Chat now with support
Chat with Support

Change Auditor for EMC 7.3 - User Guide

Introduction

You can create custom search definitions to search for file and/or folder changes to a specific EMC file, folder or volume. You will use the Search Properties tabs across the bottom of the Searches page to define new custom searches.

 

Create custom EMC searches

The following scenarios explain how to use the What tab to create custom EMC searches.

Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all Change Auditor users.
3
Click New at the top of the Searches page.
5
Open the What tab, expand Add and select Subsystem | File System.
By default, All Actions is selected meaning that all of the actions associated with the file system path will be included in the search.
8
Click OK to save your selection and close the dialog.
9
Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all Change Auditor users.
3
Click New at the top of the Searches page.
5
Open the What tab, expand Add and select Subsystem | File System.
This Object - select to search only the selected object.
This Object and Child Objects Only - select to search the selected object and its direct child objects.
This Object and All Child Objects - select to include the selected object and all subordinate objects (in all levels)
7
In the Path field, enter or use the browse button to select the EMC path to be searched.
NOTE: If the scope of your search is This Object, you can use the * wildcard character to specify the EMC path. That is, use an asterisk (*) to substitute zero or more characters.

When using the This Object option, be sure to select the appropriate Type option to define the type of path to be searched: Files or Folders.

By default, All Actions is selected meaning that all of the actions associated with the path will be included in the search.
When the scope includes child objects, All Types are selected by default meaning that all types of paths will be searched. If you selected the This Object scope option, Files is selected by default, which can be changed to Folders. Only one type can be selected.
9
Click OK to save your selection and close the dialog.
10
Click Run to save and run the search. Click Save to save the search definition without running it.
Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all Change Auditor users.
3
Click New at the top of the Searches page.
5
Open the What tab, click Add (or expand Add and select Event Class).
6
On the Add Facilities or Event Classes dialog, enter EMC in the filter field under the Facility heading to display all of the EMC events.
7
From this list, select one or more events and use the Add | Add This Event option to add the selected events to the list box at the bottom of the dialog. Click OK to save your selection and close the dialog.
8
Click Run to save and run the search. Click Save to save the search definition without running it.

 

Performance Considerations

This section contains strategies to help minimize performance issues.

Change Auditor agent performance

Performance is directly linked to the CPU speed and network latency of the server hosting the Change Auditor agent collecting the EMC events.

To improve agent performance, you can:

See System overview for more information.

You can also improve performance by assigning an EMC Auditing template to more than one agent. When multiple agents are assigned to the same EMC Auditing template, events will be load balanced and events will be sent to each agent round-robin style.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating