Chat now with support
Chat with Support

Change Auditor 7.2 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Custom Searches and Search Properties

•
Introduction
•
Create a custom search
•
Search Properties tabs

Introduction

You can create custom search definitions to search for the configuration changes that need to be tracked in your environment. The search properties tabs across the bottom of the Searches page allows you to define new custom searches.

 

Two new columns have been added as of Change Auditor 7.0 that allow you to display extra information through the search Layout tab:

Table 1. Available columns
Layout Tab
Search Column Name
Description

Origin - AD Site Name

Origin AD Site

The Active Directory site of the computer from which the event originated.

User- IsAdministrator

Administrator

‘Yes’ indicates that the user is a direct or indirect member of the local Administrators, Active Directory Administrators, Domain Admins or Enterprise Admins groups.

Create a custom search

The following procedure provides the ‘general’ steps involved in creating a custom search.

* 
NOTE: Selecting the Private folder creates a search that only you can run and view. Selecting the Shared folder creates a search that all users can run and view.
To define a new search:
1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.
3
Click New at the top of the Searches page.
4
On the Search Properties tabs, enter the search criteria to use:
•
Info — enter a name and description for the search
•
Who — allows you to search for events generated by a specific user, computer or group
•
What — allows you to search for events based on subsystem, event class, object class, severity, or result
•
Where — allows you to search for events captured by a specific agent, domain or site
•
When — allows you to search for events that occurred during a specified date and time range
•
Origin — allows you to search for events that originated from a specific workstation or server
 
* 
NOTE: When you specify criteria on more than one search properties tab (for example, Who, What and Where tabs), Change Auditor first evaluates each individual tab’s criteria and then chains the individual tab’s criteria together using the ‘AND’ operator, returning only those events that meet all the specified search properties.
5
To be notified when an event is captured as a result of this custom search, open the Alert tab to enable and define how and where to dispatch alerts when the selected search criteria is met. See Enable Alert Notifications for more information about setting up alert notifications.
6
Once you have defined the search criteria to use, you can either save the search definition or run the search.
•
To save and run the search, click Run from one of the Search Properties tabs.
•
To save the search definition without running it, click Save from one of the Search Properties tabs.
•
To create a search using a different name than was initially entered, click Save As | Save As from one of the Search Properties tabs.
•
To save the search definition as the new default for new searches, click Save As | Save As Default from one of the Search Properties tabs.

Search Properties tabs

To define custom search criteria, use the Search Properties tabs, which are displayed across the bottom of the Searches page. The Search Properties tab pane consists of the following tabs:

•
Info tab
•
Who tab
•
What tab
•
Where tab
•
When tab
•
Origin tab
•
Alert tab (Search Properties tabs)
•
Report tab (Search Properties tabs)
•
Layout tab
•
SQL tab
•
XML tab
To display and enable the Search Properties tabs:
1
From the Searches page:
•
Click Show Properties
•
Right-click a folder (left pane) or search definition (right pane) and select Show Properties
•
Select a folder (left pane) or search definition (right pane) and click New | New Search
* 
NOTE: You can also display the Search Properties tabs from a Search Results tab, using Search Properties.
2
Use the “X” hide button in the upper right corner of the Search Properties tab pane to hide this pane.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating