LEM-File Audit Alerts

When I use nDepth to search for FileAudit-DetectionIP I do not see results for all servers. They all have the same tools running from the same group. What am I missing here? We need to log all changes that occur on a MS SQL Server thats on a Windows 2003 Server; for Sarbox.

Any help is appreciated!

Find more posts tagged with

file_audit

Accepted answers

All comments

phil3

Do all of the servers have the same level of file auditing enabled in Windows? We have a KB with recommendations if you're interested: [LEM] Audit Policy and Best Practice.

If this doesn't help, perhaps you could post the entire search parameters. You can switch your search input mode to "Text" using the toggle on the left side of the search bar and paste that content here, or you could just upload a screenshot of the Search Builder view.

Thanks.

chadder08

I found my problem. I had not enabled FileAudit in the Rules.

Thanks for your quick reply!

chadder08

However...I don't recall what if anything I need to do after enabling the Rule.

phil3

Are you talking about a rule you have enabled in your LEM Console? If so, you'll want to be sure to click the Activate Rules button at the top of the Build > Rules view to sync your local changes with your LEM Manager.

The presence of this sort of rule shouldn't affect whether you can search File Audit events using nDepth, however, so I'm confused about the correlation here. If your LEM Manager is picking up the events from the Agent, you should see them in your filters and they should be searchable in nDepth regardless of your LEM rules.

chadder08

Hmmm.... I see fileaudit events for other servers but not the one I need.