Chat now with support
Chat with Support

Change Auditor for EMC 7.3 - User Guide

Install EMC Event Enabler Framework

* 
NOTE: This guide outlines the installation steps that are required for Change Auditor to integrate with the EMC Event Enabler Framework. For detailed installation steps, see the appropriate guides from EMC Corporation. See the EMC Corporation website (http://www.emc.com/) for information about downloading EMC product executables.
1
Download the Common Event Enabler (CEE) Framework compatible with your device from the EMC website and install on one or more Windows servers where you want to monitor activity. The server must also have an agent installed.
2
Install the EMC Common Event Publishing Agent (CEPA) Auditing which enables Change Auditor to monitor the file system activity on EMC.
* 
NOTE: For Isilon or Unity NAS servers, the installation process is complete. Skip the next two steps.
NOTE: Change Auditor for EMC does not support automatic Isilon of Unity auditing configuration. See EMC Isilon Auditing and EMC Unity Auditing for more information about the manual configuration required.
3
Create a configuration file (cepp.conf file) before using the CEPA auditing feature. The cepp.conf file contains the information to connect Data Movers to the Windows computers where the CEE software is installed. You can either manually create the cepp.conf file or use Change Auditor to create this configuration file later.
4
If you manually created the cepp.conf file, start the CEPA facility and then verify that it has started. Use the following command syntax to start the CEPA facility and to check its status:
•
$ server_cepp <DataMoverName> -service -start
•
$ server_cepp <DataMoverName> -service -status

Create EMC Auditing template

You need to define an EMC auditing template for each EMC file server (CIFS) to be audited. In addition to defining the EMC file server (CIFS) to audit and the agents to receive these events, completing this step also installs the Shared EMC Connector service (QCeeService). This service enables auditing of EMC devices by multiple Quest software products. This service is required because EMC supports only one auditing pool at a time.

* 
NOTE: The cepp.conf file contains the information to connect Data Movers to the Windows computers where the CEE is installed and stores the auditing configuration. If you manually created the cepp.conf, you can update the configuration file during template creation. More specifically, it adds a ‘quest servers’ pool name entry to the existing configuration file specifying the Change Auditor agents assigned to receive the EMC events.
* 
NOTE: Ensure that the servers that you deploy agents to have CEPA Auditing installed.

Client components and features

The following table lists the client components and features that require a valid Change Auditor for EMC license. You are not prevented from using these features; however, associated events are not captured unless the proper license is applied.

* 
NOTE: To hide unlicensed Change Auditor features from the Administration Tasks tab (including unavailable audit events throughout the client), select Action | Hide Unlicensed Components. This command is only available when the Administration Tasks tab is the active page.

 

Table 1. Change Auditor for EMC client components and features
Client page
Feature

Administration Tasks Tab

Agent Configuration Page:

•
Event Logging - enable/disable EMC event logging
NOTE: See EMC event logging for information about enabling EMC event logging.
•
Configuration Setup Dialog - File System Tab
•
Discard duplicates that occur within nn seconds
•
Audit all configured, including duplicates (Not Recommended)
NOTE: See File System events settings for details about these File System Events settings.

Audit Task List:

•
EMC
NOTE: See EMC auditing templates for information about creating templates to define EMC auditing.

Event Details Pane

What Details:

•
Path
•
Process

Events

Facilities:

•
EMC

Search Properties

What Tab:

•
Subsystem | File System
NOTE: See Create custom EMC searches for information about using the What tab to create custom EMC search queries.

Searches Page

Built-in Reports:

•
Reports that include EMC events

 

Getting Started

•
Introduction
•
Verify auditing template is applied
•
Make changes and run a report
•
Troubleshooting steps
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating