Change Auditor for EMC 7.0.2 - Event Reference Guide

Introduction

Change Auditor for EMC tracks, audits and alerts on file and folder changes in real time, translating events into simple text and eliminating the time and complexity required by native auditing. The auditing scope can be set on an individual file or folder or an entire file system recursive or non-recursive. Change Auditor for EMC also allows you to include or exclude certain files or folders from the audit scope in order to ensure a faster and more efficient audit process.

In addition to real-time event auditing, you can also enable event logging to capture EMC events locally in a Windows event log. This event log can then be collected using InTrust to satisfy long-term storage requirements.

NOTE: EMC auditing and event logging are ONLY available if you have licensed Change Auditor for EMC and defined an EMC Auditing template for each EMC file server (CIFS) to be audited. Contact your Sales Representative for more information on obtaining Change Auditor for EMC.

This document lists the events that can be captured by Change Auditor for EMC. Separate event reference guides are provided that list the core Change Auditor events (when any Change Auditor license is applied) and the events captured when the different auditing modules are licensed.

Change Auditor for EMC Events

Change Auditor for EMC queries EMC Celerra/VNX/Isilon file servers for modifications made to files and folders. This chapter lists the audited events captured by Change Auditor when Change Auditor for EMC is licensed and an EMC Auditing template is created for each EMC file server (CIFS) to be audited. These events are listed in alphabetical order by facility:

Change Auditor Internal Auditing

CEPP Configuration Changed

Created when the cepp.conf configuration file is changed by another user or third-party application. The change to this configuration file may prevent Change Auditor for EMC from capturing EMC events.

Medium

EMC

Table 2. EMC events

EMC File Access Rights Changed (no from-value)

Created when file access rights have changed on a file server.

For more information see, Note 3, Note 5, and Note 6.

Medium

EMC File Contents Written

Created when the contents of a file was written on a file server.

Medium

EMC File Created

Created when a file is created on a file server.

Medium

EMC File Deleted

Created when a file is deleted on a file server.

Medium

EMC File Moved

Created when a file is moved on a file server.

Medium

EMC File Opened

Created when a file is opened on a file server.

Medium

EMC File Ownership Changed (no from-value)

Created when the ownership of a file is changed on a file server.

For more information see, Note 3 and Note 6.

Medium

EMC File Renamed

Created when a file is renamed on a file server.

Medium

EMC Folder Access Rights Changed (no from-value)

Created when the access rights of a folder have changed on a file server.

For more information see, Note 3, Note 5, and Note 6.

Medium

EMC Folder Created

Created when a folder is created on a file server.

For more information see,Note 2

Medium

EMC Folder Deleted

Created when a folder is removed from a file server.

For more information see,Note 2

Medium

EMC Folder Moved

Created when a folder is moved on a file server.

For more information see,Note 2

Medium

EMC Folder Ownership Changed (no from-value)

Created when the ownership of a folder has changed on a file server.

For more information see, Note 3 and Note 6.

Medium

EMC Folder Renamed

Created when a folder is renamed on a file server.

Medium

自助服务工具
知识库
通知和警报
产品支持
下载软件
技术说明文件
用户论坛
视频教程
联系我们
获得许可 帮助
技术支持
查看全部
相关文档