Endpoint Administration Guide for UNIX › Auditing Events › Warning Mode › Put a Resource into Warning Mode

Put a Resource into Warning Mode

You put a resource into Warning mode to monitor the effects of access rules, without needing to enforce these rules.

Note: As well as putting individual resources into Warning mode, you can put a class into Warning mode.

To put a resource into Warning mode

1. In CA ControlMinder Endpoint Management edit the resource you want to put into Warning mode.

   The appropriate Modify page appears.

2. Click the Audit tab.

   The Audit Modes page for the resource appears.

3. Select Warning Mode, and click Save.

   The resource you modified is now in Warning mode.

Note: In Warning mode, CA ControlMinder always writes warning records to the audit log when access is permitted but access rules are violated: you do not need to set the audit property on the resource for this to happen.

Use the sereport utility (report number 6) to see all resources in Warning mode.

Example: Put a File into Warning Mode

The following selang example puts the file c:\myfile into Warning mode:

chres FIlE c:\myfile warning

Example: Clear Warning Mode from a File

The following selang example takes the file c:\myfile out of Warning mode:

chres FIlE c:\myfile warning-

Warning mode is now not active for the myfile, so CA ControlMinder enforces the access rules for myfile.

Example: Put a Terminal into Warning Mode

The following selang example puts the terminal myterminal into warning mode:

chres terminal myterminal warning

CA ControlMinder permits access by any authorized user from the terminal myterminal, but logs an audit record for any user that normally would be denied access from that terminal.