立即与支持人员聊天
与支持团队交流

Change Auditor 7.4 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Search Properties tabs

Located across the bottom of the page, the Search Properties tabbed pages define the criteria or properties which make up the selected search.

* 
NOTE: If the Search Properties tabs are not displayed across the bottom of the Search page, click Show Properties at the top of the page.

The Search Properties tabs displayed are:

•
Info: Allows you to enter a name and description for the search
•
Who: Allows you to search for events generated by a specific user, computer, or group.
•
What: Allows you to search for events based on subsystem, event class, object class, severity, or results.
•
Where: Allows you to search for events captured by a specific agent, domain, site, or server type.
•
When: Allows you to search for events that occurred within a specific date/time range.
•
Origin: Allows you to search for events that originated from a specific workstation or server.
•
Alert: Allows you to enable alerts and define how and where to dispatch alerts.
•
Report: Allows you to enable reporting, specify the report layout template to be used or choose to design your own report layout, and define when and where to send the report.
•
Layout: Allows you to define the data (columns) to be retrieved from the database and the sort order for displaying the retrieved data. The layout defined on this tab applies to both the search results displayed in the client and in the report, if reporting is enabled on the Report tab.
•
SQL: Displays the SQL script used to create the selected search definition.
* 
NOTE: This tab is hidden by default. Use Action | Show SQL Tab to display this tab.
•
XML: Displays the XML representation of the search criteria.
* 
NOTE: This tab is hidden by default. Use Action | Show XML Tab to display this tab.

For a detailed description of the Info, Who, What, Where, Origin and Layout tabs and how to use them to create a custom search, see Custom Searches and Search Properties. For more information about the Alert tab, see Enable Alert Notifications. For more information about the Report tab, see Generate and Schedule Reports.

View a list of available searches

All search definitions, private or shared, custom or built-in, are listed on the Searches page.

To view the search definitions available to all Change Auditor users:
1
Open the Searches page.
2
In the explorer view (left pane), double-click the Shared folder to expand the folder and display a hierarchy of folders.
3
Select a subordinate folder under the Shared folder.
The right pane displays a list of the search definitions that are stored in the selected folder.
4
Double-clicking a search in the right-hand pane runs the search and opens a new Search Results page.
5
Right-clicking a search displays a context menu containing actions that can be taken against the selected search.
To view the search definitions that are only available to you:
1
Open the Searches page.
2
Select the Private folder (or a subordinate folder created under the Private folder) in the explorer view.
The right pane displays a list of the search definitions that are stored in the selected folder.
To view the list of built-in reports (those provided with Change Auditor):
1
Open the Searches page.
2
Expand the Built-in folder in the explorer view.
3
Select a folder under the Built-in folder to view the list of search definitions that are stored in the selected folder.
The right pane displays a list of the search definitions that are stored in the selected folder.

Run searches

To run a previously saved search or built-in report:
1
Open the Searches page.
2
Expand and select the appropriate folder in the explorer view to display the list of search definitions stored in the selected folder.
3
Use one of the following methods to run a search:
•
Double-click the search definition.
•
Right-click the search definition and select Run.
•
Select the search definition and click Run.
4
A new Search Results page will be displayed populated with the events that met the search criteria defined in the selected search definition.

Run a quick search

Quick search allows you to run a search immediately without saving the search definition. To save the search definition, you can select Save As before you run the search.

To run a quick search:
1
Open the Searches page.
2
Select the Quick Search node in the explorer view to display the Quick Search entry in the Searches list
3
You can either run the default quick search which will retrieve all events that were generated since the beginning of the week or define the search criteria to be used.
•
To run the default search, double-click the Quick Search entry in the Searches list or click Run.
•
To define the search criteria, select the Quick Search definition to enable the Search Properties tabs. On the Search Properties tabs, enter the search criteria to use. Once finished entering the search criteria, click Run from one of the Search Properties tabs.
4
A new search results tab, titled Quick Search, will be displayed populated with the events that met the search criteria defined.
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级