立即与支持人员聊天
与支持团队交流

Change Auditor - For Advanced Users 7.3 - SCOM Management Pack Guide

SCOM Management Pack Overview

Quest has designed and implemented management packs to integrate with System Center Operations Manager (SCOM) 2012, 2012 R2, and 2016.

* 
NOTE: SCOM 2007 is no longer supported.

The SCOM management packs:

•
Monitor an approved list of Change Auditor events.
•
Display instances of these events within the SCOM Operations Console.
•
Provide views that can quickly present information about and from the Change Auditor coordinators.

This guide provides information about:

•
Configuration Requirements
•
Knowledge Authoring — Purpose
•
Knowledge Authoring — Features
•
Knowledge Authoring — Configuration

Configuration Requirements

To integrate Change Auditor with SCOM, you need to:

•
Prepare the SCOM installation to receive Change Auditor events
•
Prepare Change Auditor to send alerts to the SCOM agent
Prepare the SCOM installation to receive Change Auditor events
To prepare the SCOM installation to receive events:
1
Install a SCOM agent on the server hosting the coordinator.
The agent monitors the server for the WMI events that are sent by triggered alerts.
2
Import the Change Auditor Management Pack into SCOM.
The management pack for SCOM 2012, 2012 R2 and 2016. (ChangeAuditor.mp) is located in the following directory within the Change Auditor installation package: <Change Auditor Installation Files Directory>/Integration/SCOM.
* 
NOTE: Importing the management pack into SCOM may fail if the transaction log for the SCOM database “OperationsManager” is full. This can occur if the database size is set too small and the Autogrowth options are turned off for the database file and the log file.
 
Importing the management pack creates the rules required to receive the WMI events from the Change Auditor coordinator. The rules are automatically transferred to the SCOM agent.
* 
NOTE: The list of rules in the SCOM management pack is based on the events in the latest version of Change Auditor. Deprecated events are not available in SCOM.
Prepare Change Auditor to send alerts to the SCOM agent

After you have deployed the SCOM agent and installed the Change Auditor management pack, you need to configure Change Auditor to send events to SCOM. This configuration is required on a per-search basis by creating alerts and enabling the WMI option.

To create an alert, using the Change Auditor client:
1
Select the Searches tab and choose the required search.
2
In the Search Properties panel, select the Alert tab.
3
Enable alerts on the search by checking the Alert Enabled option.
4
Enable the WMI setting by checking the option next to Send Alert To.
5
Save the search.
To create an alert using the web client:
1
Log onto the Change Auditor Web Client as an Administrator.
2
Click on the Searches page on the navigational panel, which is denoted by a magnifying glass icon.
3
Select a search.
4
In the Search Properties panel, select the Alert tab.
5
Enable alerts for this search by checking the Alert Enabled option.
6
Enable the WMI setting by checking the option next to Send Alert To.
7
Save the search.
When the events are detected, they will display in the SCOM console.
* 
NOTE: Only alerts that are found in the search with the WMI alerts enabled display in SCOM.

Knowledge Authoring — Purpose

The Management Pack monitors the performance and availability of Change Auditor. By detecting and alerting on critical events, it helps indicate and prevent possible security breaches of Active Directory and the information and resources it contains.

Knowledge Authoring — Features

The Management Pack monitors events from Windows Management Information (WMI) of any computer that is running a properly installed and registered instance of the Change Auditor coordinator. These events, coupled with extensive embedded expertise, enable you to proactively manage Active Directory and avoid costly security breaches.

This management pack alerts you to important events that may occur within Active Directory.

自助服务工具
知识库
通知和警报
产品支持
下载软件
技术说明文件
用户论坛
视频教程
RSS订阅源
联系我们
获得许可 帮助
技术支持
查看全部
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级