Administering AuditMaster

As an administrator, you will perform certain tasks to define how AuditMaster operates. As for adding audit configurations, the menu commands for these tasks are available only to users with administrative rights.

•

Adding and Removing Servers

•

Replacing the Network Share with a Local Path

•

Reviewing System Activity in the Status Log

•

Maintaining Users

•

Setting the Audit Filter

•

Maintaining Server Settings

Adding and Removing Servers

In AuditMaster, a server is a PSQL server on which an AuditMaster event handler is running. The file amserver contains the server connection settings used by AuditMaster. This file is typically located on the server in the data folder of the AuditMaster installation directory.

This section provides instructions for the following topics:

•

Adding a Server

•

Editing the Server Description

•

Removing a Server

Adding a Server

When you add an AuditMaster server, you enable the AuditMaster Viewer client to connect to an AuditMaster server either on the local system or elsewhere on the network. You can add any AuditMaster server to which you have network access and file permissions.

►

To add a server

Check the server that you wish to add to make sure that PSQL services are running.

From AuditMaster Viewer, select Server > Add to open a Windows Explorer dialog to select an AuditMaster server.

Enter the path to the file amserver to read the settings for the AuditMaster server to which you want to make a client connection.

In a default installation this path is \\server\PVSWAUDIT$\DATA\amserver, where server is the name of the PSQL system with the database to be monitored. Note that a share name other than PVSWAUDIT$ may have been chosen.

Click Open.

The server you selected is added to the data tree.

Depending on your system and network, the name may be the machine name or it can be the the path to the amserver file. To change the name to suit your needs, see To edit a server description.

Note If your client cannot connect successfully to the AuditMaster server, you may receive a –108 error message. The cause may be a faulty network mapping or other network problem. It may also involve a license key with too low a user count. See Authorization License.

Right-click a server configuration to select Login. You may also double-click.

In the AuditMaster Login dialog, enter an AuditMaster user name and password, and click OK.

Note The built-in user ID admin has the default password MASTER. Passwords are case-sensitive, but user names are not. To change this password, see Changing Your User Password. For information on the relationship between AuditMaster logins and database and Windows logins, see Displaying Audit Records under PSQL Security.

The listed server is now ready for monitoring.

Editing the Server Description

When a server is added for monitoring, its default name in the data tree uses the path name to the Data folder in the AuditMaster home directory. If needed, you can assign a more meaningful name.

Note Data tree names have no effect on network names.

►

To edit a server description

In the data tree, right-click the server icon and select Edit Server Description.

In the dialog, replace the string with new text. You may use spaces.

Click OK.

The server icon in the data tree has the new name.

Removing a Server

When you remove a server connection from an AuditMaster viewer client data tree, the client no longer has access to that server. However, auditing continues on the server, and existing audit records, users, and settings remain because the server is where they are stored. If you add the server connection again, everything that was present before is redisplayed in the data tree.

►

To remove a server

Click a server in the AuditMaster data tree and select Server > Remove.

A dialog box prompts you to confirm the removal.

Select Yes to remove the server.

The server is removed from the data tree.

Replacing the Network Share with a Local Path

AuditMaster installs a hidden network share to enable remote client access for AuditMaster Viewer from other systems. If for security reasons you would like to disable the network share to block remote access, you can replace it with an explicit local path after AuditMaster installation. This replacement can be done only on the server where AuditMaster is installed, not from a remote client. No existing audit records are affected, but auditing must stop momentarily when you restart the event handler to complete the share removal process.

Note Removing the network share will prevent remote access by all AuditMaster Viewer clients to the AuditMaster system. Be sure that you want to remove it.

►

To replace the default network share with a local path

On the system where AuditMaster server is installed, open AuditMaster Viewer.

The AuditMaster window appears, listing servers available for monitoring.

Right-click a server configuration to select Login. You may also double-click the server name.

Enter an AuditMaster administrative login name and password, and click OK.

Note The built-in user ID admin has the default password MASTER. Passwords are case-sensitive; user names are not. To change this password, see Changing Your User Password. For information on the relation of AuditMaster logins to database and OS logins, read under Displaying Audit Records under PSQL Security.

Select Admin > Server Settings.

The Server Settings dialog box appears. On the left, the AMmon path settings are at the top of the list and are already highlighted.

For each of the settings in the Value column on the right, double-click the path name and change

\\server\PVSWAUDIT$

drive:\PSQL root directory\Audit

where server is the name of the system on which PSQL server and the AuditMaster event handler are installed and drive and PSQL root directory are, respectively, the local drive letter and path name to the AuditMaster directory selected at installation time.

In this example, the result would resemble the following:

In the list of sections on the left, select Common Settings.

The dialog box displays the values on the right.

Double-click the value for the AuditMaster status log file and change it to

drive:\PSQL root directory\Audit\data\amstatus.log

The result might resemble the following:

After you have finished changing the values, click OK.

The system displays a prompt to restart the event handler.

Click OK.

Do not restart the event handler yet. You will do that later in this task. If needed, see Restarting the AuditMaster Event Handler.

Select Server > Add to open a dialog to browse to the amserver file.

Using the new path value you chose, enter drive:\PSQL root directory\Audit\DATA to navigate to the location of the amserver file that contains the settings you have just changed.

Select the file amserver, and click Open.

Based on the new server settings you have entered, the new server appears in AuditMaster Viewer.

Select the old server node with the network share in its name and then select Server > Remove.

Click Yes to confirm its removal from the list. The status field at the bottom of the main window indicates no server is active.

Exit from AuditMaster Viewer.

In order to remove the network share, AuditMaster and PSQL services must not be running.

If PCC is not running, start it.

In PSQL Explorer, right-click the Services node and select Stop All Services.

In Windows Explorer, open the folder drive:\PSQL root directory.

Right-click the shared folder Audit and select Properties.

Select the Sharing tab.

Select Do not share this folder, and click OK to delete the share and close the Properties window.

In PSQL Explorer, right-click the Services node and select Start All Services.

After the services have started, verify that AuditMaster is working properly without a network share by opening AuditMaster Viewer to log in.

In the AuditMaster Viewer window, right-click the server and select Login. You may also double-click the server name.

Enter an AuditMaster administrative user name and password, and click OK.

Note The built-in user ID admin has the default password MASTER. Passwords are case-sensitive, while user names are not. To change this password, see Changing Your User Password. For information on the relation of AuditMaster logins to database and OS logins, read under Displaying Audit Records under PSQL Security.

The new AuditMaster server is now ready to operate without a network share. Other server settings are unchanged and previously captured audit records captured remain in the system. Only the means of the viewer client connection has changed.

Reviewing System Activity in the Status Log

AuditMaster Status Log Viewer displays the activity logging that the system performs on itself. It provides a list of status messages and internal errors generated by AuditMaster operations. In a development environment, it also can be configured to capture messages for debugging purposes.

►

To view, filter, and sort status log records

Open Status Log Viewer by doing one of the following:

•

In AuditMaster Viewer, select Admin then View Status Log.

•

Access the Status Log from operating system Start menu or Apps screen, or from the installation location (the default is C:\<installation directory>\Audit\Data). This method is especially useful if the viewer is not responding because of a system problem, such as disk full.

The Status Log Viewer window displays several types of messages. Normally, these are all status messages to provide information on current system operation.

If needed, set filter options to display only the status records you want. The Clear Fields button allows you to start over on most fields. The filtering options are given in the following list:

•

To filter the log by the type of message, select the type of message from the Message Type list.

•

You may choose to view debug and error messages, which can be helpful in troubleshooting any unexpected behavior in AuditMaster.

•

To filter by the Module Name, enter the name of the module.

•

To filter by the source file, enter the name of the source file.

•

You can look at specific lines of the source file by entering the line numbers in the fields provided.

•

To filter by specific dates, select dates from the Earliest and Latest lists.

•

To filter by searching for message content, enter a text string and select check boxes for matching exact text or case.

For example, the text string archiv will display only status records related to AuditMaster archived files.

Selecting for exact text requires that the Message Content field contain the entire text string for the search. If you are searching for partial text strings, leave this check box cleared.

When you are finished setting filter options, click Refresh.

The viewer refreshes with only records you wish to see.

You also may sort status log records by selecting column headers on which to sort.

For example, use the SHIFT key to select both the Date and Time columns to order the records chronologically.

After selecting columns on which to sort, click Refresh.

The viewer refreshes by sorting the records displayed.

Maintaining Users

As part of AuditMaster security, only trusted personnel are allowed access to the AuditMaster system. As administrator, you must define user names and provide a password for each user. You must also decide whether each user shall also have your same administrator privileges.

This section covers tasks done in the User Maintenance window.

•

To add a user

•

To remove a user

►

To add a user

Select Admin > User Maintenance.

The User Maintenance window appears.

Enter a user name and password. Passwords are case-sensitive, user names are not.

Click Create User.

You are asked whether to give this user AuditMaster administrator privileges. Click Yes or No.

The new user appears in the list of current users.

►

To remove a user

Select Admin > User Maintenance.

The User Maintenance window appears.

Select a user in the Delete User list.

Click Delete User.

You are asked to confirm the deletion. Click OK.

The user is removed from the list.

Setting the Audit Filter

The trusted list restricts auditing by stopping capture of audit records of low value, such as monitoring of system or batch processes that represent no direct access by human users.

Once a name is listed as trusted, the system ignores it globally and logs no activity for that name for any audit configuration.

►

To add a name to the trusted list

Select the Admin > Audit Filter > Trusted List command.

The Trusted List window appears.

In the User Name field, enter a text string as it would appear in the User Name column of the audit record grid. The string you enter is not case-sensitive (i.e., SYSTEM, System, and system are the same).

The Add button becomes active.

Click the Add button.

The name you entered moves to the Users list.

Click Close.

To activate the new trusted list, you must restart the event handler. See Restarting the AuditMaster Event Handler.

►

To delete a name from the Trusted List

Select the Admin > Audit Filter > Trusted List command.

The Trusted List window appears.

In the Users field, select one or more names to delete. You may use shift-click and control-click for your selection.

The Delete button becomes active.

Click the Delete button.

Your selections are removed from the trusted list.

Click Close.

To activate the new trusted list, you must restart the event handler. See Restarting the AuditMaster Event Handler.

Maintaining Server Settings

The Server Settings window displays AuditMaster system settings. You can open it using the Admin > Server Settings command.

The window offers groups of settings. As shown in the following table, some of the settings can be changed, although in most cases this is not needed, and in some instances not recommended.

After a change is made to any of these settings except for automated archiving, you must restart the event handler to activate the new setting. See Restarting the AuditMaster Event Handler.

Setting Group	Setting	Purpose
AMMON Paths	Various path names	These locations are set at installation time to work with a shared volume that is also created by the AuditMaster installer. To meet security requirements, the share can be replaced with an explicit local path name. For instructions, see Replacing the Network Share with a Local Path. Be advised that doing so blocks remote clients and restricts access to only the local system.
AMMON Settings	Archives to Keep	Used with Automated Archiving settings. By default, the value is –1, which means that the system does not monitor the number of archived files. If the value is greater than zero, then the system retains only that number of the most recent files and deletes the older ones. See Archives to Keep.
AMMON Settings	Mapper Threshold	Controls the frequency of automatic refreshing of the Current View File in AM Viewer. Default is 1, meaning 1 minute. Setting the value to zero turns off automatic refreshing. Its entry in amstatus.log is "Running Mapper after n minute(s)."
Automated Archiving	Creation of Archive Files	Configures the automatic conversion of audit records into archive files. For instructions, see Automated Archiving.
Common Settings	Archive Disk Limit	Used with Automated Archiving settings. By default, the value is –1, which means that the system does not monitor the total size of all archived files. If the value is greater than zero bytes, then the system retains only the most recent files for which the total size is less than or equal to this number of bytes and deletes the older files. See Archive Disk Limit.
Common Settings	MaxStatusLogSize	Maximum length in bytes of the amstatus.log file. Default is 10000000 (10 million) bytes. Minimum value is 1024 bytes.
Common Settings	MSG API Detection List	A list of file types to monitor, separated by blanks. Default is btrv, the only allowed value in the current release.
Common Settings	StatusLogFile	Location of the amstatus.log file. The default path uses the AuditMaster share PVSWAUDIT$, but you can replace it with another location.
Errors to Audit	Btrieve Error Codes to Audit	Sets the Microkernel Engine status codes to log as audit events. A certain number are turned on by default at installation. See Errors to Audit.
Operations to Audit	Operations to Audit Globally	For each file to be monitored, sets the Microkernel Engine events to enter by default in the audit log. These settings can be manually changed on each file. See Operations to Audit Globally.
TNBTMON Paths	Internal legacy setting	No longer used.

Automated Archiving

The Automated Archiving section offers options for configuring the audit record archiving.

By default, AuditMaster automatically moves audit records to an archived file when audit records in the log file reach 75 MB. However, in the Automated Archiving section of Server Settings, you can change this default size, choose to archive by date, or a combination of the two.

If you select the check boxes for both By Date and Time and By Size Threshold, then whichever condition occurs first will prompt the system to create an archived file and reset the log file to empty.

If you clear the By Size Threshold setting and choose only By Date and Time, the system still uses a 2 GB size threshold. If the date and time you select has not occurred and the log file size reaches 2 GB, the system will automatically archive, then when the date and time arrive, it will archive again.

Archives to Keep

The AMmon Settings section offers one settable value, Archives to Keep. By default, the value is –1, which means that the system does not monitor the number of archived files. If the value is greater than zero, then the system retains only that number of the most recent files and deletes the older ones.

After a change is made, you must restart the event handler to activate the new setting. If needed, see Restarting the AuditMaster Event Handler.

Caution Use of this setting may lead to unintentional loss of archived audit records. Be sure to consider the possible situations when it may be undesirable to delete archived files automatically.

Archive Disk Limit

The Common Settings section offers one settable value, Archive Disk Limit. By default, the value is –1, which means that the system does not monitor the total size of all archived files. If the value is greater than zero bytes, then the system retains only the most recent files for which the total size is less than or equal to this number of bytes and deletes the older files.

After a change is made, you must restart the event handler to activate the new setting. If needed, see Restarting the AuditMaster Event Handler.

Caution Use of this setting may lead to unintentional loss of archived audit records. Be sure to consider the possible situations when it may be undesirable to delete archived files automatically.

Errors to Audit

The Errors to Audit group sets the Microkernel Engine status codes to log as audit events.

After AuditMaster installation, a default set of status codes are already selected for logging:

Error	Description
2	The application encountered an I/O error.
8	The current positioning is invalid.
18	The disk is full.
19	The application encountered an unrecoverable error.
32	The file cannot be extended.
37	Another transaction is active.
43	The specified record address is invalid.
46	Access to the specified file is denied.
51	The owner name is invalid.
54	The variable-length portion of the record is corrupt.
67	The MicroKernel cannot open the SQL data dictionary files.
69	The Delete operation specified a file that is damaged.
73	The RI definition is out of sync.
101	Insufficient operating system memory is available.
138	The MicroKernel has detected an invalid null indicator.
141	The user name is invalid for the database login.
142	The database specified on login is invalid.
143	The MicroKernel cannot allow unauthorized access to files in a secure database.
147	The log segment is missing.
148	A roll forward error occurred.

After a change is made, you must restart the event handler to activate the new setting. If needed, see Restarting the AuditMaster Event Handler.

Operations to Audit Globally

The Operations to Audit window offers the same type of settings as the Operations to Audit button in the Audit Configuration window.

The difference is that in Server Settings the options are global for any file in an audit configuration, while in the Audit Configuration window, the button allows you to set operations to audit for individual files.

At installation time, the AuditMaster defaults in this window include all operations except Read. If you select different options, they become the new defaults for any file you add to an audit configuration group. Operations to audit set for files added earlier are not affected unless you click the Apply to All Files button.

Finally, if any file is removed from a group and then added again, its operations to audit settings default to the current selections in this window.

For information on individual file settings, see Operations to Audit by File.

After a change is made, you must restart the event handler to activate the new setting. If needed, see Restarting the AuditMaster Event Handler.

Note In a PSQL database, when the client-side cache engine is turned on, the cache engine reads an entire database page after 8 consecutive reads in anticipation of more reads. The records in the database page read by the cache engine are not audited by the event handler on the server. If auditing requires that every read be captured, verify the setting is off. However, lack of engine caching can reduce database performance. The behavior occurs only when the threshold of 8 consecutive reads is reached. If 7 reads and then an update occurs, no caching occurs and all 7 reads are captured. In PSQL Control Center, expand Local Client, right-click MicroKernel Router, and select Properties, then click Performance tuning to see the setting Use Cache Engine. By default, the setting is off.