was last updated.

Load

Yes

Displays the load status of the agent service in regards to processing events. Valid entries are:

•

Normal - agent service is running and processing events as expected

•

Medium - agent service has more than 100 events waiting

•

Critical - agent service has reached a critical load and events may be missed

•

Unknown - agent service is inactive; therefore, the load is unknown

NetApp

Indicates whether an agent is assigned to a NetApp Auditing template to capture NetApp filer events.

Registry

Indicates whether a Registry Auditing template has been assigned to the agent’s configuration.

Service

Displays whether a Service Auditing template has been assigned to the agent’s configuration.

SharePoint

Indicates whether an agent is assigned to a SharePoint Auditing template to capture SharePoint events.

SQL

Indicates whether a SQL Auditing template has been assigned to the agent’s configuration.

Startup Time

Displays the date and time when the agent was last initialized.

Status

Yes

Displays the current status of the agent:

•

•

•

Displays the agent platform:

•

•

•

•

Displays how long the agent has been running.

Version

Displays the version number of the agent currently deployed.

Workstation

Indicates whether this is a workstation agent.

In addition to selecting the fields to display, you can use the drop-down controls to define what servers/workstations are to be included on the Agent Statistics page.

The following table describes how to use these controls to filter the content displayed on the Agent Statistics page.

Table 2. Agent Statistics page: Filter controls

Control

Description

Type

Use the left-most control to specify the type of objects to be included in the display:

•

All - select to view all agented servers and workstations (default)

•

DCs - select to view agented domain controller servers

•

Servers - select to view agented servers regardless of domain membership

•

Workstations - select to view agented workstations (including workstations joined to the domain and workstation agents manually installed on non-Active Directory computers)

Active Directory view

By default, the Agent Statistics page provides a forest view of the servers found. However, you can use the right-most controls to limit your view to an individual domain or site.

Use the middle control to select the Active Directory view (forest, domain or site) then use the right-most control to select an individual forest, domain or site for which servers are to be displayed.

Resource Properties pane

The Resource Properties pane located across the bottom of the Agent Statistics page contains additional information about the agent selected in the Agent Statistics grid.

To display the Resource Properties pane:

To display this pane, select an agent from the Agent Statistics grid and click Show Properties.

Use the hide button in the upper right-hand corner of the Resource Properties pane to hide this pane.


	NOTE: The Resource Properties pane also appears when you select Related Search \| View Resources on an Event Details pane. When accessed using the Event Details pane, the additional information is for the server referenced in the selected event.

The Resource Properties pane is divided into the following tabbed pages:

•

•

•

•

•

•