Active Administrator 8.6.3 - User Guide

Auditing & Alerting

The Auditing & Alerting module helps you manage auditing and alerting needs. The audit agent collects and stores the events that you identify to the audit database. You can run reports on the collected information and send alert notifications to specified recipients. To manage the audit database, you can archive or purge selected data.

Topics 

•	Using the Auditing & Alerting landing page

•	Managing audit reports

•	Managing archive reports

•	Managing audit agents

•	Managing alerts

•	Managing event definitions

•	Archiving & purging audit events

Using the Auditing & Alerting landing page

Using the Auditing & Alerting landing page

The Auditing & Alerting landing page displays the active tiles for each feature in the section. The active tiles automatically update every 30 minutes, but you can use the icons to refresh the tiles at any time. You also can pause and resume the refresh of data. To customize the active tile refresh, see Setting general user options.

To use the auditing & alerting landing page

1	Select Auditing & Alerting.

2	To access the features in this section, click an active tile or choose from the tree.

▪	Audit Reports (See Managing audit reports.)

▪	Archives (See Managing archive reports.)

▪	Alerts & History (See Managing alerts.)

▪	Audit Agents (See Managing audit agents.)

▪	Event Definitions (See Managing event definitions.)

▪	Archive & Purging (See Archiving & purging audit events.)

Managing audit reports

Managing audit reports

Reports provide a means to filter the data in the audit database. Active Administrator® has default reports that display under User Reports. You also can create reports. All reports are stored in the Active Administrator database and are available to all users.

Topics 

•	Creating a new audit report

•	Creating a new audit report by copying a report

•	Running an audit report

•	Scheduling audit reports

•	Changing ownership of scheduled reports

•	Categorizing audit reports

•	Using tags to mark events

•	Adding a comment to an event

•	Grouping events

•	Viewing event details

To manage audit reports

1	Select Auditing & Alerting | Audit Reports.

The left pane displays the list of auditing reports that are grouped by categories. You also can designate reports to be listed under Favorites.

All Events (Last 24 Hours) is a snapshot of the audit database. The Applied Filters area displays the last 1000 events collected based on the applied filters and selected report.

2	Use the tool bar to manage the audit reports.

 

Table 61. Audit reports tool bar

Option	Description
Refresh All	Refresh the report list.
Refresh Selected	Refresh selected reports.
New	Create a new report. See Creating a new audit report.
Edit audit report	Edit the selected report.
Delete	Delete the selected report(s).
View	Generate a report to send as an email, to save to a file, or to open in a report editor. See Running an audit report.
Schedules	Schedule a report. See Scheduling audit reports. Change ownership of scheduled reports. See Changing ownership of scheduled reports
More | Copy As	Copy an existing report to create a new report. See Creating a new audit report by copying a report.
Categories	Manage report categories. See Categorizing audit reports.
Tags	Manage audit tags. See Using tags to mark events.
Grouping	Group events to organize the display. See Grouping events.

Creating a new audit report

Creating a new audit report

A wizard guides you through creating an audit report. You also can copy an existing report and make changes to create a new report. See Creating a new audit report by copying a report.

 

NOTE: If you want a report that identifies the user account that modified or deleted any audit reports, include the Active Administrator Audit Report Updated or Active Administrator Audit Report Deleted events.

To create a new report

1	Select Auditing & Alerting | Audit Reports.

2	Click New.

3	On the Welcome page, click Next.

4	Type a name and description for the report.

5	Click Next.

6	To display the report under Favorites, select the check box.

7	To display the results in a table format, select Export View. Otherwise, leave the check box unselected to generate a formatted report.

8	To categorize the report, browse to choose a category. See Categorizing audit reports.

9	By default, all comments attached to an event are included. You can choose to exclude all comments or include only a set number of the most recent comments.

10	Click Next.

11	By default, the report is filtered by today’s date. You can add additional filters to the report.

To add filters

a	Click Add Filter.

b	Select a filter from the list.

The Edit Report Filter page lists all the possible filters, but opens to the filter that you selected. You can continue to define the filter you selected and add additional filters.

c	Select a filter to add a definition.

 

Table 62. Audit report filters

Filter	Description
Date/Time Range	By default, the Date/Time Span filter is set to 1 day. You can change this filter and add other filters by selecting a filter in the list. On each filter, all items are selected by default. You can choose to include or exclude selected items.
Acting Users	By default, all users are included in the report results. You can include or exclude selected users.
Events	By default, all events are included in the report results. You can include or exclude selected events.
Domain Controllers	By default, all servers are included in the report results. You can include or exclude selected servers.
Event Description Filters	You can filter the report results by text that displays either in the Action Text column of the Report Results Preview area or in the Event Details area. To add a search value 1 Click Add. 2 Type a search value. 3 Choose whether to filter the Action Text column or the Event Details area. 4 Click OK. 5 Choose to include only events that include the search value or do not include the search value in their descriptions. 6 Choose to include all or any of the lines shown in the Search Values area. NOTE: If you want to use Full-Text Search to filter the event descriptions, you must first install Full-Text Search, and then enable Full-Text Search in Active Administrator. For more information on installing Full-Text Search, refer to the documentation for SQL Server® Database Engine. To enable Full-Text Search in Active Administrator, use the AA Server Manager tool. See Managing the Active Directory server.
Event Log ID’s	By default, all Event IDs are included in the report results. You can include or exclude specific Event IDs.
Affected Object Locations	By default, all Object Locations are included in the report results. You can include or exclude specific Object Locations.
Affected Object Types	By default, all Object Types are included in the report results. You can include or exclude specific Object Types.
Failure/Success	By default, all Event Types are included in the report results. You can include or exclude specific Event Types.
Event Tags	By default, all Tags are included in the report results. You can include or exclude specific Tags. See Using tags to mark events.
Comments Mask	You can filter the report results by text that displays in the Comments area of the Event Details. See Adding a comment to an event and Viewing event details.
Attributes	You can filter the report results by changes in their attributes. You can search for the value before the change or after the change. To add an attribute 1 Click Add. 2 Type an Attribute. 3 Choose whether a Value is before the change occurred or after the change occurred. 4 Click OK.

12	Click Next.

13	Review the summary, and click Finish.

14	Click Finish.