Integration Guide › Integrating with CA User Activity Reporting Module › CA User Activity Reporting Module Integration Architecture › CA User Activity Reporting Module Integration Components

CA User Activity Reporting Module Integration Components

CA User Activity Reporting Module integration uses the following CA Access Control components. These components are part of the CA Access Control enterprise reporting service:

• A Report Agent is a Windows service or a UNIX daemon that runs on each CA Access Control or UNAB endpoint and sends information to queues on a configured Message Queue that resides on the Distribution Server. For CA User Activity Reporting Module integration, the Report Agent collects endpoint audit messages from the audit log files on a scheduled basis, and sends these events to the audit queue on a configured Distribution Server.
• A Message Queue is a component of the Distribution Server that is configured for receiving endpoint information that Report Agents send. For reporting, the Message Queue forwards endpoint database snapshots to the central database using the CA Access Control Web Service. For redundancy and failover, you can have multiple Distribution Servers collecting and forwarding the information.

Note: CA Access Control Enterprise Management installs the Distribution Server on the Enterprise Management Server by default.

CA User Activity Reporting Module integration also uses the following CA User Activity Reporting Module components:

• A CA User Activity Reporting Module agent is a generic service configured with connectors, each of which collects raw events from a single event source and then sends the events to a CA User Activity Reporting Module server for processing. For CA Access Control audit data, the agent deploys the CA Access Control connector.
• A CA Access Control connector is an out-of-the-box CA User Activity Reporting Module integration for a CA Access Control audit event source. The connector enables raw event collection from a CA Access Control Distribution Server and the rule-based transmission of converted events to an event log store, where they are inserted into the hot database.
• A collection server is a CA User Activity Reporting Module server that refines incoming event logs, insert them into the hot database, compresses the hot database when it reaches the configured size into a warm database, and auto-archives the warm database to the related management server on the configured schedule.

Note: For more information about CA User Activity Reporting Module components, see the CA User Activity Reporting Module documentation.

More information:

Reporting Service Architecture

Reporting Service Components