Chat now with support
Chat with Support

Change Auditor for SharePoint 7.2 - User Guide

SharePoint Auditing page

The SharePoint Auditing page displays when SharePoint is selected from the Auditing task list in the navigation pane of the Administration Tasks tab. From this page, you can start the SharePoint Auditing wizard to specify the SharePoint farm and paths to audit. You can also edit existing templates and remove templates that are no longer being used.

The SharePoint Auditing page contains an expandable view of all the SharePoint Auditing templates that have been defined. To add an template to this list, use the Add toolbar button. Once added, the following information is provided for each template:

Click the expansion box to the left of the Farm name to expand this view and display the following details for each template:

SharePoint Auditing templates

To enable SharePoint auditing, create a SharePoint auditing template for each SharePoint farm to audit. Each auditing template defines the SharePoint path within the farm to audit and the agent to capture events from the selected SharePoint farm.

Be sure that all the SharePoint auditing templates contain a GUID in their Farm name (Farm field on SharePoint Auditing page) BEFORE you attempt to add any new templates.

2
Click Auditing.
3
Select SharePoint.
4
Click Add to open the SharePoint Auditing wizard to define the SharePoint farm and paths to audit and the agent to receive the events.
If you are creating a template for a farm that has not been previously audited, use the drop-down arrow and select Find a SharePoint farm. On the Eligible Change Auditor Agents dialog, select the SharePoint Web Front End server to capture SharePoint events. Note: If you have multiple agents, select the Web Front End server. The first time an agent is selected, you are prompted to enter the credentials to connect to the SharePoint farm. Change Auditor then performs a SharePoint topology search to locate the SharePoint farm residing on the selected agent (which may take several minutes). Once the topology is completed, the name of the farm (and GUID) is displayed in the SharePoint Farm field in the wizard.
NOTE: The Next button on this page is disabled if you select a SharePoint farm from the drop-down list that is assigned to a SharePoint Auditing template. You can only select a SharePoint farm whose auditing template has been deleted.
Click Add and select the SharePoint paths to audit. Once you have selected the paths to audit, they are displayed in the SharePoint Paths to audit list.
Optionally, select Add optional SharePoint paths to exclude from auditing under to select a path that has been added to the SharePoint paths to audit and click Add to locate and add any subsequent paths within the selected path to exclude from auditing.
Use Add | Add This Event to add individual events.
Use the Add | Add All Events in Facility option to add all events in the selected facility.
If you are creating a template for a farm that has not been previously audited (you used the Find a SharePoint farm option) you see a list of servers with Change Auditor agents. Select the required agent, and click OK.
If you are creating a template for a previously audited farm, select the required agent in the SharePoint farm and click OK. Click Set Credentials and enter the credentials to access the SharePoint farm. Click OK. A notification message is displayed indicating whether you have entered valid credentials.
10
On the Administration Tasks tab, click Configuration, select Agent in the Configuration task list to open the Agent Configuration page.
12
Verify that Auditing is displayed in the SharePoint column.
5
On the Administration Tasks tab, click Configuration. Select Agent in the Configuration task list to open the Agent Configuration page.

The disable feature allows you to temporarily stop auditing the specified SharePoint farm or path without having to remove the template or individual path from a template.

1
On the Auditing page, place your cursor in the Status cell for the template, click the arrow control, and select Disabled.
The entry in the Status column for the template changes to ‘Disabled’.
2
To re-enable the auditing template, use the Enable option in either the Status cell or right-click menu.
1
On the SharePoint Auditing page, click in the Status cell for the path and select Disabled.
The entry in the Status column for the selected path changes to ‘Disabled’.
2
To re-enable the auditing of a path, use the Enable option in either the Status cell or right-click menu.

SharePoint Auditing wizard

The SharePoint Auditing wizard displays when you click Add or Edit on the SharePoint Auditing page. This wizard steps you through the process of creating a new template, identifying the SharePoint farm and paths to audit. You will also select an agent that has SharePoint installed to capture events from the selected SharePoint farm.

You can also use this wizard to modify a previously defined template.

The following table provides a description of the fields and controls in the SharePoint Auditing wizard.

On the first page of the wizard, specify the SharePoint farm and paths to audit.

SharePoint Farm

This field displays that name (and GUID) of the SharePoint farm being audited. Use the drop-down control to select or find a SharePoint farm.

Find a SharePoint farm - select this option to select a SharePoint farm for auditing. Selecting this option displays the Eligible Change Auditor Agents dialog allowing you to select from a list of agents that host a SharePoint farm.
NOTE: The topology will scan for the SharePoint farm and add it to the SharePoint Farm field. A red flashing icon indicates that the SharePoint Farm is already being monitored by another SharePoint Auditing template. See the Upgrade Change Auditor for SharePoint appendix for more information on editing existing templates BEFORE adding new SharePoint Auditing templates.
<SharePoint Farm Name (GUID)> - select from a list of cached SharePoint farms that have been previously selected for auditing.

SharePoint paths to audit list

This box lists the SharePoint components within the selected SharePoint farm to be audited. Use the Add and Remove buttons at the top of this list box to specify the SharePoint components to be audited.

Add - Use Add to locate and add a component within the selected SharePoint farm to the SharePoint Paths to Audit list. Clicking Add displays the Browse SharePoint dialog allowing you to select a SharePoint component for auditing.
Remove - Select an entry in the SharePoint Paths to Audit list and click Remove to remove it from the template.

SharePoint paths to exclude list (Optional)

The list box located across the bottom of this page displays the SharePoint components to be excluded from auditing. Use the button above this list box to specify the paths to be excluded.

Add - To exclude a component, select a path in the SharePoint Paths to Audit list and then click Add to select the components under the selected audit path that are to be excluded from auditing.
Clicking Add displays the Browse SharePoint dialog allowing you to locate and select a SharePoint component under the selected audit path for exclusion.
Remove - Select an entry in the Exclusion list and click Remove to remove it.

From this page, select the SharePoint operations (event classes or facilities) to audit on the selected SharePoint farm. You must select at least one event class.

Event Classes

The data grid across the top of the page displays all of the SharePoint event classes available for auditing. Select/highlight an event class and use the appropriate add option to add either the individual event class or all events in the selected facility.

This grid displays the following information for each event class:

Facility - displays the facility to which each event class belongs
Event Class - displays the events available for auditing
Status - indicates whether the event is currently enabled or disabled
Severity - displays the current severity level assigned to each event

Add

Select an event class in the data grid, click Add and select one of the following options:

Add This Event - use to add the selected event classes to the Audit list box at the bottom of the page.
Add All Events in Facility - use to add all event classes in the selected facility to the Audit list box at the bottom of the page. This option is only available when you have selected only one event class in the data grid.

Remove

Click Remove to remove the selected entry from the Audit list box.

Audit list

This list box displays the facilities and/or event classes to be included in the selected auditing template.

From this page, select the agent to capture events from the selected SharePoint farm.

NOTE: If you used the Find SharePoint Farm option on the first page of the wizard to specify the SharePoint farm to be audited, this page is pre-populated based on the agent selected.

Browse

Click Browse to display a list of the agented servers available in the selected SharePoint farm. From this dialog, select the agent to capture the events from the specified farm.

Set Credentials

Once you have selected the agent, click Set Credentials to enter the credentials to be used to access the selected SharePoint farm.

Clicking this button displays the SharePoint Credentials Required dialog which prompts you to enter the following:

Clear Credentials

Click Clear Credentials to clear the credentials previously entered for the selected agent.

Change Auditor Agent

Once an agent is selected, the following information is displayed:

Use the last page of the wizard to verify the deployment status of the Change Auditor SharePoint Solution.

Refresh Change Auditor Solution Status

The Change Auditor SharePoint Solution status is checked/refreshed once every hour; therefore, the status displayed may not reflect the most current status. Click Refresh Change Auditor Solution Status to force a refresh of the solution’s status.

Solution Status

The Solution Status pane displays the current status of the Change Auditor SharePoint Solution.

If it contains a warning symbol and red text, select Refresh Change Auditor Solution Status. If the warning state remains, click Finish to close the wizard. On the local SharePoint farm server, run the SharePoint Solution Manager utility to add/deploy the solution. See Add and deploy Change Auditor SharePoint Solution.

SharePoint event logging

In addition to real-time event auditing, you can enable event logging to capture SharePoint events locally in a Windows event log. This event log can then be collected using InTrust to satisfy long-term storage requirements.

For SharePoint events, event logging is disabled by default. When enabled, only configured activities are sent to the ChangeAuditor for SharePoint event log. See the Change Auditor for SharePoint Event Reference Guide for a list of the SharePoint events that can be sent to the event log.

2
Click Configuration.
3
Select Agent in the Configuration task list to display the Agent Configuration page.
4
Click Event Logging.
6
Click OK to save your selection and close the dialog.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating