Chat now with support
Chat with Support

Change Auditor for EMC 7.3 - User Guide

Introduction

 

* 
NOTE: EMC auditing is only available if you have licensed Change Auditor for EMC. If you do not have a valid license you can use the features, however, associated events are not captured. To verify that it is licensed, right-click the coordinator icon in the system tray and select Licensing.

Verify auditing template is applied

To ensure EMC events are being captured, check to see if the agent assigned to the EMC Auditing template is using the latest agent configuration.

To verify that latest agent configuration is being used:
1
Select Start | All Programs | Quest | Change Auditor | Change Auditor Client.
2
Select View | Administration.
3
If not already selected, click Configuration.
4
Select Agent in the Configuration task list to open the Agent Configuration page.
5
Select the agent assigned to the EMC Auditing template (Auditing appears in the EMC column) and click Refresh Configuration.

Make changes and run a report

1
To test EMC auditing, make changes to the EMC Celerra/VNX NAS being monitored.
For example:
•
create a new folder
•
add a new .txt or .docx file in this folder
•
change the security permissions on a file (right-click file, open the Security tab and add another user with full control)
•
delete the sample .txt file
•
add a sub-folder
•
change the security permission of the new folder
2
Select Start | All Programs | Quest | Change Auditor | Change Auditor Client to review the events generated.
3
Open the Searches tab.
4
Expand the Shared | Built-in | All Events folder in the left-hand pane.
5
Locate and double-click All EMC Events in the right-hand pane.
A new Search Results tab is added to the client displaying the EMC events that were captured.
6
Select an event from the Search Results grid to display the event details for the selected event.

Troubleshooting steps

* 
NOTE: If the Search Properties tabs are displayed across the bottom of the Search Results page, double-click an event to display the event details for the selected event.

If the EMC events do not appear in the client as expected, check the following:

•
Verify that the CEPA (EMC CAVA agent service) is running on the Windows Server where the EMC events are being collected.
•
Verify that the Shared EMC Connector service (QCeeService) is running.
•
Use the following command to verify that the CEPP service on the EMC Data Mover is running and is in the state of ONLINE:
server_cepp <DataMoverName> -p -i
If the CEPP service is OFFLINE, restart the EMC CAVA agent service on the Windows Server. If that does not work, restart the EMC CEPP service on the Data Mover using the following commands:
server_cepp <DataMoverName> -service -stop
server_cepp <DataMoverName> -service -start
•
Verify that the EMC file server (CIFS) is valid on the first page of the EMC Auditing wizard. The EMC File Server (CIFS) field should contain the IP address or Netbios name of the CIFS to be audited.
•
Verify that you have selected those type of events in the EMC Auditing template. (Events tab in wizard.)
•
Verify that you have included the correct subfolders and paths in the EMC Auditing template. (Inclusions tab in wizard.)
* 
NOTE: Entering * will include all subfolders and paths.
•
Verify that you have not excluded the specified subfolders or paths in the EMC Auditing template. (Exclusions tab in wizard.)
•
If you set the credentials on the second page of the wizard, verify that you have selected the correct Data Mover for the selected CIFS.
•
Refresh the specified agent configurations on the Agent Configuration page to ensure the latest EMC Auditing template is being used.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating