Chat now with support
Chat with Support

Change Auditor 7.3 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Introduction

You can create custom search definitions to search for the configuration changes that need to be tracked in your environment. The search properties tabs across the bottom of the Searches page allows you to define new custom searches.

 

Two new columns have been added as of Change Auditor 7.0 that allow you to display extra information through the search Layout tab:

Table 1. Available columns
Layout Tab
Search Column Name
Description

Origin - AD Site Name

Origin AD Site

The Active Directory site of the computer from which the event originated.

User- Is Administrator

Administrator

‘Yes’ indicates that the user is a direct or indirect member of the local Administrators, Active Directory Administrators, Domain Admins or Enterprise Admins groups.

NOTE: You can now filter searches to include or exclude users with the Administrator right.

Create a custom search

The following procedure provides the ‘general’ steps involved in creating a custom search.

* 
NOTE: Selecting the Private folder creates a search that only you can run and view. Selecting the Shared folder creates a search that all users can run and view.
To define a new search:
1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.
3
Click New at the top of the Searches page.
4
On the Search Properties tabs, enter the search criteria to use:
•
Info — enter a name and description for the search
•
Who — allows you to search for events generated by a specific user, computer or group
•
What — allows you to search for events based on subsystem, event class, object class, severity, or result
•
Where — allows you to search for events captured by a specific agent, domain or site
•
When — allows you to search for events that occurred during a specified date and time range
•
Origin — allows you to search for events that originated from a specific workstation or server
 
* 
NOTE: When you specify criteria on more than one search properties tab (for example, Who, What and Where tabs), Change Auditor first evaluates each individual tab’s criteria and then chains the individual tab’s criteria together using the ‘AND’ operator, returning only those events that meet all the specified search properties.
5
To be notified when an event is captured as a result of this custom search, open the Alert tab to enable and define how and where to dispatch alerts when the selected search criteria is met. See Enable Alert Notifications for more information about setting up alert notifications.
6
Once you have defined the search criteria to use, you can either save the search definition or run the search.
•
To save and run the search, click Run from one of the Search Properties tabs.
•
To save the search definition without running it, click Save from one of the Search Properties tabs.
•
To create a search using a different name than was initially entered, click Save As | Save As from one of the Search Properties tabs.
•
To save the search definition as the new default for new searches, click Save As | Save As Default from one of the Search Properties tabs.

Search Properties tabs

To define custom search criteria, use the Search Properties tabs, which are displayed across the bottom of the Searches page. The Search Properties tab pane consists of the following tabs:

•
Info tab
•
Who tab
•
What tab
•
Where tab
•
When tab
•
Origin tab
•
Alert tab (Search Properties tabs)
•
Report tab (Search Properties tabs)
•
Layout tab
•
SQL tab
•
XML tab
To display and enable the Search Properties tabs:
1
From the Searches page:
•
Click Show Properties
•
Right-click a folder (left pane) or search definition (right pane) and select Show Properties
•
Select a folder (left pane) or search definition (right pane) and click New | New Search
* 
NOTE: You can also display the Search Properties tabs from a Search Results tab, using Search Properties.
2
Use the “X” hide button in the upper right corner of the Search Properties tab pane to hide this pane.

Info tab

From the Info tab, you can view or enter the name and description of a search definition. You can also define the maximum number of records to be retrieve and display, or enable a refresh interval that defines how often the client is to retrieve and redisplay updated information.

The Info tab contains the following information and controls:

 
Table 2. Info tab: Field and control descriptions
Field and Control
Description

Search Name

Displays the name of the selected search.

When creating a search, place your cursor in this text box and enter a descriptive name for the search.

Search Description

Displays the description of the selected search.

To add a description to a new search, place your cursor in this text box to enter a brief description of the search.

Search Limit

Specifies the maximum number of records to retrieve and display. By default, the maximum of 50,000 records are returned from the database during a single request. Select this check box and use the arrow controls to change the search limit for the selected search.

NOTE: Clearing this check box removes the search limitation, which may increase both client memory and wait time if expected search results are over 100,000. Therefore, Quest recommends that you leave this check box checked and use the defined search limit.

Refresh Interval

Specifies how often the client is to retrieve and redisplay updated information. Select this check box and use the arrow controls to enable and set the refresh interval for the selected search.

When this option is checked, an extra field, Next Refresh, is added to the heading area of the Search Results grid.

NOTE: This option is not checked by default for new searches, only for the default favorite search (Change Auditor Real-Time) used in the Overview page. The default interval for the default favorite search is five minutes.
To name a new search:
1
Place your cursor in the Search Name text box and enter a descriptive name for the search.
* 
NOTE: If you do not enter a new name for your search, it is named ‘New Search’.
2
Place your cursor in the Search Description text box and enter a brief description of the search.
3
After entering the search name and optional description, proceed to the other Search Properties tabs to enter the search criteria.
To change the maximum number of records to retrieve:

The Search Limit field specifies the maximum number of records to retrieve and display for the selected search. By default, a maximum of 50,000 records are returned from the database during a single request.

1
To restrict the search results to a specific number of records, ensure that the Search Limit check box is checked.
2
Set the value to the maximum number of events to return.
* 
NOTE: Clearing this check box removes the search limitation, which may increase both client memory and wait time if expected search results are over 100,000. Quest recommends that you leave this check box checked and use the defined search limit.
To set a refresh interval:

The Refresh Interval field specifies how often to retrieve and redisplay updated information.

1
Select the Refresh Interval check box to enable this feature and activate the field to the right of this field.
* 
NOTE: This option is not checked by default for new searches, only for the default favorite search (Change Auditor Real-Time) used in the Overview page. The default interval for the default favorite search is five minutes.
2
Enter or use the arrow controls to set the refresh interval (how many minutes between refreshes) for the selected search.
When this option is checked, an extra field, Next Refresh, is added to the heading area of the search results grid whenever this search is run.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating