Tip:
Highlight text to annotate it
X
Have you ever wondered when a change was made or who has been modifying settings? The new
console auditing feature in LANDesk Management Suite nine point five can help. This video
shows you how to:
Enable auditing
Configure what is audited
View events
Before you can begin auditing events, you need to give at least one user the auditing
configuration role. From the Console, click Tools, Administration, User Management.
In the Roles tree, you'll see roles for Auditing Configuration and Auditor. An Auditor
only gets to see what events have been logged. Someone with the Auditing Configuration role
can view events and decide what gets logged. So double-click Auditing Configuration.
On the Users and groups page, select users that will have the auditing configuration
role. Click OK.
Whoever you just gave that role to needs to restart the Console. If you gave it to yourself,
that means YOU. Go ahead and restart the Console, and new options will magically appear.
Now that you have the power, select what events you want to track. Click Configure, Services.
In the dialog box, click the Auditing configuration tab. Select the checkboxes next to the events
you want to track. I'm just going to select all of them.
This checkbox here at the bottom: Write auditing events to the Event Log. When you enable this
checkbox, any time LANDesk writes an event to the core database, it will also write it
to the Windows Event Log so it can be viewed in the Windows Event Viewer. This may be handy
if you use 3rd party auditing or if you must comply with specific auditing regulations.
It may be up to two minutes before LANDesk begins writing to the Windows Event Log.
Once auditing has been configured, anyone with the auditing role can view the events.
If you are using the Web Console, look for the Auditing log in the Monitoring panel on
the left side. Double-click the item to view the details in an XML file.
OR, from the Windows Console, click Tools, Administration, Auditing. The Auditing panel
is displayed here, and you can select one of the default queries or create a custom
query to find the events you are looking for. You can filter by user, device name, modified
date, or feature. To see details about a specific event, double-click
on it to view an XML file. Some of the XML files like this one for Agent Settings may
have a lot of options, so you can use a diff tool to view the changes.
And there you have it: the new auditing tool in LANDesk Management Suite nine point five.
Thanks for watching!