Chat now with support
Chat with Support

Change Auditor 7.1 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Define events to be captured based on results

The Results column on the Audit Events page allows you to specify if an individual event is to be captured by Change Auditor based on the results of the operation performed in the event. That is, you can specify to capture an individual event based on the following results:

•
All Results - capture event regardless of the result returned.
•
Success Only - capture event only if the operation occurred as stated in the event.
•
Success and Failed Only - capture event if the operation occurred as stated in the event or if it was prevented due to a factor/setting outside of Change Auditor’s control.
•
Success and Protected Only - capture event if the operation occurred as stated in the event or if it was prevented because the object was protected using Change Auditor’s protection feature.
To change the results criteria for capturing an event:
1
Open the Audit Events page.
2
Locate the event to modify.
3
Place your cursor in the Results cell for that event, click the arrow control and select one of the following options:
•
All Results (default)
•
Success Only
•
Success and Failed Only
•
Success and Protected Only
4
Change Auditor will now only capture and return the event if the operation mentioned if the event meets the results criteria selected.

View event information

Change Auditor provides access to the associated Event Reference Guide which contains detailed descriptions for each event, including how Change Auditor detected the configuration change event, what the changed parameter controls, and the consequence of such a change.

To view the event reference guide:
1
Open the Audit Events page.
2
Select an event from the list and click Knowledge Base.
 

Account Exclusion

•
Introduction
•
Excluded Accounts Auditing page
•
Excluded Accounts templates
•
Excluded Accounts wizard

Introduction

Account exclusion allows you to define a list of trusted accounts to exclude from auditing. This enables you to exclude events generated by accounts that make a large number of changes or by accounts which are trusted.

To use account exclusion, you must first define the user/computer accounts that can make changes without triggering an event in Change Auditor:

1
Create an Excluded Accounts template which specifies the user and/or computer accounts that are to be excluded from the auditing process. For more information on creating a template, refer to Excluded Accounts templates.
2
Add this template to an agent configuration. For more information on how to add a template to an agent configuration, refer to Define agent configurations.
3
Assign the agent configuration to Change Auditor agents. For more information on how to assign an agent configuration to an agent, refer to Assign agent configurations to server agents.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating