Chat now with support
Chat with Support

Change Auditor for EMC 7.2 - Event Reference Guide

Introduction

Change Auditor for EMC tracks, audits and alerts on file and folder changes in real time, translating events into simple text and eliminating the time and complexity required by system provided auditing. The auditing scope can be set on an individual file or folder or an entire file system recursive or non-recursive. Change Auditor for EMC also allows you to include or exclude certain files or folders from the audit scope in order to ensure a faster and more efficient audit process.

In addition to real-time event auditing, you can also enable event logging to capture EMC events locally in a Windows event log. This event log can then be collected using InTrust to satisfy long-term storage requirements.

* 
NOTE: EMC auditing and event logging are ONLY available if you have licensed Change Auditor for EMC and defined an EMC Auditing template for each EMC file server (CIFS) to be audited. Contact your Sales Representative for more information on obtaining Change Auditor for EMC.

This document lists the events that can be captured by Change Auditor for EMC. Separate event reference guides are provided that list the core Change Auditor events (when any Change Auditor license is applied) and the events captured when the different auditing modules are licensed.

Change Auditor for EMC Events

Change Auditor for EMC queries EMC Celerra/VNX/Isilon file servers for modifications made to files and folders. This chapter lists the audited events captured by Change Auditor when Change Auditor for EMC is licensed and an EMC Auditing template is created for each EMC file server (CIFS) to be audited. These events are listed in alphabetical order by facility:

•
Change Auditor Internal Auditing
•
EMC
 
* 
IMPORTANT: When expecting large numbers of events, it may be necessary to increase the Max Events per Connection setting in the client (Agent Configuration on the Administration Tasks tab) to avoid an ever-increasing backlog of events waiting to be sent from the agent to the coordinator database.
* 
NOTE: To view a complete list of all the Change Auditor for EMC events, open the Audit Events page on the Administration Tasks tab in the client. This page contains a list of all the events available for auditing by Change Auditor for EMC. It also displays the facility to which the event belongs, the severity assigned to each event, if the event is enabled or disabled, and the type of Change Auditor for EMC license that is required to capture each event.

Change Auditor Internal Auditing

 
Table 1. Change Auditor Internal Auditing event
Event
Description
Severity

CEPP Configuration Changed

Created when the cepp.conf configuration file is changed by another user or third-party application. The change to this configuration file may prevent Change Auditor for EMC from capturing EMC events.

Medium

EMC

 
Table 2. EMC events
Event
Description
Severity

EMC File Access Rights Changed (no from-value)

Created when file access rights have changed on a file server.

For more information see, Note 3, Note 5, and Note 6.

Medium

EMC File Contents Written

Created when the contents of a file was written on a file server.

Medium

EMC File Created

Created when a file is created on a file server.

Medium

EMC File Deleted

Created when a file is deleted on a file server.

Medium

EMC File Moved

Created when a file is moved on a file server.

Medium

EMC File Opened

Created when a file is opened on a file server.

Medium

EMC File Ownership Changed (no from-value)

Created when the ownership of a file is changed on a file server.

For more information see, Note 3 and Note 6.

Medium

EMC File Renamed

Created when a file is renamed on a file server.

Medium

EMC Folder Access Rights Changed (no from-value)

Created when the access rights of a folder have changed on a file server.

For more information see, Note 3, Note 5, and Note 6.

Medium

EMC Folder Created

Created when a folder is created on a file server.

For more information see,Note 2

Medium

EMC Folder Deleted

Created when a folder is removed from a file server.

For more information see,Note 2

Medium

EMC Folder Moved

Created when a folder is moved on a file server.

For more information see,Note 2

Medium

EMC Folder Ownership Changed (no from-value)

Created when the ownership of a folder has changed on a file server.

For more information see, Note 3 and Note 6.

Medium

EMC Folder Renamed

Created when a folder is renamed on a file server.

Medium

Self Service Tools
Knowledge Base
Notifications & Alerts
Product Support
Software Downloads
Technical Documentation
User Forums
Video Tutorials
RSS Feed
Contact Us
Licensing Assistance
Technical Support
View All
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating