Endpoint Administration Guide for Windows › Managing Endpoints › What Is CA ControlMinder? › Expanding Native Security › Sending Audit Events to Unicenter TNG

Sending Audit Events to Unicenter TNG

Integration with Unicenter TNG is set up at installation.

You can choose to send audit data to Unicenter TNG, permit launching of CA ControlMinder from Unicenter TNG, or both. The two options are not interrelated.

Selecting the first option sets registry values under the subkey:

HKEY_LOCAL_MACHINE\Software\ComputerAssociates\AccessControl\UCTNG

The value Integration is set to 1 (yes) and the value EvtManagerServer receives the name of the Unicenter TNG host as a string value.

Audit events that are passed to Unicenter TNG appear in the Console logs in the Unicenter Enterprise Management\Enterprise Managers\Windows NT\Event window.

The second option permits launching CA ControlMinder from the Unicenter WorldView menu by pointing to the icon representing the TCP/IP Network in the Managed Objects window and selecting CA ControlMinder from the right-click menu.

CA ControlMinder also sends following information about events:

• Product name (CA ControlMinder + version number)
• User name
• Terminal name
• Class name
• Resource name
• Process name
• Event's time
• Full audit message in the format of CA ControlMinder auditing

The fields User name, Terminal name, Class name, Resource name, and Process name are not always sent, depending on event type.