Endpoint Administration Guide for Windows › Monitoring and Auditing › Viewing Audit Events › Audit Events in the Windows Event Log

Audit Events in the Windows Event Log

The Windows event log stores audit events from various sources in a single collection. If you configure CA ControlMinder to route audit events to the event log, each time seosd writes an audit event to the CA ControlMinder audit log, a corresponding event is sent to the event log.

The audit.cfg file filters audit events from both the audit log and the event log. If an audit event is not written to the audit log, it is not sent to the event log.

The Windows 2008 event log also routes audit events into containers called channels, depending on the volume, audience, and originating application of the audit events. The CA ControlMinder channel is named CA-AccessControl-AuthorizationEngine/Audit.

If you have deployed CA ControlMinder on a Windows 2008 server, you can choose to send audit events to:

• the event log
• the channel
• both the event log and the channel
• neither the event log or the channel