Chat now with support
Chat with Support

Change Auditor for VMWare 7.1.1 - User Guide

VMware Searches/Reports

•
Introduction
•
VMware built-in searches
•
Create custom searches

Introduction

Change Auditor provides built-in searches that can be run to retrieve VMware activity captured by deployed agents enabling you to retrieve valuable information from a variety of perspectives.

* 
NOTE: The terms ‘searches’ and ‘reports’ are used in conjunction to acquire the desired output. You run a ‘search’ and the results returned are referred to as a ‘report’.

You can also create custom search definitions to search for the configuration changes that need to be tracked in your environment. You will use the search properties tabs across the bottom of the Searches page to define new custom searches.

 

VMware built-in searches

and

* 
NOTE: By default, the VMware reports include the following information on the Search Results page: VMware Audited Host, VMware Host, VMware Datacenter, and VMware Virtual Machine. These additional columns are defined using the Layout tab.

To see a complete list of built-in reports, see the Change Auditor Built-in Reports Reference Guide.

To run a built-in search:
1
Click the Searches tab or select View | Searches.
2
Expand and select the appropriate folder in the explorer view (left pane) to display the list of search definitions stored in the selected folder. For example, selecting the Shared | Built-in | Cloud Storage Activity will display all the built-in searches available for Cloud Storage.
3
In the right-hand pane, locate the search to be run and use one of the following methods to run the selected search:
•
Double-click a search definition
•
Right-click a search definition and select Run
•
Select the search definition and click Run
4
A new Search Results Page will be displayed populated with the audited events that met the search criteria defined in the selected search definition.
* 
NOTE: To modify a built-in search, see the Change Auditor User Guide.

Create custom searches

The following scenarios explain how to use the What tab to create custom VMware searches.

 
* 
NOTE: If you wanted to, you can use the other search properties tabs to define additional criteria:
•
Who - allows you to search for events generated by a specific user, computer or group
•
Where - allows you to search for events captured by a specific agent or within a specific domain or site
•
When - allows you to search for events that occurred within a specific date/time range
•
Origin - allows you to search for events that originated from a specific workstation or server

 

* 
NOTE: Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all Change Auditor users.
To search for all events:
1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.
3
Click New to activate the Search Properties tabs across the bottom of the Searches page.
4
On the Info tab, enter a name and description for the search.
5
Open the What tab, expand Add and select Subsystem | VMware.
6
On the Add VMware Host dialog, select the All VMware Hosts option.
7
Review the Actions section and select those that are to be included in the search.
By default, All Actions is selected meaning that all of the actions associated with the VMware host will be included in the search.
8
Click OK to save your selection and close the dialog.
9
Once you have defined your search criteria, click Run to save and run the search.
10
When this search is run, Change Auditor will search for all VMware events and display the results in a new search results page.
To search for events performed against a specific VMware host:
1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.
3
Click New to activate the Search Properties tabs across the bottom of the Searches page.
4
On the Info tab, enter a name and description for the search.
5
Open the What tab, expand Add and select Subsystem | VMware.
6
On the Add File System Path dialog, select one of the following scope options:
•
This Object - select to search only the selected object.
7
In the Host Name field, enter or use the filters to select the host to be searched.
8
In the VM Name field, enter or use the filters to select the VM to be searched.
9
Review the Actions section and select those that are to be included in the search.
By default, All Actions is selected meaning that all of the actions associated with the path will be included in the search.
10
Click OK to save your selection and close the dialog.
11
Click Run to save and run the search. Click Save to save the search definition without running it.
12
When this search is run, Change Auditor will search for VMware events in the host and VM.
To search for a specific event class:
1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.
3
Click New to activate the Search Properties tabs across the bottom of the Searches page.
4
On the Info tab, enter a name and description for the search.
5
Open the What tab, click Add (or expand Add and select Event Class).
6
On the Add Facilities or Event Classes dialog, enter VMware in the data filter field under the Facility heading to display all of the VMware events.
7
From this list, select one or more events and use the Add | Add This Event option to add the selected events to the list box at the bottom of the dialog. Click OK to save your selection and close the dialog.
8
Click Run to save and run the search. Click Save to save the search definition without running it.
9
When this search is run, Change Auditor will search for the VMware events based on the search criteria specified on the What tab and display the results in a new search results page.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating