Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Change Auditor 7.3 - User Guide

Table of Contents

Change Auditor Overview

Available Change Auditor auditing modules

Agent Deployment

Deployment page Deploy agents Change the agent installation location and system tray option Enable auto deployment Refresh or clear Deployment page information

Change Auditor Client Overview

Starting the Change Auditor client Accessing Change Auditor news and updates Managing connection profiles

Connection wizard

Client components Customize table content

Sort data Resize or move columns Add or remove columns Group data

Using custom filters

Directory object picker

Overview My Favorite Search Define a favorite search Overview panes

Top Agent Activity Recent Event Activity Count of Events By Agent Status Coordinator Status

Event Details pane

Introduction Searches page

Explorer view Searches list Search Properties tabs

View a list of available searches Run searches Run a quick search

Search Results and Event Details

Introduction Search Results page

Search Results grid Search Properties tabs Event Details pane

View search results

Display results in different formats

Preview search results Compare results side-by-side View event details or search properties Copy event details Email event details Add comments View user context and run related searches Protect critical objects, mailboxes, files and folders Add search properties to existing event queries

Custom Searches and Search Properties

Introduction Create a custom search Search Properties tabs

Info tab Who tab What tab Where tab When tab Origin tab Alert tab Report tab Layout tab SQL tab XML tab

Enable Alert Notifications

Introduction Alert tab (Search Properties tabs) Enable alerts Disable alerts Alert History page View alert history View event details or alert properties

Administration Tasks

Administration Tasks tab Administration Task lists Export/import Administration Task settings

Agent Configurations

Introduction Agent Configuration page Define agent configurations Assign agent configurations to server agents Enable event logging

Coordinator Configuration

Coordinator Configuration page SMTP Configuration Configure email alert notifications/reports Customize alert email content Shared Folder Configuration Group Membership Expansion Add groups to Group Membership Expansion list Agent Heartbeat Check Disconnect client after 30 minutes of inactivity Scheduled Task Handling

Purging and Archiving your Change Auditor Database

Introduction Planning your jobs Purge and Archive page Create and maintain jobs Purge and Archive wizard Purge selected records

Disable Private Alerts and Reports

Introduction Private Alerts and Reports page Disable private alerts and reports

Generate and Schedule Reports

Schedule reports for distribution

Create global report template Define report content and layout Enable and schedule reporting

Launch Report Designer Publish reports Print or save a page's contents

SQL Reporting Services Configuration

Introduction SQL Reporting Services Page SQL Reporting Services Templates SQL Reporting Services Wizard

Change Auditor User Interface Authorization

Introduction Application User Interface Authorization page Add task definition Add role definition Add application group Remove a task definition

Client Authentication

Introduction Client Authentication Page

Changing authentication methods

Certificate authentication for client coordinator communication

Installation settings Deployment Coordinator configuration Windows client configuration

Integrating with On Demand Audit

Managing a Quest On Demand Audit integration

Creating an On Demand Audit configuration Working with an On Demand Audit configuration

Enable/Disable Event Auditing

Introduction Audit Events page Enable/disable event auditing Modify event's severity level or event class description Define events to be captured based on results View event information

Account Exclusion

Introduction Excluded Accounts Auditing page Excluded Accounts templates Excluded Accounts wizard

Registry Auditing

Introduction Registry Auditing page Registry Auditing templates Registry Auditing wizard

Service Auditing

Introduction Services Auditing page Service Auditing templates Service Auditing wizard

Agent Statistics and Logs

Introduction Agent Statistics page

Agent Statistics grid Resource Properties pane

Machine Info page Processors page Drives page Shares page Services page Exchange Mailboxes page

Agent system tray icon

Change Auditor Agent Status dialog

View agent status/statistics Manage Change Auditor agents Agent Log page View and save agent trace logs

Coordinator Statistics and Logs

Introduction Coordinator Statistics page Coordinator system tray icon

Change Auditor Coordinator Status dialog Coordinator Configuration tool

View coordinator status and statistics Manage Change Auditor coordinators Coordinator Log page View and save coordinator trace logs

Change Auditor Commands

Menu commands Tool bar buttons Right-click commands

Change Auditor Email Tags

Introduction

In addition to the overview information provided in the Coordinator Status pane on the Overview page, you can obtain coordinator status and statistics through the following options:

•

The Coordinator Statistics page which provides a global view of all installed coordinators, including the current status and other usage statistics for each coordinator.

•

The Change Auditor Coordinator Status dialog, which is accessed using the coordinator system tray icon, provides the status and usage statistics for a single coordinator.

You can also view or retrieve coordinator trace logs from the Coordinator Statistics page or by using the coordinator system tray icon.

Coordinator Statistics page

Use the View | Statistics | Coordinator menu command to display the Coordinator Statistics page, which provides a global view of all installed coordinators, including the current status of the coordinators.

The Coordinator Statistics page may contain the following information for each coordinator. The following table identifies the fields that are displayed by default. To display different fields, click the Field Chooser button located to the far left of the column headings and select the required columns:


	NOTE: All dates and times are based on the client’s current local date and time. The format used to display the date and time is determined by the local computer’s regional and language setting.

Table 1. Coordinator Statistics page: Field descriptions

Agents Connected

Displays the number of agents to which this coordinator is connected.

Alerts Last 24 Hours

Displays the number of alerted event entries in the last 24 hours of the coordinator operation.

The value in this field is a hypertext link and when selected displays the alerts generated in the last 24 hours.

Alerts Last Hour

Displays the number of alerted event entries in the last 60 minutes.

The value in this field is a hypertext link and when selected displays the alerts generated in the last 60 minutes.

Displays the number of alerted event entries since local midnight today.

The value in this field is a hypertext link and when selected displays the alerts generated since local midnight today.

Displays the number of alerted events found in the coordinator database.

The value is this field is a hypertext link and when selected displays the alerts in the coordinator database.

Alerts Yesterday

Displays the number of alerted event entries from local midnight today to local midnight yesterday.

The value in this field is a hypertext link and when selected displays the alerts generated yesterday.

Displays whether the coordinator is installed in a 32-bit (x86) or 64-bit (x64) environment.

Displays the port number assigned to the coordinator Service Connection Point (SCP).

Displays the computer name of the coordinator.

Coordinator FQDN

Displays the fully qualified domain name of the coordinator.

Displays the ID of the coordinator that processed the event.

Displays the name assigned to the coordinator database during the coordinator installation.

Displays the name of the SQL instance that is being used for the coordinator database.

Displays the size of the coordinator database, in kilobytes.

Displays the name of the domain where the coordinator is located.

Events Last 24 Hours

Displays the number of event entries received from all agents in the last 24 hours of coordinator operation.

The value in this field is a hypertext link and when selected launches a quick search to display the events generated in the last 24 hours.

Events Last Hour

Displays the number of event entries received in the last 60 minutes of the coordinator operation.

The value in this field is a hypertext link and when selected launches a quick search to display the events generated in the last 60 minutes.

Displays the number of events encountered since 12:00 a.m. of the current day (based on the relative coordinator computer's time).

The value in this field is a hypertext link and when selected launches a quick search to display the events generated today.

Displays the number of entries found in the coordinator events database.

The value in this field is a hypertext link and when selected launches a quick search to display all events encountered since the agent was started.

Events Yesterday

Displays the number of events encountered between 12:00 a.m. yesterday and 12:00 a.m. of the current day (based on the relative coordinator computer's time).

The value in this field is a hypertext link and when selected launches a quick search to display the events generated yesterday.

Displays the name of the forest where the coordinator resides.

Displays the date and time when the coordinator was last initialized.

Displays the current status of the coordinator:

•

•

•

•

Displays how long the coordinator has been running.

Displays the current coordinator version installed on the server.

Coordinator system tray icon

During the coordinator installation process, Change Auditor automatically loads an icon in the system tray of each coordinator. This system tray icon allows you to enable/disable the coordinator, display the status of the coordinator installed on the current machine, and to change the database instance and service accounts used to access the database. Whenever a coordinator is not active, a status indicator will appear in the lower left corner of this icon to represent its current status:

•

•

Yellow - initializing

By right-clicking on the coordinator icon in the system tray, a context menu is displayed which consists of the following commands:

Table 2. Coordinator system tray icon: Right-click commands

Coordinator Status

Displays the Coordinator Status dialog which assists you in determining if the coordinator is running, what version is installed and how active the coordinator is.

See Change Auditor Coordinator Status dialog for a full description of this status dialog.

Enable/Disable Coordinator

Starts or stops the coordinator.

View Coordinator Log

Opens the log viewer to review the events recorded in the coordinator log (ChangeAuditor.ServiceLog.nptlog).

For example: %ProgramFiles%\Quest\ChangeAuditor\Service\Logs\ChangeAuditor.ServiceLog.nptlog

Coordinator Configuration

Starts the Coordinator Configuration Tool which allows you to:

•

modify the credentials used to access the coordinator database

•

specify a ‘static’ port to be used for communication with the coordinator

•

specify where the Active Directory/GPO protection templates are to be stored: SQL (default) or Active Directory

See Coordinator Configuration tool for a description of how to use this utility.

Load On Startup

Automatically loads the system tray application when the coordinator starts.

Display information about Change Auditor including the installed version number and licensing information.

Closes the system tray application.

Change Auditor Coordinator Status dialog

The Change Auditor Coordinator Status dialog helps you determine if the coordinator is running and what version is installed on the server. The other status information on the dialog is broken down into the following sections:

•

Coordinator Information - displays the status, version number, SCP port and installation name for the coordinator

•

Database Information - displays the coordinator database server, name and size

•

Agent Connections to this Coordinator - displays the total number of agents that are connected to the coordinator

•

Events and Alerts on this Coordinator - displays status information regarding events, alerts, and search activities for this particular coordinator

•

Agent Ports on this Coordinator - displays all ports used for communication.

The Change Auditor Coordinator Status dialog contains the following information:

Table 3. Change Auditor Coordinator Status dialog: Status information

Coordinator Information

Coordinator Status

Displays the current status of the coordinator:

•

•

•

•

This value will normally be ‘Running’. If the credentials supplied for the database access during the coordinator installation are incorrect or have expired, this field will display ‘Not Running’ indicating that the coordinator did not successfully start. If this happens, use the Database Configuration Utility to change the permissions trying to access the database.

Installation Name

Displays the installation name assigned to the coordinator during installation.

Displays the current version of the coordinator installed on the server.

Database Information

Displays the name of the server where the coordinator resides.

Database Catalog

Displays the name assigned to the coordinator database during the coordinator installation.

Displays the size of the coordinator database, in megabytes.

Database Free Space

Displays the available free space in the coordinator database.

Agent Connections to This Coordinator

Agents Connected (Total)

Displays the total number of agents connected to this coordinator.

Events and Alerts on This Coordinator

Displays the number of events this coordinator has received since it was last started.

Events in Receive Buffer

Displays the number of events that have not yet been processed by this coordinator and forwarded to the client.

Average Events Per Second

Displays the average number of events processed by this coordinator per second.

Agent Ports on This Coordinator

Client SCP Port

Displays the port number assigned to the coordinator Service Connection Point (SCP).

Public SDK Port

Displays the port number assigned for external applications to access the coordinator.

Displays the port number assigned to the agents to communicate with the coordinator.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center