Working with Audit Configurations

Working with Audit Configurations
How to Audit Data
The running of AuditMaster depends on audit configurations. An audit configuration combines three types of information:
n
n
n
Schemas are not required to use AuditMaster, but they make audit records human-readable and enable more precise alerts.
Files monitored under an audit configuration may be arranged into groups. For example, if you have a different group of files for each customer in your application, you can give each customer’s data files their own AuditMaster group. Groups are for organizing your thinking about auditing and have no affect on the operation of the AuditMaster system.
All groups under a single audit configuration must use the same schema. Also, only one schema can be used in each audit configuration. So, if you want to monitor a database using a different schema, you will create a separate audit configuration for that combination. Each file to be monitored can belong to only one group in one audit configuration.
We recommend you work through the following tutorials before attempting to create an audit configuration:
1
2
3
4
5
Configuring Data Monitoring without Schemas
The tutorial in this section shows how to use an audit configuration consisting of the following:
n
n
n
Only AuditMaster administrative users can set audit configurations.
The database used in this example is fictional. Simply read through the steps to become familiar with the audit configuration procedure. In the next tutorial, Configuring Data Monitoring with a Schema, you will have sample files for hands-on practice.
‰
1
The Pervasive AuditMaster window appears. For Pervasive PSQL under Windows, an entry for the AuditMaster server was added by default during installation.
2
Right-click the server to select Login. You may also double-click.
The AuditMaster Login dialog box appears.
3
Enter the default user name admin and the password MASTER.
Note The built-in user ID admin has the default password MASTER. Passwords are case-sensitive; user names are not.
4
5
Select Admin Audit Configuration.
The Audit Configuration window opens.
6
In the left pane, right-click Pervasive PSQL Generic and select New Configuration. You may also double-click to open it.
The Pervasive SQL Generic Configuration dialog box appears:
7
The system displays the Selection of Files to Be Monitored window.
8
Click Add Group.
The Enter Group Name dialog box appears.
A group is a set of one or more files to monitor. Group names are case-sensitive and can use any keyboard characters, including spaces, up to 40 characters in length. Since group names are globally visible, it is recommended that you name a group to reflect the audit configuration under which you are creating it.
9
For this example, the group name Pvideo is used.
The Selection of Files to Be Monitored window activates the Available Files area.
10
In the Available Files area, navigate through the folder hierarchy to locate files to monitor. Only files in Btrieve format will be listed. You may also use the Show Files in Subdirectories button, after double-clicking a folder, to display a list of all Btrieve files from the double-clicked directory downward.
Note A large number of files may take time to display in the list.
11
Highlight a file name, and click Select. You may also double-click to select a file.
The file path name appears in the Files to Be Monitored list.
You can also click Select All to select every file in the current list.
If you decide not to monitor a file, select it and click Remove to delete it from the group. Remove All deletes all files from the group.
Note The Operations to Audit button enables you to override the global auditing settings applied to each selected file by default. See details under Operations to Audit by File.
12
In the Audit Configuration window, the Configured Components area identifies the new configuration for the product definition. Expanding the newly added group in the Monitored Files area lists the file that was added to the group.
AuditMaster is now set to monitor the Pervasive PSQL file. The file and its group are associated only with this particular audit configuration.
13
In the audit configurations, expand the one that contains the group and file you want to change, then click the Select Files button to display the Selection of Files to Be Monitored window and return to step 10.
14
The window closes and the system prompts you to restart the AuditMaster event handler.
15
16
After the restart, the new AuditMaster configuration becomes active and auditing begins.
Configuring Data Monitoring with a Schema
The tutorial in this section shows how to set an audit configuration for the following:
n
n
n
Schemas are not required to use AuditMaster, but they make audit records human-readable and enable more precise alerts.
Only AuditMaster administrative users can set audit configurations.
Your Pervasive PSQL installation includes a database for demonstration purposes, stored in the folder Demodata. For this tutorial, the schema for these tables has already been imported into AuditMaster so that you can experiment with audit records for the demonstration database.
Managing Schemas shows how to create a new audit configuration that uses your own application and its schema.
‰
1
The Pervasive AuditMaster window appears, showing the server available.
2
Right-click the server to select Login. You may also double-click.
The AuditMaster Login dialog box appears.
3
Enter the default user name admin and the password MASTER.
Note The built-in user ID admin has the default password MASTER. Passwords are case-sensitive; user names are not.
4
5
Select Admin Audit Configuration.
The Audit Configuration window opens.
6
In the left pane of the Audit Configuration window, right-click Pervasive PSQL Demo and select New Configuration. You may also double-click to open it.
The Pervasive PSQL Demo Configuration dialog box appears:
7
If you have a standard Pervasive PSQL installation, click OK to accept the default drive C: for the Pervasive PSQL Demo drive location and the version of Pervasive PSQL. Otherwise, use the drop-down list to change to the appropriate location for your Pervasive PSQL database.
The system displays the Selection of Files to Be Monitored window.
8
Click Add Group.
The Enter Group Name dialog box appears.
A group is a set of one or more files to monitor. Group names are case-sensitive and can use any keyboard characters, including spaces, up to 40 characters in length. Since group names are globally visible, it is recommended that you name a group to reflect the audit configuration under which you are creating it.
9
Enter the group name Demodata, and click OK.
10
In the Available Files area, navigate through the folder hierarchy to locate files to monitor. Only files in Btrieve format are listed. You may also use the Show Files in Subdirectories button, after double-clicking a folder, to display a list of all Btrieve files from the double-clicked directory downward.
Note Listing many folders and files may take several minutes.
For this example, select the Pervasive PSQL demonstration directory C:\<installation directory>\Demodata.
11
Click the file name student.mkd, and click Select. You may also double-click it.
The file path name appears in the Files to Be Monitored list.
You can also click Select All to add every file in the current list.
Each file can be a member of only one group in one audit configuration. If you select a file that is already listed in another group, AuditMaster informs you of a configuration conflict. Should this occur, see Resolving Configuration Conflicts.
If you decide not to monitor a file, select it and click Remove to delete it from the group. Remove All deletes all files from the group.
12
In the Audit Configuration window, the Configured Components area identifies the new configuration. Expanding the newly added group in the Monitored Files area lists the files.
AuditMaster is now set to monitor the file.
13
In the audit configurations, expand the one that contains the group and file you want to change, then click the Select Files button to display the Selection of Files to Be Monitored window and return to step 10.
Note All groups and files in an audit configuration that uses a schema must use the same one. If you try to add a file that does not match the schema for the audit configuration, AuditMaster warns that the file is “not registered for monitoring.”
14
The window closes and the system prompts you to restart the AuditMaster event handler.
15
16
After the restart, the new AuditMaster configuration becomes active and auditing begins.
You are now ready to attempt to create an audit configuration for your own Pervasive PSQL database server, application, database files, and schema. Proceed to Managing Schemas.
Operations to Audit by File
Each file in an audit configuration receives a default list of audit events, but you also can click the Operations to Audit button in the Selection of Files to Be Monitored window to reset that list as shown here.
 
The following table lists operations you can set for individual files. As with other new settings, you must restart the event handler.
 
See also Operations to Audit Globally.
Note In a Pervasive PSQL database, when the client-side cache engine is turned on, the cache engine reads an entire database page after 8 consecutive reads in anticipation of more reads. The records in the database page read by the cache engine are not audited by the event handler on the server. If auditing requires that every read be captured, verify the setting is off. However, lack of engine caching can reduce database performance. The behavior occurs only when the threshold of 8 consecutive reads is reached. If 7 reads and then an update occurs, no caching occurs and all 7 reads are captured. In Pervasive PSQL Control Center, expand Local Client, right-click MicroKernel Router, and select Properties, then click Performance tuning to see the setting Use Cache Engine. By default, the setting is off.
Managing Schemas
AuditMaster can import Pervasive PSQL schemas for two purposes:
n
n
Without its schema, application data in audit records appears as hexadecimal rows and you cannot set alerts for individual data fields. The example Configuring Data Monitoring without Schemas monitored files in a fictional video store database. Lacking a schema, the application data record for an insert resembled the following:
After schema import, AuditMaster can better display the next insert:
Note Schema import has no effect on display of data already captured.
The rest of this section covers the following topics:
n
n
Importing a Schema from Pervasive PSQL
The following example steps you through using the AuditMaster Schema Maintenance Wizard to import a schema from a Pervasive PSQL database. It uses the same fictional video store as in the previous example, and while no files are provided for hands-on practice, after reviewing the steps you should be ready to export a schema from your own application.
A command-line version of the wizard is described under Managing Schemas from the Command Line.
Note If you have set Pervasive PSQL security policy on the DefaultDB database to Mixed or Database, then before working with a new schema for an audit configuration, you must first add its path to the list of data locations for DefaultDB. See details under Running AuditMaster under Pervasive PSQL Security.
‰
1
Access Schema Maintenance Wizard from the operating system Start menu or Apps screen.
The Schema Maintenance Wizard appears.
2
Click Next to continue.
The wizard asks you to specify the location of the amserver file.
3
Accept the default path to the file, or enter a custom path, and click Next. You may also use the ellipsis button to browse to a folder or network location.
The wizard asks you to choose to import or remove a schema.
4
Select Import Schema and click Next.
The wizard asks you to enter information about the database application to be audited.
5
Enter a name for the audit configuration.
You will use this name to identify the audited application in the Audit Configuration window.
6
Enter a description for the audit configuration.
This description will appear in the Product Information area of the Audit Configuration window.
7
Enter a version for the audit configuration.
A version number will help to identify the release of your application and distinguish it from other versions if your network environment supports more than one release.
8
Click Next.
The wizard asks for the folder for the schema to be imported.
This directory is the location for the database tables and schema information in their data dictionary files (file.ddf, field.ddf, index.ddf).
9
10
Click Next.
The wizard summarizes the schema import.
11
Click Finish to complete the import.
The wizard reports the result of the schema import.
12
Click Close.
When you open the Audit Configuration window, the imported schema will appear and be ready for use.
Note Schema import does not affect display of data already captured.
Removing a Schema from AuditMaster
Removing a schema from the AuditMaster system allows you to replace it with a different schema.
‰
1
Access Schema Maintenance Wizard from the operating system Start menu or Apps screen..
The Schema Maintenance Wizard appears.
2
Click Next to continue.
The wizard asks you to specify the location of the amserver file.
3
Accept the default path to the file, or enter a custom path, and click Next. You may also use the ellipsis button to browse to a folder or network location.
The wizard asks you to choose to import or remove a schema.
4
Select Remove Schema and click Next.
The wizard asks for the schema to remove.
5
The wizard summarizes the schema removal.
6
Click Finish.
The wizard reports the result of the schema removal.
7
Click Close.
Note Audit records captured using the removed schema now display as hexadecimal rather than in human-readable format.
Resolving Configuration Conflicts
Each file selected for monitoring can belong to only one group in one audit configuration. If you attempt to select it for any other group, the following window appears:
You have two options for resolving the conflict:
n
Click the Close button to cancel the selection and leave the file in its original group.
n