Chat now with support
Chat with Support

Change Auditor 7.1.1 - Web Client User Guide

Install Change Auditor Web Client Web Client Overview Overview Page Shared Overviews Administration Page Searches Page Search Results Page Administration Tasks Page Configuration Tasks (Administration Tasks Page) Auditing Tasks (Administration Tasks Page) Protection Tasks (Administration Tasks Page) Change Auditor Client Comparison

Introduction

The following sections describe the pages available through the Configuration task list of the Administration Task page and the tasks that can be performed on each of these pages. These pages allow you to define and assign agent configurations, enable email alerting and reporting, enable group membership expansion, define database purging, design templates for reports and authorize who is able to perform the different Change Auditor operations. For a full description of all options and fields available on these Configuration Tasks pages, refer to the Quest Change Auditor User Guide.

Agent Configuration page

Use the Agent Configuration page to define and assign agent configurations. The Agent Configuration page is displayed when Agent in the Configuration task list is selected in the navigation pane of the Administration Tasks page.

 
Table 19. Agent Configuration page: Tool bar buttons
Tool bar button
Description

Columns

Use to display different fields on the Agent Configuration page.

Configurations

Use to display the Configuration Setup dialog to add, edit or delete agent configuration definitions. See Defining and assigning agent configurations.

Assign

Use to assign an agent configuration to the selected agents.

Default All

Use to reset all agent configurations back to the default configuration.

Refresh Configuration

Use to retrieve the current agent configuration assignments.

Event Logging

Use to enable/disable event logging. See Enable event logging.

Defining and assigning agent configurations

To enable various custom auditing and protection features you are required to assign templates to an agent’s configuration. The custom auditing and protection features that require custom templates to be assigned to an agent’s configuration are:

•
File System auditing
•
Registry auditing
•
Service auditing
•
SQL Server auditing
•
Excluded Accounts auditing
•
File System protection
* 
NOTE: The NetApp, EMC, FluidFS, SharePoint, and VMware auditing templates define which agents are used to capture events; however, these templates do not use the agent configurations as described below. See Templates with defined agents for more information.
Define agent configurations
To define a new agent configuration:
1
Open the Administration Tasks page.
2
Click Configuration.
3
Select Agent in the Configuration task list to display the Agent Configuration page.
4
From the Agent Configuration page, click Configurations.
The Configuration Setup dialog is displayed, where the top pane contains a drop-down list of configuration definitions available as well as the means for creating a new configuration. To view the Configurations list, click the arrow control to the far right of the tool bar buttons. After selecting a configuration from the list, the cell updates to display the name of the currently selected configuration.
5
Click Add to create a new definition or click Copy to duplicate the configuration displayed in the cell.
This adds a new configuration to the list, allowing you to name the new configuration, specify the system settings and assign auditing and protection templates to the configuration.
6
With the new/copied configuration displayed in the cell, enter the name for the new agent configuration in the Configuration Name field.
7
Use the tabs on the bottom pane to assign templates or view/modify agent settings.
Table 20. Configuration Setup dialog
Tab
Description
Procedure

Template

Use to add templates to selected agent configuration
1
Select the corresponding check box in the Assigned column
2
Click Apply to save your selection.

System Settings

Use to define how agents are to process events
1
Modify the following settings:
•
Polling Interval
•
Forwarding Interval
•
Retry Interval
•
Agent Load Threshold
•
Max events per connection
•
Allowed time for connection
2
Click Apply to save your selection.

File System

Use to define how to process duplicate file system events

NOTE: Applies to Change Auditor for Windows File Servers, Change Auditor for EMC, or Change Auditor for NetApp events
1
Modify the following settings:
•
Discard duplicates that occur within nn seconds
•
Audit all configured, including duplicates (Not recommended)
2
Click Apply to save your selection.

AD Query

Use to optimize the Active Directory auditing process

NOTE: Applies to Change Auditor for Active Directory Queries
1
Modify the following settings:
•
Discard query results less than nn records
•
Discard queries taking less than nn milliseconds
•
Discard duplicate queries that occur within nn minutes
•
AD Query auditing enabled
2
Click Apply to save your selection.

Exchange

Use to define how to handle duplicate folder events

NOTE: Applies to Change Auditor for Exchange
1
Modify the following setting:
•
Discard duplicates that occur within nn seconds
2
Click Apply to save your selection.

VMware

Use to define how often the agent is to poll VMware for new VMware events
1
Modify the following setting:
•
Polling Interval
2
Click Apply to save your selection.
8
Click OK to save your selections and close the dialog.
Assign agent configurations to agents

Once agent configurations are defined they can be assigned to one or more installed agents. Use the Agent Configuration page to assign agent configurations to agents.

To assign a configuration to an agent from the Agent Configuration page:
1
On the Agent Configuration page, select one or more agents from the agent list and click Assign.
2
On the Agent Assignment dialog, select the configuration definition to be assigned to the selected agents and click OK.
3
Back on the Agent Configuration page, the agent configuration assignment will be updated in the Configuration column.
4
Select the agents assigned to the agent configuration and click Refresh Configuration to ensure that the assigned agents are using the latest agent configuration.
* 
NOTE: If you do not refresh the agent’s configuration, the agent will automatically check for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.

Templates with defined agents

The following auditing templates define the agents to be used to capture events:

•
NetApp auditing
•
EMC auditing
•
FluidFS auditing
•
SharePoint auditing
•
VMware auditing

To enable the auditing defined in these templates, you must refresh the selected agent’s configuration after creating the template.

Refreshing an agent’s configuration to enable a newly assigned auditing template:
1
Open the Administration Tasks page.
2
Click Configuration.
3
Select Agent in the Configuration task list to display the Agent Configuration page.
4
Select the agents assigned to the auditing template and click Refresh Configuration to ensure the agent is using the latest configuration.
* 
NOTE: If you do not refresh the agent’s configuration, the agent will automatically check for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating