Previous Topic: pwextractor Utility—Extract Privileged Account PasswordsNext Topic: ReportAgent Log Files


ReportAgent Utility—Send Report Snapshots and Audit Events

The ReportAgent sends report snapshots and audit events to the Distribution Server for inclusion in CA ControlMinder, UNAB, and CA User Activity Reporting reports.

You must configure an endpoint for reporting before you run the ReportAgent. When you configure an endpoint for reporting, you specify the Distribution Server with which the ReportAgent communicates and the schedule at which it runs. After you configure an endpoint for reporting, the ReportAgent runs as a daemon or service and sends snapshots at the scheduled times. However, if you want to immediately send report snapshots or audit events to the Distribution Server, you can run the ReportAgent on demand.

Note: For more information about how to configure an endpoint for reporting, see the Implementation Guide. You can also use the report_agent.sh script to configure, start, and stop the ReportAgent on UNIX computers.

On UNIX computers, you run the ReportAgent utility from the ACSharedDir/bin directory on a UNIX computer, where ACSharedDir is the default directory /opt/CA/AccessControlShared. You may also need to set the library path environment variable.

This command has the following syntax:

ReportAgent -debug {0 | 1 | 2} -task {0 | 1 | 2 | 3 | 4} [-now]
ReportAgent -report snapshot
-debug {0 | 1 | 2}

Specifies to run the ReportAgent in debug mode. The ReportAgent service or daemon must be stopped to use this option.

Limits: 0—Prints debug information to the console.

1—Prints debug information to the log file.

2—Does not print debug information (no output).

-task {0 | 1 | 2 | 3 | 4}

Specifies the information that the ReportAgent sends to the Distribution Server.

Limits: 0—Sends a snapshot of the CA ControlMinder database and any local PMDBs to the queue/snapshots queue on the Distribution Server.

1—Sends endpoint audit events to the queue/audit queue on the Distribution Server.

2—(UNIX) Sends a snapshot of the UNAB database to the ac_endpoint_to_server queue on the Distribution Server.

3—(UNIX) Sends UNAB audit events to the queue/audit queue on the Distribution Server.

4—(UNIX) Sends keyboard logger audit events to the queue/audit queue on the Distribution Server.

-now

Specifies to immediately run the ReportAgent.

If you do not specify this option, the ReportAgent runs at the next scheduled time.

-report snapshot

Specifies to immediately send a snapshot of the CA ControlMinder database and any local PMDBs to the queue/snapshots queue on the Distribution Server. The ReportAgent service or daemon must be running to use this option.

Example: View ReportAgent Debug Information

The following example sets the library path environment variable on a Linux computer, then specifies to immediately run the ReportAgent in debug mode, print debug information to the console, and send audit events to the Distribution Server:

LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:/opt/CA/AccessControlShared/lib
export LD_LIBRARY_PATH
cd /opt/CA/AccessControlShared/bin
./ReportAgent -debug 0 -task 1 -now

More information:

Configure a Windows Endpoint for Reporting

Configure a UNIX Endpoint for Reporting