Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Change Auditor - For Advanced Users 7.4 - Technical Insight Guide

Table of Contents

Change Auditor Services

Quest Change Auditor Coordinator Quest Change Auditor Workstation Agent Quest Change Auditor Agent Change Auditor for EMC

Change Auditor licensing processes

License check process Component licensing User counts

Component Start-up Considerations

Start up delays

Change Auditor network communications

Service Connection Points

CN=ChangeAuditor.Coordinator

Ports and protocols Network encryption

SMB protocol and share encryption Secure password storage Client to coordinator connection Agent to coordinator connection (version 6.x and 7.0.1) Agent to coordinator connection (version 7.0.2) Coordinator to SQL Server connection

Coordinator internal tasks

Forest topology collection Group expansion Alert processing License check Remote deployment Foreign Agent Credentials Agent heartbeat check Refresh coordinator statistics Event aggregator SQL upgrade monitor Open handle Scheduled purge job Scheduled archive job Scheduled report job

Registry Settings

Force agent WCF port Force client port Force SDK port Use predefined GC for name resolution Allow collation switch Report zip limit SQL command timeout Enable ChangeAuditor Agent service to start with the Microsoft security update (KB2264107) Adjust memory dumps settings

Change Auditor built-in fault tolerance Change Auditor protection

Using multiple protection templates

How access rules are evaluated How scheduling and location works with denied access

Database Considerations

How to move the Change Auditor database and coordinator to another server How to estimate the required SQL server disk space How SQL Server Autogrow affects Change Auditor How to query an archive database

Account exclusions best practices

Change Auditor for EMC

Table 4. Quest Change Auditor for EMC service
Service Name	QCeeService
Display Name	Quest Shared EMC Connector
Description	This shared component enables auditing of EMC devices by Quest products.
Default Path	%ProgramFiles%\Common Files\Quest\QCEE\QCeeService.exe
Startup Type	Automatic
Exe Name	QCeeService.exe

Change Auditor licensing processes

This section describes the licensing processes used within Change Auditor:

•

License check process

•

Component licensing

•

License check process

The Change Auditor coordinator service performs a valid license check once every 5 minutes, or during service startup. The coordinator determines if:

•

A valid license is installed.

•

The license has an expiration date and if the current date exceeds the expiration date.

•

The total user count allowed under the given license.

If a license has expired, the coordinator service notifies the Change Auditor agent service, and the agent stops collecting events for that component.

For example, If the Exchange license has expired, the Change Auditor agent service will no longer collect Exchange events. After all licenses have expired and the coordinator has no valid licenses installed, the coordinator service schedules itself to shut down 5 minutes from the time this is detected.

Component licensing

The first time an agent connects to any coordinator and retrieves the first configuration update, it sends a component license update request to the coordinator. After that, the agent requests a component license update every 24 hours from the connected coordinator. If the agent is not connected to a coordinator at the 24-hour mark, no component license update happens and the agent tries again 24 hours later.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center