Endpoint Administration Guide for Windows › Monitoring and Auditing › Monitoring Access Control Activity

Monitoring Access Control Activity

The CA Access Control trace is a real-time log that can show every action taken by CA Access Control. Trace records are accumulated in ACInstallDir\log\seosd.trace (where ACInstallDir is the directory where you installed CA Access Control).

Or they are accumulated in whatever file you specify as the trace_file value in the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\AccessControl\SeOSD\

Although you can filter the records from the trace file, the trace mechanism is designed for system monitoring and not for security auditing.

By default, CA Access Control only generates trace messages during CA Access Control initialization. Once CA Access Control is initialized, it stops the trace mechanism and trace messages are not generated.