Endpoint Administration Guide for Windows › Monitoring and Auditing › Viewing Audit Events

Viewing Audit Events

CA ControlMinder sends audit events to the audit logs. You view the audit logs using the following CA ControlMinder tools:

• CA ControlMinder Endpoint Management
• The seaudit utility

You can configure CA ControlMinder to also send audit events to the Windows event log. The event log stores audit events from various applications in a single collection. You use the Windows Event Viewer to view audit events in the event log.

Audit Events in the Windows Event Log

The Windows event log stores audit events from various sources in a single collection. If you configure CA ControlMinder to route audit events to the event log, each time seosd writes an audit event to the CA ControlMinder audit log, a corresponding event is sent to the event log.

The audit.cfg file filters audit events from both the audit log and the event log. If an audit event is not written to the audit log, it is not sent to the event log.

The Windows 2008 event log also routes audit events into containers called channels, depending on the volume, audience, and originating application of the audit events. The CA ControlMinder channel is named CA-AccessControl-AuthorizationEngine/Audit.

If you have deployed CA ControlMinder on a Windows 2008 server, you can choose to send audit events to:

• the event log
• the channel
• both the event log and the channel
• neither the event log or the channel