Chat now with support
Chat with Support

Change Auditor for EMC 7.3 - User Guide

Configuring audit scope

Audit only volumes, extensions and operations that are vital for your environment.

* 
NOTE: Configuring the auditing scope to audit only critical files/folders is recommended because this filtering controls the traffic between the coordinator and agent. However, changes to the auditing scope as described below will have no impact on the traffic between EMC and the agents.

Use the EMC Auditing template to specify the auditing scope for EMC events. For example, using the EMC Auditing template you can:

•
Decrease the number of volumes being audited
•
Set the Audit Path to File, Folder or Volume and enter the file, folder or volume to be audited.
•
To specify a file, enter: <ShareName>\<FolderName>\<FileName.ext>
•
To specify a folder, enter: <ShareName>\<FolderName>
•
To specify a volume, enter: <VolumeName>
•
Decrease the number of file extensions being audited
•
Use the Inclusions tab to specify individual subfolders or files to be included for auditing.
•
Use the Exclusions tab to exclude individual subfolders or files from auditing.
* 
NOTE: On both the Inclusions and Exclusions tabs, you can specify a group of files or subfolders using wildcard characters. That is, use an asterisk (*) to substitute zero or more characters or use a question mark (?) to substitute a single character.

See File/Folder Inclusion and Exclusion Examples for more information and examples.

•
Decrease the number of operations being audited
•
Use the Events tab to select only vital file and/or folder events.

EMC Events

The following events can be selected for auditing from the Events tab on the EMC Auditing wizard. The events listed on the Events tab is based on the file/folder specified in the Audit Path and the coverage specified in the Scope cell.

File events
•
EMC File access rights changed (no from-value)
•
EMC File contents written
•
EMC File created
•
EMC File deleted
•
EMC File moved
•
EMC File opened (Only available when the Audit Path is File)
•
EMC File ownership changed (no from-value)
•
EMC File renamed
 
Folder events
•
EMC Folder access rights changed (no from-value)
•
EMC Folder created
•
EMC Folder deleted
•
EMC Folder moved
•
EMC Folder ownership changed (no from-value)
•
EMC Folder renamed
 

 

File/Folder Inclusion and Exclusion Examples

This section provides sample entries for the Inclusions and Exclusions tabs on the auditing wizard. It does not list every combination available, but provides a variety of examples to help you understand how to use the wildcard characters allowed on these two tabs.

The Inclusions and Exclusions tabs only appear when the Folder, Volume or All Volumes option is selected in the Audit Path field and the Scope includes child objects. Use these two tabs as described below:

•
Inclusions tab - enter a file mask to specify what is to be audited.
•
Exclusions tab - optionally enter a file mask (or path) to specify subfolders and files in the selected audit path that are to be excluded from auditing.

Inclusions tab

You must enter a file mask on the Inclusions tab to specify what is to be audited in the selected audit path. Use the following characters to specify a file mask on the Inclusions tab:

•
Fixed characters such as letters, numbers and other characters that are allowed in file names.
•
An asterisk (*) wildcard character to substitute zero or more characters.
•
Question mark (?) wildcard character to substitute a single character.
•
A double asterisk (**) to specify a recursive match. (find match in the folder and all subfolders in audit path).
* 
NOTE: The slash (\) and double asterisk (**) characters can only be used with volumes.
Examples:

The following table provides some examples of file masks that can be used on the Inclusions tab of the auditing wizard. Note that <String> in this table may contain any of the file mask characters described above (i.e., fixed characters, * or ?).

Table 1. Inclusion examples
What to include in the audit:
Inclusion syntax/examples:

Include all files located anywhere in the audit path.

NOTE: This is the most commonly used file mask.

Inclusion Syntax: *

Include all files with a specific file name regardless of its file extension.

Inclusion Syntax: <FileName>.*

Example: Name.*

Includes:
Name.txt
Name.docx
Name.pdf

Include all files with a specific file extension.

Inclusion Syntax: <FileNameString>.<Ext>

Example 1: *.tmp

Includes:
Files with a file extension of .tmp.

Name.tmp
Testing.tmp

Example 2: ???*.doc

Includes:
Files whose name contains at least three characters with a file extension of .doc.

MyTest.doc
Testing123.doc
123.doc

Example 3: ???test.doc

Includes:
Files whose name contains seven characters and ends in ‘test’ with a file extension of .doc.

ABCtest.doc
123test.doc

Include all files with a specific file name that has a file extension of a specific length (number of characters).

Inclusion Syntax: <FileName>.<ExtString>

Example 1: Name.???

Includes:
Name.txt
Name.tmp
Name.pdf

Example 2: Name.????

Includes:
Name.docx
Name.xlsx

Include all files that contain a specific string in their name and/or file extension.

Inclusion Syntax: <FileNameString>.<ExtString>

Example: *name.??p

Includes:
Files whose name end with ‘name’ with a three character file extension that ends in the letter ‘p’.

Myname.tmp
Name.bmp

 

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating