Chat now with support
Chat with Support

Change Auditor 7.4 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Add search properties to existing event queries

After selecting a specific event from the results of a search, you can further refine your search criteria. Expand Add to Search to display the available options for refining your current search. These options are produced from the details of the selected event and may differ between event types.

Choosing a criteria from this list will add it to your current search. You can then preview the refined results before saving the search. Once saved, the new search criteria will be permanent.

Custom Searches and Search Properties

•
Introduction
•
Create a custom search
•
Search Properties tabs

Introduction

You can create custom search definitions to search for the configuration changes that need to be tracked in your environment. The search properties tabs across the bottom of the Searches page allows you to define new custom searches.

 

Two new columns have been added as of Change Auditor 7.0 that allow you to display extra information through the search Layout tab:

Table 1. Available columns
Layout Tab
Search Column Name
Description

Origin - AD Site Name

Origin AD Site

The Active Directory site of the computer from which the event originated.

User- Is Administrator

Administrator

‘Yes’ indicates that the user is a direct or indirect member of the local Administrators, Active Directory Administrators, Domain Admins or Enterprise Admins groups.

NOTE: You can now filter searches to include or exclude users with the Administrator right.

Create a custom search

The following procedure provides the ‘general’ steps involved in creating a custom search.

* 
NOTE: Selecting the Private folder creates a search that only you can run and view. Selecting the Shared folder creates a search that all users can run and view.
To define a new search:
1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.
3
Click New at the top of the Searches page.
4
On the Search Properties tabs, enter the search criteria to use:
•
Info — enter a name and description for the search
•
Who — allows you to search for events generated by a specific user, computer or group
•
What — allows you to search for events based on subsystem, event class, object class, severity, or result
•
Where — allows you to search for events captured by a specific agent, domain or site
•
When — allows you to search for events that occurred during a specified date and time range
•
Origin — allows you to search for events that originated from a specific workstation or server
 
* 
NOTE: When you specify criteria on more than one search properties tab (for example, Who, What and Where tabs), Change Auditor first evaluates each individual tab’s criteria and then chains the individual tab’s criteria together using the ‘AND’ operator, returning only those events that meet all the specified search properties.
5
To be notified when an event is captured as a result of this custom search, open the Alert tab to enable and define how and where to dispatch alerts when the selected search criteria is met. See Enable Alert Notifications for more information about setting up alert notifications.
6
Once you have defined the search criteria to use, you can either save the search definition or run the search.
•
To save and run the search, click Run from one of the Search Properties tabs.
•
To save the search definition without running it, click Save from one of the Search Properties tabs.
•
To create a search using a different name than was initially entered, click Save As | Save As from one of the Search Properties tabs.
•
To save the search definition as the new default for new searches, click Save As | Save As Default from one of the Search Properties tabs.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating