Using Archive Manager

Archive Manager is a tool for handling audit archives. Before using it, first read Working with Archived Audit Records.

In the data tree, you handle one archived file at a time, but Archive Manager allows you to work with several archived files as a group. The Tools  Archive Manager command displays its window.

This example corresponds to Archived Files in the data tree:

After auditing has occurred, the data tree might appear like this:

And the Uncompressed tab would show this:

While the Compressed tab would show this:

In each case, the appropriate buttons are available at the bottom of the Archive Manager window:

 

Command

Compress. Compress the file.

Decompress. Decompress the file.

Delete. Remove the file permanently.

Select All. Highlight all files in the list.

Clear All. Clear highlighting on selected files.

Close. Close Archive Manager.

To use Archive Manager, click a button command after clicking a file to highlight it. Use the SHIFT key to select a range of files or the CTRL key to add a single file to the currently highlighted selection.

Note The larger the file, the longer it takes to decompress and become ready to query. For large files, to be sure all records are ready, select Admin  View Status Log to check the log for the “finished decompressing” message, even if the file icon shows as uncompressed. You may also want to right-click Archived Files in the data tree and select Refresh All to update the display.

Running Queries

To display audit records from a current view or archived file, you must first run a query using AuditMaster Query Builder. You may query for all available audit records in the files you select, or you may restrict the query to Who, Did What, From Where, When, or How. For example, you can search for audited events on a particular date, events from a selected table, or changes that were made by only one particular user.

Figure 7-3 Query Builder Window

This section covers the following topics:

n	Displaying All Audit Records

n	Restricting a Query

n	Building an Advanced Query

n	Using the Files Tab

n	Running a Saved Query or Last Query Executed

Displaying All Audit Records

The simplest query in the Query Builder window is to display all audit records:

‰	To display all available audit records

1	Select a current or archived view file.

2	Select File  Query, or right-click and select Query.

The Query Builder window appears.

3	By default, all options in each tab are selected. To display all AuditMaster data for this file, simply select Execute.

Audit records are displayed in the grid in the upper right-hand pane of the viewer.

Restricting a Query

Query Builder provides tabs for restricting a query to who, did what, from where, when, how, and in which audit record files to look.

‰	To restrict a query

1	Select options from the tabs to make a query more selective.

 

Table 7-3

Options for Restricting a Query

To find...	Click tab	Perform these steps...
Users All records that contain a specific user or users	Who	1. To find a specific user or users, clear the All Users option. 2. The list of database users is now available. 3. Select a user or multiple users by checking the box beside their name. 4. If needed, you can add a user by clicking Add and typing in the specific user.
Operations, Groups, and Tables Specific operations, such as an insert or a delete, in a specific type of table, in a specific group	Did What	1. To find a specific type of operation, clear the All Operations option. You can also clear the All Groups or All Tables option. The list is now available. 2. Select the operations and any objects affected by them. Expand lists as needed to select the appropriate options. Use the SHIFT or CTRL keys to extend the selection.
Network Addresses Any information originating from a specific network address.	From Where	1. To find a specific network address, clear the All Network Addresses option. The list of network addresses is now available. 2. Select one or more network addresses by checking the box beside the address. If needed, you can add an address by clicking Add and typing in the specific network address.
Specific Dates Any activity on a specific date and within a time range	When	1. To find a specific start and end date, clear the All Date Range option. The Start Date and End Date calendars are now available. 2. Select a day, month, and year from the calendars. Use the arrows to click back and forth through the months.‘ 3. To find a specific time range for each day in the date range, clear the Time Range option. Select a time from the Start Time and End Time fields. Note: The time range applies to each individual day in the date range (e.g., 8:00 a.m. to 5:00 p.m. on each day).
Processes or Programs The program or process identified by AuditMaster in the Process Name column of the audit record grid	How	1. To find a specific program or process, clear the All Processes option. The processes are now available. 2. Select a program or process by clicking the box beside the option. If the process name does not appear, use the Add field at the bottom of the pane to include it in the list.

2	If you plan to reuse this query later, click Save.

In the save dialog box, provide a descriptive name for the query and click OK. For details on using a saved query, see Running a Saved Query or Last Query Executed.

3	To run the query, click Execute.

The audit record grid displays the query result.

Building an Advanced Query

The Advanced tab is used to build complex queries that cannot be built using the other tabs. This tab can set expressions to evaluate for specific events and can also be used to query at the column level in an audited table if its schema has been imported.

The following example shows the creation of a query to search for all inserts into the database on a specific day.

‰	To step through the Advanced Expression Builder example

1	Open the Query Builder window, and click the Advanced tab.

2	To customize your query, select the Use Advanced Expression Builder checkbox.

The expression area becomes active.

3	In the Type column, double-click Select Type to activate a drop-down list for the following query attributes:

 

Select Type Attribute	Description
(	Open parenthesis to build expression block
Data Field	Same as field attribute from Tables under Did What tab, except that you can restrict the query at the column level, not just at the table level
Date	Same as Date Range attribute under When tab
Group	Same as Groups attribute under Did What tab
Database Name	Pervasive PSQL database where event occurred
Table	Same as Table attribute under Did What tab
Operation	Same as Operations attribute under Did What tab
How	Same as Process attribute under How tab
Rec ID	Record number in audit data grid
Time	Same as Time Range attribute under When tab
Where	Same as Network Address attribute under From Where tab
Who	Same as User attribute under Who tab
and	Used to build expression
or	Used to build expression
)	Close parenthesis to build expression block

Note All text values entered for Select Type are case-sensitive. For example, using defaultdb as the database name returns no result, since it does not match case with the name DefaultDB.

4	In the list of query attributes, select Date.

A calendar dialog box appears with the current date selected.

5	Click OK to accept the default date.

The date appears in the Value column.

6	In the Operation column, select a logical operator, or leave the default equal sign = as is.

The expression should resemble the following:

7	You may use the Del and Ins buttons to remove an item from the expression or add a new item.

8	After building your expression, decide whether to set it for Alert Only.

This option will select for records meeting the defined conditions but display only those for which alerts have tripped.

For more details, see Working with Alerts.

9	If you plan to run this query often, click Save.

The Saved Queries window appears to enable you to give the query a name and save it for future use. See also Running a Saved Query or Last Query Executed.

10	To run this query, click Execute.

The Query Builder executes the query and displays the results in the audit record grid.

Using the Files Tab

The Files tab allows you to select which current view and uncompressed archived files to include in a query.

‰	To select which files to include in a query

1	From the Query Builder window, click the Files tab.

Figure 7-4 Files Tab

2	Click checkboxes to make or clear file selections for the query, then continue with query settings in other tabs as needed.

Only uncompressed files can be queried. If a file you want to query is not listed, you will need to decompress it.

Note The larger the file, the longer it takes to decompress and become ready to query. For large files, to be sure that all records are ready, use the Admin  View Status Log command to check the status log for the “finished decompressing” message, even if the file icon shows as uncompressed. You may also want to right-click the Archived Files branch of the data tree and select Refresh All to update the display.

Running a Saved Query or Last Query Executed

For each AuditMaster server, queries are stored in the data tree under Saved Queries and Last Query Executed. This section covers the following topics:

n	To save a query

n	To use a saved query

n	To use the last query executed

‰	To save a query

1	After creating a query in the Query Builder window, click the Save button.

The Saved Queries dialog box asks you to name the query.

2	Enter a name for the query and click Save.

The query is added to the list of existing queries and will now appear in the data tree.

3	Click Close.

‰	To use a saved query

1	In the data tree, right-click a query under Saved Queries.

A pop-up menu offers you several choices.

2	Select one of the options listed in the following table:

 

Table 7-4

Saved Query Commands

Command

Query Current View File. Run the query against the current view file.

Query Multiple View Files. Display the Files tab in the Query Builder to select the files against which to run the query.

Rename. Change the name of the query.

Delete. Remove the query permanently from the list.

If you run a query, any result appears in the audit record grid. You may simply double-click a saved query to run it against the current view file.

Only uncompressed files can be queried. If a file used in a query has been compressed, you must decompress to run the query.

Note The larger the file, the longer it takes to decompress and become ready to query. For large files, to be sure that all records are ready, use the Admin  View Status Log command to check the status log for the “finished decompressing” message, even if the file icon shows as uncompressed. You may also want to right-click the Archived Files branch of the data tree and select Refresh All to update the display.

‰	To use the last query executed

In the data tree, double-click the Last Query Executed.

Any result appears in the audit record grid.

Working with Alerts

Under Microsoft Windows, AuditMaster provides an alert capability. The Alerts window enables you to create an alert to a specific event in a Pervasive PSQL database. Once an alert is set, AuditMaster checks each new audit record for the alert condition. When found, AuditMaster executes an alert action. For example, when a data record is deleted, the system can send an alert to notify you by email. In the audit record grid, tripped alerts are flagged with an icon .

Caution Dramatic and undesirable consequences may arise from an alert with a broad query likely to match a large number of audit records, especially when the alert action sends email.

This section covers the following topics:

n	Adding a New Alert

n	Setting an Action for an Alert, including

w	Setting an EmailAlert Action

w	Setting a RunProgram Action

n	Editing an Existing Alert

n	Stopping an Alert

Note After creating or changing an alert, close AuditMaster Viewer and restart the AuditMaster event handler so that the alert takes effect. See Restarting the AuditMaster Event Handler.