Endpoint Administration Guide for Windows › Monitoring and Auditing › The Auditing Process

The Auditing Process

To configure CA Access Control for your auditing requirements, you must first understand how auditing works. Auditing lets you keep track of access requests (events) that CA Access Control intercepted. You can use this data to meet with compliance requirements, to analyze and refine your access rules for your security requirements, or to monitor access requests.

The process CA Access Control follows to record audit events in the log depends on the type of event it intercepts:

• Interception events

  Note: Intercepted login events (TERMINAL class), and audit records generated by user traces, are not cached; they always follow the auditing process for interception events.

• Audit events

Note: CA Access Control intercepts an event only if the appropriate class is active, and the database contains a rule anticipating this event.