Endpoint Administration Guide for Windows › Managing Endpoints › What Is CA Access Control? › Expanding Native Security › Sending Audit Events to Unicenter TNG

Sending Audit Events to Unicenter TNG

Integration with Unicenter TNG is set up at installation.

You can choose to send audit data to Unicenter TNG, permit launching of CA Access Control from Unicenter TNG, or both. The two options are not interrelated.

Selecting the first option sets registry values under the subkey:

HKEY_LOCAL_MACHINE\Software\ComputerAssociates\AccessControl\UCTNG

The value Integration is set to 1 (yes) and the value EvtManagerServer receives the name of the Unicenter TNG host as a string value.

Audit events that are passed to Unicenter TNG appear in the Console logs in the Unicenter Enterprise Management\Enterprise Managers\Windows NT\Event window.

The second option permits launching CA Access Control from the Unicenter WorldView menu by pointing to the icon representing the TCP/IP Network in the Managed Objects window and selecting CA Access Control from the right-click menu.

CA Access Control also sends following information about events:

• Product name (CA Access Control + version number)
• User name
• Terminal name
• Class name
• Resource name
• Process name
• Event's time
• Full audit message in the format of CA Access Control auditing

The fields User name, Terminal name, Class name, Resource name, and Process name are not always sent, depending on event type.