Chat now with support
Chat with Support

Change Auditor 7.2 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

My Favorite Search

The Overview top pane displays a real-time view of events generated based on a user-defined ‘favorite’ search. By default, the Change Auditor Real-Time search definition is used and all events captured for the last 20 minutes are displayed

As events are returned, they are added to the search results, providing you with a real-time view of what’s happening in your environment. By default, the events are sorted by date, with the latest event being added to the top of the list. You can, however, use the column controls to select a different sort criteria for the information displayed. For more information on customizing the content of this table, see Customize table content.

Double-clicking an event displays the Event Details pane across the bottom of the page, which contains additional details regarding the selected event. The layout and content for My Favorite Search is the same as that used on the Search Results page. For a description of the search results grid and the Event Details pane, please refer to Search Results grid and Event Details pane.

Define a favorite search

By default the Change Auditor Real-Time search (all events captured in the last 20 minutes) is used to capture the events displayed on the Overview page. You can, however, select a different ‘favorite’ search, which will then be used to populate the top pane on the Overview page.

To define a ‘favorite’ search:
1
Open the Searches page.
2
Select the search to use, right-click and select Set As My Favorite.
3
Open the Overview page, click Refresh to display the results of that search in the My Favorite Search pane at the top of the Overview page.
To modify the current ‘favorite’ search:
1
From the Overview page, click My Favorite Search: <search name> title at the top of the My Favorite Search grid.
2
The Searches page and corresponding search properties tab are displayed.
3
Use the search properties tabs to modify the search criteria. Click Save from one of the search properties tabs to save your changes.
4
Open the Overview pane, click Refresh to display the results of the modified search in the My Favorite Search pane.

Overview panes

You can customize the Overview panes across the bottom of the Overview page based on your preference to display a variety of overview information about Change Auditor. By default, the Top Agent Activity and Agent Status panes display across the bottom of the Overview page. However, each of these panes has an arrow button on its heading that you can use to display different overview information.

The following overview views are available:

•
Top Agent Activity
•
Recent Event Activity
•
Count of Events By
•
Agent Status
•
Coordinator Status
•
Alert History Counts

Within the overview panes, blue underlined numbers are hypertext links. Selecting a link displays the search results for the selected count.

Top Agent Activity

The Top Agent Activity pane displays the most active agents in your environment. That is, the agents that have forwarded the most events to the coordinator based on the date range selected. If this pane is not displayed, click the arrow on the heading of one of the lower panes and select Top Agent Activity to display this pane.

By default, the agent activity on all servers for the past month, excluding uninstalled agents, will be displayed. You can, however, use the controls located at the top of this pane to specify the types of agented objects to be included as well as the date range.

Type

By default all agented objects are included. However, you can use the drop-down menu located in the upper left corner of this overview pane to limit the types of objects to be included:

•
All - view all agented servers and workstations (default)
•
DCs - view only agented domain controller servers
•
Servers - view only agented servers that are joined to the domain
•
Workstations - view only agented workstations that are joined to the domain
•
Others - view only non-member objects, such as ADAM workgroup servers or workstation agents manually installed on non-Active Directory machines
Show Uninstalled Agents

Select this check box to include all uninstalled agents in the count. Uninstalled agents are not included by default.

Time interval

By default, data will be collected for the last month. However, you can use the controls in the upper right corner of this overview pane to specify a different time interval for collecting this data.

Where: <nn> is a positive numeric value and <interval> is one of the following:

•
Hours
•
Days
•
Weeks
•
Months (default)
•
Years
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating