Chat now with support
Chat with Support

Change Auditor 7.3 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Exchange Mailboxes page

For Exchange Mailbox servers, the Exchange Mailboxes page displays a list of the Exchange mailbox databases on the selected server.

Agent system tray icon

An agent icon in the system tray allows you to enable, disable, or display the status of the agent installed on the current server.

* 
NOTE: The agent system tray icon is only available for server agents.

Whenever an agent is not active, a status indicator will appear in the lower left corner of this icon to represent its current status:

•
Red - inactive
•
Yellow - initializing

You can load the agent system tray icon using one of the following methods:

•
Click Advanced Options on the Deployment page to launch the Advanced Deployment Options dialog. From this dialog, select the Yes option for the Launch ServiceStatusTray on startup setting.
* 
NOTE: By default, the Do not change option is selected which indicates that you want to use the current setting for the agent system tray icon. That is, if you already have it set to launch on startup it will continue to operate that way. Similarly, it will not launch on startup if this is a clean install and you have not previously set it up to do so.
•
Navigate to %ProgramFiles%\Quest\ChangeAuditor\Agent and double-click on the ServiceStatusTray.exe file.

By right-clicking on the agent system tray icon, a context menu is displayed which consists of the following commands:

 
Table 8. Agent system tray icon: Right-click commands
Command
Description

Agent Status

Displays the Change Auditor Agent Status dialog which assists you in determining if the agent is running, what version is installed, and how active the agent is. See Change Auditor Agent Status dialog for a full description of this status dialog.

Enable/Disable Agent

Starts or stops the agent service.

Find More Connections / Retry Connections

Looks for more coordinators in a forest than the agent automatically found.

NOTE: An agent automatically connects to a coordinator in its own site. However, if a coordinator is not available in the site it will then search for a coordinator in the forest.

When the agent is connected to a coordinator that is not currently running, use the Retry Connections command to reattempt to connect to a coordinator.

Refresh Configuration

Applies a new agent configuration to the selected agent.

NOTE: This command only available when the coordinator to which the agent is connected is running.

Coordinator Credential Configurator

Use to enter the credentials of the agent that can be used to find and connect to a coordinator in an Active Directory forest.

NOTE: This command is only available when you install a agent on a workgroup server.

View Agent Log

Opens the log viewer to review the events recorded in the Change Auditor agent log (ChangeAuditor.AgentLog.nptlog).

For example: %ProgramFiles%\Quest\ChangeAuditor\Agent\Logs\ChangeAuditor.AgentLog.nptlog

Load on startup

Automatically loads the system tray application when the agent service starts.

About

Displays information about the agent including the installed version number and licensing information.

Exit

Closes the system tray application.

Change Auditor Agent Status dialog

Change Auditor Agent Status dialog

The Change Auditor Agent Status dialog helps you determine if the agent is running and what version is installed on the domain controller. The other status information in the dialog is broken down into the following sections:

•
Agent Information - displays the status, version number, the coordinator installation name to which the agent is connected, and the agent’s database size
•
Events - displays audit event activity
•
Coordinator Connection - displays information regarding the connection between the agent and the coordinators

This dialog contains the following status information:

 
Table 9. Change Auditor Agent Status dialog: Status information
Field
Description
Agent Information

Agent is

The current agent status:

•
Running - the agent service is running
•
Initializing - the agent service has started but is still initializing
•
Not Running - the agent service is not currently running
•
Failed - the agent service failed to initialize

Version

The current version of the agent installed on the server.

Installation Name

The installation name assigned to the coordinator to which the agent is connected.

DB Size (KB)

The size of the agent database, in kilobytes. This is dependent on the number of monitored Active Directory, registry and file system objects, and the number of events queued for transmission to the coordinator. If a coordinator is not available, this database may become large. When the events are successfully sent to a coordinator, the database space is re-used for subsequent events, but the displayed database size will not decrease.

License

The licenses that are applied. Use the arrow controls to scroll through the licenses.

Events

Contains indicators of internal Change Auditor activity and may be used by Quest Support should they need to diagnose agent problems.

AD Events

If licensed (Change Auditor for Active Directory), this is the number of Active Directory related events processed by the agent. This field will be blank for agents running on member servers.

ADAM Events

If licensed (Change Auditor for Active Directory), this is the number of ADAM events processed by the agent.

Exchange Events

If licensed (Change Auditor for Exchange) and configured, this is the number of Exchange Mailbox events processed by the agent.

Local Security Events

If licensed (Change Auditor for Active Directory), this is the number of local user and group (SAM) events processed by the agent.

File System Events

If licensed (Change Auditor for Windows File Servers) and configured, this is the number of File System events processed by the agent.

Registry Events

If configured, this is the number of Registry events processed by the agent.

SQL Events

If licensed (Change Auditor for SQL Server) and configured, this is the number of SQL Server events processed by the agent.

NetApp Events

If licensed (Change Auditor for NetApp) and configured, this is the number of NetApp filer events processed by the agent.

EMC Events

If licensed (Change Auditor for EMC) and configured, this is the number of EMC events processed by the agent.

SharePoint Events

If licensed (Change Auditor for SharePoint) and configured, this is the number of SharePoint events processed by the agent.

Azure AD Events

If licensed (Change Auditor for Active Directory) and configured, this is the number of Azure AD events processed by the agent.

ADFS Events

If licensed (Change Auditor for Logon Activity) and configured, this is the number of ADFS events processed by the agent.

Logon Events

If licensed (Change Auditor for Logon Activity User), this is the number of user logon activity events processed by the agent.

Office 365 Events

If configured (Change Auditor for Exchange and Change Auditor for SharePoint), this is the number of Exchange Online, SharePoint Online, and OneDrive for Business events processed by the agent.

Other Events

This is the number of events processed by the agent that do not ‘fit’ into the other event categories (such as Authentication Services events, Service events, etc.).

FluidFS Events

If licensed (Change Auditor for FluidFS), this is the number of Fluid File System events processed by the agent.

Excluded Events

If configured, this is the number of events excluded by the agent because they originated from a user or computer that was defined as an excluded account.

Skype for Business Events

If licensed (Change Auditor for Skype for Business) and configured, this is the number of Skype for Business events processed by the agent.

Coordinator Connection

Connected

The computer name (and SCP port) of the coordinators to which this agent is currently connected.

NOTE: For more details on agent connection behavior, see Installation Notes and Best Practices in the Quest Change Auditor Installation Guide.

All

The list of all available coordinators in the installation.

Last Conf Update

The time when the agent last downloaded the agent configuration information/settings.

Events Last Sent

The local time when the last event was sent. If no events have been detected by Change Auditor recently, this time may be fairly old.

Events Sent

The number of events that have been sent to a coordinator since the agent was last started.

Acknowledged

The number of events that a coordinator has acknowledged.

Normally, this value will be the same as the Events Sent. However, it may be smaller if the coordinator is not running or if a large number of events are being processed by the coordinator which may be slowing it down. Events may also be lost due to communication problems, in which case the agent will try to re-send the events.

Events Waiting

The number of events in the agent database that are waiting to be forwarded to a coordinator.

This value should be at or near zero when the server is idle, but can grow if it is busy. If the value never returns to zero, it may indicate that the agent is having difficulty communicating with the coordinator service. If this is the case, contact Technical Support for assistance.

View agent status/statistics

To view agent status/statistics (Overview page):
1
Open the Overview page and if the Top Agent Activity pane is not displayed, click the arrow on the heading of one of the overview panes and select Top Agent Activity.
This pane displays the top most active agents in your environment, based on the data range specified.
2
By default, the agent activity on all servers for the past month, excluding uninstalled agents, is displayed. Use the controls at the top of this pane to specify the type of agented objects to be included as well as the date range.
3
The values in the Audited Events column are links, which when selected will open up a new Search Results tab to display the related details for these events.
4
If the Agent Status pane is not displayed, click the arrow on the heading of one of the overview panes and select one of the following commands:
•
Agent Status | Enterprise View
•
Agent Status | <domain>
5
By default, this pane will only include active and inactive (installed) agents in the pie chart. You can however, select the Show Uninstalled Agents check box to include agents that are set as ‘uninstalled’ in the pie chart.
6
Double-clicking the pie chart will display the Agent Statistics page.
To view agent status/statistics (Agent Statistics page):
1
Open the Agent Statistics page and click Refresh to retrieve updated information.
2
Click Show Uninstalled Agents to include uninstalled agents. Click Hide Uninstalled Agents to exclude uninstalled agents from the display.
The values in the different event columns are links, which when selected will open up a new Search Results tab to display the related details for these events.
To view agent status/statistics on the current agent only (agent system tray icon):
* 
NOTE: The agent system tray icon can be loaded using one of the following methods:
•
Click Advanced Options on the Deployment page to display the Advanced Deployment Options dialog. From this dialog, select the appropriate Launch ServiceStatusTray on startup option (Yes or Do not change).
•
Navigate to %ProgramFiles%\Quest\ChangeAuditor\Agent and double-click the ServiceStatusTray.exe file.
1
Right-click the system tray icon and select Agent Status.
This opens the Change Auditor Agent Status dialog, which displays agent information (including if the agent is running), event activity for the agent and coordinator connection information.
2
Click OK.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating