Endpoint Administration Guide for Windows › Monitoring and Auditing › The Audit Log › Audit Display Filters › Filter Wizard, Choose Name and Switches Page

Filter Wizard, Choose Name and Switches Page

The Choose Name and Switches page of the Filter Wizard lets you define the name of the audit display filter you want to create and the switches that you want to apply to this filter.

This window contains the following fields:

Filter Name

Defines the name of the audit display filter you want to create.

Audit Event Records

Specifies whether you want the filter to display all audit records or only those switches that are selected.

If you select to list all records, the switches on this page do not apply.

List INET audit records of Host and Service

Specifies whether to list the INET audit records of the TCP requests received from the specified hosts for the specified services. Host and service are masks that identify which set of hosts and services are searched for.

Show LOGINs for user on terminal

Specifies to list the following:

• LOGIN records for the specified user on the specified terminal. Both user and terminal are masks you define.
• Records created by the authorization engine when an invalid password is entered multiple times.

List RESOURCEs audit of class on resource for users

Specifies whether to list resource records. You can define the following later:

• Class—a mask that identifies the class to which the accessed resource belongs.
• Resource—a mask that identifies the names of the resources that were accessed.
• User—a mask that identifies the name of the users who accessed the resources.

List updates to database

Lists database update audit records. You can define:

• Cmd—a mask identifying the selang commands to search for.
• Class—a mask identifying the classes to search for.
• Object—a mask identifying the records to search for.
• User—a mask identifying the users who executed the commands.

List startup/shutdown messages

Specifies whether to list the startup and shutdown messages from the CA ControlMinder services.

List WATCHDOG audit records

Specifies whether to list the Watchdog audit records.

Show only trace records

Specifies whether to only list records sent to the audit log by the tracing facility.