Endpoint Administration Guide for Windows › Monitoring and Auditing › Viewing Audit Events › Route Audit Events to the Windows Event Log

Route Audit Events to the Windows Event Log

If you configure CA ControlMinder to route audit events to the Windows event log, each time seosd writes an audit event to the CA ControlMinder audit log, a corresponding event is sent to the event log. You can also configure CA ControlMinder to send Policy Model audit events to the event log.

To route events to the event log

1. Stop CA ControlMinder using the following command:

   secons -s
   

   CA ControlMinder stops.

2. Set the value of the SendAuditToNativeLog configuration setting in the logmgr section to 1.

   Audit events are sent to the Windows event log.

3. (Optional) Set the value of the SendAuditToNativeLog configuration setting in the Pmd section to 1.

   Audit events for policy models are sent to the Windows event log.

4. Restart CA ControlMinder using the following command:

   seosd -start
   

   CA ControlMinder restarts.

Example: Route Audit Events to the Event Log

The following example routes audit events to the event log. You must be in the remote configuration environment (env config) to use this command:

er config ACROOT section(logmgr) token(SendAuditToNativeLog) value(1)

Example: Route Policy Model Audit Events to the Event Log

The following example routes Policy Model audit events to the event log. You must be in the remote configuration environment (env config) to use this command:

er config ACROOT section(Pmd) token(SendAuditToNativeLog) value(1)

More information:

Change Configuration Settings