Chat now with support
Chat with Support

Change Auditor for VMWare 7.1.1 - User Guide

Getting Started

•
Introduction
•
Create a VMware template
•
Enable and disable VMware events as required
•
Make changes and run a report
•
Troubleshooting

Introduction

Change Auditor for VMWare provides you with the ability to search, report and alert on changes to VMware’s infrastructure, including data centers, hosts, virtual machines and other resources associated with vCenter or ESX hosts.

To capture VMware events in Change Auditor, you must:

•
Create VMware Auditing templates to define which VMware hosts to audit, which operations to capture, and the agent to use to audit these hosts.
•
Enable the required VMware events.

Create a VMware template

To create a VMware auditing template:
1
Open the Administration Tasks tab.
2
Click Auditing.
3
Select VMware (under the Applications heading in the Auditing task list) to open the VMware Auditing page.
4
Click Add to open the VMware Auditing wizard which steps you through the process of creating a VMware Auditing template.
5
On the first page of the wizard, enter the following information:
•
Template Name — Enter a name for the template.
•
VMware Host — Enter the IP address or name (the name must be resolvable) of the vCenter Server or of an individual host computer to audit. Click Add to add it to the VMware Host list.
* 
NOTE: To audit one or more hosts on a specific vCenter Server, use the Find ESX Hosts button to search for and select the ESX hosts to be audited. Clicking this button displays the Find ESX Hosts dialog, where you enter the information/credentials for the vCenter Server for which you want to view ESX hosts. After entering the vCenter Server information/credentials, click Search to retrieve a list of hosts. Select one or more hosts from the list and click OK to save your selection and close the dialog. The selected hosts will now be display in the VMware Host list in the auditing wizard.
Repeat this step to add additional VMware hosts to the list.
6
Click Next to select the agent to use for VMware auditing.
7
On the second page of the wizard, click Browse.
On the Eligible Change Auditor for VMWare Agents dialog, select the agent to use to monitor the selected VMware hosts.
* 
NOTE: The agent must have access to the vCenter Server or VMware hosts selected on the first page of the wizard.
Once you have selected an agent, click OK to save your selection and close this dialog. Back on the wizard page, the agent information (Agent, Domain and Agent FQDN) is displayed for the selected Change Auditor for VMWare agent.
8
Click Set Credentials and enter the credentials to access the selected vCenter Server or VMware hosts. After entering the credentials, click OK to close the credentials dialog.
 
* 
IMPORTANT: You can select an account with ‘Read-Only’ access or role (for restrictions) to properly audit VMware events. The credentials entered may be Active Directory or Linux credentials depending on the computer (vCenter Server vs. individual host computer) selected for auditing.

If you specified multiple machines (for example, vCenter Servers and/or ESX hosts) in the auditing template, all of these machines must use the same credentials.

A desktop notification indicates whether access is granted or denied to the specified vCenter Server or VMware host based on the credentials entered.
9
When valid credentials are entered, a Certificate Notice is displayed for each computer selected for auditing. Click OK to accept the certificates. Once valid credentials are supplied and the certificates have been accepted, click Finish to create the template.
10
On the Administration Tasks tab, click Configuration. Select Agent in the Configuration task list to open the Agent Configuration page.
11
Select the agent assigned to the VMware Auditing template (Auditing appears in the VMware column) and click Refresh Configuration to ensure the agent is using the latest configuration.

Enable and disable VMware events as required

Change Auditor for VMWare allows you to enable or disable events to best suit your organization. To view or modify the current event auditing settings, use the Audit Events page, which is accessible through the Administration Tasks tab.

To disable/enable individual events:
1
Open the Administration Tasks tab.
2
Click Auditing.
3
Select Audit Events (under the Configuration heading in the Auditing task list) to display the Audit Events page.
4
To disable an event, use one of the following methods:
•
Select one or more enabled events and click Disable. (Use the Shift or Ctrl keys to select multiple events.)
•
Select an enabled event, place your cursor in the corresponding Status cell, click the arrow control and select Disabled from the drop-down menu.
•
Right-click an enabled event and select Disable.
5
To enable an event, use one of the following methods:
•
Select one or more disabled events and click Enable. (Use the Shift or Ctrl keys to select multiple events.)
•
Select a disabled event, place your cursor in the corresponding Status cell, click the arrow control and select Enabled from the drop-down menu.
•
Right-click a disabled event and select Enable.
* 
NOTE: You can also disable or enable an event using the Disable/Enable tool bar button at the top of the Event Details pane on a Search Results page.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating