Endpoint Administration Guide for Windows › Monitoring and Auditing › Monitoring Access Control Activity

Monitoring Access Control Activity

The CA ControlMinder trace is a real-time log that can show every action taken by CA ControlMinder. Trace records are accumulated in ACInstallDir\log\seosd.trace (where ACInstallDir is the directory where you installed CA ControlMinder).

Or they are accumulated in whatever file you specify as the trace_file value in the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\AccessControl\SeOSD\

Although you can filter the records from the trace file, the trace mechanism is designed for system monitoring and not for security auditing.

By default, CA ControlMinder only generates trace messages during CA ControlMinder initialization. Once CA ControlMinder is initialized, it stops the trace mechanism and trace messages are not generated.