• 成为门户专家
• 下载
• 打印
• 我的下载 ()

• 支持
• 技术说明文件
• Change Auditor 7.4
• Change Auditor 7.4 - User Guide

Change Auditor 7.4 - User Guide

内容导航  

Change Auditor Overview

Available Change Auditor auditing modules

Agent Deployment

Deployment page Using group Managed Service Accounts (gMSA) Deploy agents Connect to a different foreign forest/update credentials Change the agent installation location and system tray option Enable auto deployment Refresh or clear Deployment page information

Change Auditor Client Overview

Starting the Change Auditor client Accessing Change Auditor news and updates Managing connection profiles

Connection wizard

Client components Customize table content

Sort data Resize or move columns Add or remove columns Group data

Filter data

Using custom filters

Directory object picker

Overview Page

Overview My Favorite Search Define a favorite search Overview panes

Top Agent Activity Recent Event Activity Count of Events By Agent Status Coordinator Status

Event Details pane

Searches

Introduction Searches page

Explorer view Searches list Search Properties tabs

View a list of available searches Run searches Run a quick search

Search Results and Event Details

Introduction Search Results page

Search Results grid Search Properties tabs Event Details pane

View search results

Display results in different formats

Preview search results Compare results side-by-side View event details or search properties Copy event details Email event details Add comments View user context and run related searches Protect critical objects, mailboxes, files and folders Add search properties to existing event queries

Custom Searches and Search Properties

Introduction Create a custom search Search Properties tabs

Info tab Who tab What tab Where tab When tab Origin tab Alert tab Report tab Layout tab SQL tab XML tab

Enable Alert Notifications

Introduction Alert tab (Search Properties tabs) Enable alerts Disable alerts Alert History page View alert history View event details or alert properties

Administration Tasks

Administration Tasks tab Administration Task lists Export/import Administration Task settings

Agent Configurations

Introduction Agent Configuration page Define agent configurations Assign agent configurations to server agents Enable event logging

Coordinator Configuration

Coordinator Configuration page Configure email alert notifications/reports Customize alert email content Shared Folder Configuration Group Membership Expansion Add groups to Group Membership Expansion list Agent Heartbeat Check Disconnect client after 30 minutes of inactivity Scheduled Task Handling

Purging and Archiving your Change Auditor Database

Introduction Planning your jobs Purge and Archive page Create and maintain jobs Purge and Archive wizard Purge selected records

Disable Private Alerts and Reports

Introduction Private Alerts and Reports page Disable private alerts and reports

Generate and Schedule Reports

Schedule reports for distribution

Create global report template Define report content and layout Enable and schedule reporting

Launch Report Designer Publish reports Print or save a page's contents

SQL Reporting Services Configuration

Introduction SQL Reporting Services Page SQL Reporting Services Templates SQL Reporting Services Wizard

Change Auditor User Interface Authorization

Introduction Application User Interface Authorization page Add task definition Add role definition Add application group Remove a task definition

Client Authentication

Introduction Client Authentication Page

Changing authentication methods

Certificate authentication for client coordinator communication

Introduction

Installation settings Deployment Coordinator configuration Windows client configuration

Integrating with On Demand Audit

Managing a Quest On Demand Audit integration

Creating an On Demand Audit configuration Working with an On Demand Audit configuration

Enable/Disable Event Auditing

Introduction Audit Events page Enable/disable event auditing Modify event's severity level or event class description Define events to be captured based on results View event information

Account Exclusion

Introduction Excluded Accounts Auditing page Excluded Accounts templates Excluded Accounts wizard

Registry Auditing

Introduction Registry Auditing page Registry Auditing templates Registry Auditing wizard

Service Auditing

Introduction Services Auditing page Service Auditing templates Service Auditing wizard

Agent Statistics and Logs

Introduction Agent Statistics page

Agent Statistics grid Resource Properties pane

Machine Info page Processors page Drives page Shares page Services page Exchange Mailboxes page

Agent system tray icon

Change Auditor Agent Status dialog

View agent status/statistics Manage Change Auditor agents Agent Log page View and save agent trace logs

Coordinator Statistics and Logs

Introduction Coordinator Statistics page Coordinator system tray icon

Change Auditor Coordinator Status dialog Coordinator Configuration tool

View coordinator status and statistics Manage Change Auditor coordinators Coordinator Log page View and save coordinator trace logs

Change Auditor Commands

Menu commands Tool bar buttons Right-click commands

Change Auditor Email Tags

• Viewing Topics 185 - 188 of 203

×

View agent status/statistics

To view agent status/statistics (Overview page):

1	Open the Overview page and if the Top Agent Activity pane is not displayed, click the arrow on the heading of one of the overview panes and select Top Agent Activity.

This pane displays the top most active agents in your environment, based on the data range specified.

2	By default, the agent activity on all servers for the past month, excluding uninstalled agents, is displayed. Use the controls at the top of this pane to specify the type of agented objects to be included as well as the date range.

3	The values in the Audited Events column are links, which when selected will open up a new Search Results tab to display the related details for these events.

4	If the Agent Status pane is not displayed, click the arrow on the heading of one of the overview panes and select one of the following commands:

•	Agent Status | Enterprise View

•	Agent Status | <domain>

5	By default, this pane will only include active and inactive (installed) agents in the pie chart. You can however, select the Show Uninstalled Agents check box to include agents that are set as ‘uninstalled’ in the pie chart.

6	Double-clicking the pie chart will display the Agent Statistics page.

To view agent status/statistics (Agent Statistics page):

1	Open the Agent Statistics page and click Refresh to retrieve updated information.

2	Click Show Uninstalled Agents to include uninstalled agents. Click Hide Uninstalled Agents to exclude uninstalled agents from the display.

The values in the different event columns are links, which when selected will open up a new Search Results tab to display the related details for these events.

To view agent status/statistics on the current agent only (agent system tray icon):

NOTE: The agent system tray icon can be loaded using one of the following methods: • Click Advanced Options on the Deployment page to display the Advanced Deployment Options dialog. From this dialog, select the appropriate Launch ServiceStatusTray on startup option (Yes or Do not change). • Navigate to %ProgramFiles%\Quest\ChangeAuditor\Agent and double-click the ServiceStatusTray.exe file.

1	Right-click the system tray icon and select Agent Status.

This opens the Change Auditor Agent Status dialog, which displays agent information (including if the agent is running), event activity for the agent and coordinator connection information.

2

Click OK.

Manage Change Auditor agents

To stop an agent (Agent Statistics page):

NOTE: You can use the Action | Agent Notifications menu command to hide (or display) the desktop notifications that are displayed when these processes are performed.

1	Open the Agent Statistics page.

2	Select the agent to stop and click Stop Agent.

NOTE: The Stop Agent command is only available when an agent is ‘Active’.

3	An information message is displayed, click OK to stop the agent.

4	In addition, a desktop notification is displayed in the lower right-hand corner of your screen explaining that the selected agent is being disconnected from a specific coordinator.

Once disconnected, the agent’s status will be changed to ‘Inactive’ on the Agent Statistics page.

5	If you so choose, click Set Agent Uninstalled to flag the selected agent as ‘Uninstalled’.

6	Click Show Uninstalled Agents to include uninstalled agents in the Agent Statistics list. Click Hide Uninstalled Agents to exclude uninstalled agents from the display.

To stop an agent (agent system tray icon):

NOTE: The agent system tray icon is only available for server agents.

1	From the server where the agent is installed, right-click the agent system tray icon and select Disable Agent.

2	On the confirmation dialog, click Yes to stop the agent service.

3	A message displays explaining that the agent is being stopped.

4	In addition, a desktop notification displays in the lower right-hand corner of your screen explaining that the selected agent is being disconnected from a specific coordinator.

Once disconnected, the agent system tray icon contains a red light indicating that the agent is inactive.

To start an agent (Agent Statistics page):

1	Open the Agent Statistics page.

2	Select a previously stopped agent and click Start Agent.

NOTE: The Start Agent command is only available when an agent is ‘Inactive’.

3	An information message displays explaining that it may take a few minutes to start the agent. Click OK to start the agent.

4	In addition, a desktop notification displays in the lower right-hand corner of your screen explaining that the selected agent is being connected to a specific coordinator.

Once connected, the agent’s status returns to ‘Active’ on the Agent Statistics page.

To start an agent (agent system tray icon):

NOTE: The agent system tray icon is only available for server agents.

1	From the server where the agent is installed, right-click the agent system tray icon and select Enable Agent.

2	A message displays explaining that the agent is being started.

3	In addition, a desktop notification displays in the lower right-hand corner of your screen explaining that the selected agent is being connected to a specific coordinator.

Once connected, the agent system tray icon no longer contains a red or yellow button indicating that the agent is now active.

Agent Log page

A new log page is created whenever the View Agent Log command is selected and displays the event details recorded in the trace log for the selected agent.

IMPORTANT: For workstation log management (such as Get Logs or View Agent Log), the following must be enabled on the workstation: • Windows Management Instrumentation (WMI) must be enabled in the firewall rule set (usually domain) on the workstation • Network Discovery and File Sharing must be enabled • Remote Registry Service must be set to ‘Start Automatically’. By default, this service is stopped and set to ‘Manual’ for Windows 10.

The data grid and event details pane on this page contains the following information for each log entry. The default column in the table below identifies the fields that are displayed in the data grid by default. To display different fields, click the Field Chooser button located to the far left of the column headings.

 

Table 10. Agent Log page: Field descriptions

Column	Default	Description
File	No	Specifies the name of the source file that logged the message.
Function	No	Displays the name of the function that logged the message.
ID	No	Displays the event ID used to identify the event.
Level	Yes	Indicates the severity of the event message: • Info - ‘For your information’; does not require attention • Error - events that indicate a problem has occurred; requires attention • Warning - events that warn of potential problems; does not require immediate attention
Line	No	Specifies the line within the source file that logged the message.
Logger	No	Specifies the logger used to log events.
Message	Yes	Displays the event message that was posted to the log.
Thread	No	Specifies the thread within the source file that logged the message.
Timestamp	Yes	Displays the date and time when the entry was posted to the log. NOTE: Based on the client’s current local date and time. The format used to display this date and time is determined by the local machine’s regional and language setting.

Use the tool bar buttons at the top of the log page to scroll through the log and search for log entries.

 

Table 11. Agent Log page: Tool bar buttons

Refresh	Use to refresh and reload the log entries from the source file. NOTE: Not available when the log page is launched using the View Agent Log command.
Copy	Use to copy the selected content to the clip board. Use with the Select All button to copy and paste the contents of the entire log into another application.
Select All	Use to select the entire contents of the log. Use with the Copy button to copy and paste the contents of the log into another application.
Find:	Enter a specific string of characters or word to be located in the log and use the Find button to locate the text.
Show Matched Entries Only (Ctrl+M)	Use to display only the entries that match the word/string of characters entered in the search text.
Match Case	Use to locate entries that match the case as it was entered in the search text.
Previous	Use to move to the previous entry that contains the search text.
Next	Use to move to the next entry that contains the search text.
Print	Use one of the Print options to print or save the contents of the log.

View and save agent trace logs

To view Change Auditor logs (Statistics page):

1	Open the Statistics page and select Logs | Open Log.

2	On the Open Log File dialog, use the controls at the top of the dialog to locate the Change Auditor log to view. Select the log file and click Open.

This opens a new page in the client which displays the log entries for the selected log.

3	Whenever an entry is highlighted in the top pane, the corresponding details are displayed in the Event Details pane across the bottom of the screen.

4	Use the tool bar buttons to search the log for a specific entry, to copy and paste the contents of this log for use in another application, and print or save the contents of this log.

To save Change Auditor logs to a specific location (Agent Statistics page):

1	Open the Agent Statistics page.

2	Select one or more agents from the list and select Logs | Get All Logs.

3	On the Browse for Folder dialog, select the location to save the logs for the selected agents. Click OK to save your selection.

NOTE: If necessary, select Make New Folder to create a new folder for these logs.

To view Agent logs (Agent Statistics page):

1	Open the Agent Statistics page.

2	Select one or more agents from the list and select Logs | View Agent Log.

3	This opens a new page in the client which displays the selected agent’s log (ChangeAuditor.AgentLog.nptlog). If multiple agents are selected, multiple log pages are created.

4	Whenever an entry is highlighted in the top pane, the corresponding details are displayed in the Event Details pane across the bottom of the screen.

In addition, when an error is highlighted in the top pane and there is a call stack available for that error, an Exception pane will also be displayed.

5	Use the tool bar buttons to search the log for a specific entry, to copy and paste the contents of this log for use in another application, and to print or save the contents of this log.

To view Agent logs (agent system tray icon):

NOTE: The agent system tray icon is only available for server agents.

1	On the server where the agent is installed, right-click the agent system tray icon and select View Agent Logs.

2	This opens the log viewer allowing you to review the events recorded in the selected agent’s log (ChangeAuditor.AgentLog.nptlog).

•  上一页
• Viewing Topics 185 - 188 of 203
• 下一页 

搜索该文档 在所有文档中搜索该产品版本 在所有文档中搜索该产品 搜索所有文档

×

 欢迎访问支持

您可以在附属支持站点上查找适用于戴尔*产品*的在线支持帮助。单击“继续”，转至适用于*产品*的正确支持内容和帮助。

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级

© 2024 Quest Software Inc. ALL RIGHTS RESERVED. 使用条款 隐私 Cookie Preference Center