Implementation Guide › Considerations for CA Audit Users › Sending CA Audit Events to CA User Activity Reporting Module › Modify an Existing CA Audit Policy to Send Events to CA User Activity Reporting Module

Modify an Existing CA Audit Policy to Send Events to CA User Activity Reporting Module

Use this procedure to enable a CA Audit client to send events to both CA User Activity Reporting Module and the CA Audit collector database. By adding a new target to the Route or Collector actions on an existing rule, you can send collected events to both systems. As an alternative, you can also modify specific policies or rules to send events only to the CA User Activity Reporting Module server.

CA User Activity Reporting Module collects events from CA Audit clients using the CA Audit SAPI Router and CA Audit SAPI Collector listeners. Collected events are stored in the CA User Activity Reporting Module event log store only after you push the policy to the clients and it becomes active.

Important: You must configure the CA User Activity Reporting Module listeners to receive events before you modify and activate the policy. If you do not do this configuration first, you may have incorrectly mapped events if events arrive between the time that the policy becomes active and the listeners can correctly map the events.

To modify an existing policy rule's action to send events to CA User Activity Reporting Module

1. Log into the Policy Manager server and access the My Policies tab in the left pane.
2. Expand the policy folder until you can see the desired policy.
3. Click the policy to display its basic information in the Details pane to the right.
4. Click Edit in the Details pane to add to the policy's rules. The rule wizard starts.
5. Click the Edit Actions next to the arrow for the wizard's step 3. The wizard's rule actions page displays.
6. Click the Collector action in the Browse Actions pane on the left. This displays the Action List to the right.

   You can also use the Route action to create a rule to send events to a CA User Activity Reporting Module server.

7. Click New to add a new rule.
8. Enter the IP address or host name of the collection CA User Activity Reporting Module server.

   For a CA User Activity Reporting Module implementations with two or more servers, you can enter a different CA User Activity Reporting Module host name or IP address in the Alternate Host Name field to take advantage of <Aus>'s automatic failover feature. If the first CA User Activity Reporting Module server is not available, CA Audit automatically sends events to the server named in the Alternate Host Name field.

9. Enter the name of the management CA User Activity Reporting Module server in the Alternate Host Name field, and then create a description for this new rule action.
10. Clear the check box, Perform this action on remote server, if it is checked.
11. Click Add to save the new rule action and then click Finish in the wizard window.
12. Select the Rules tab in the lower right pane, and then select a rule to check.
13. Click Check Policies to check the changed rule with the new actions to ensure that it compiles properly.

    Make any needed modifications to the rule and ensure that it compiles correctly before you activate it.

14. Click Activate to distribute the checked policy that contains the new rule actions you added.
15. Repeat this procedure for each rule and policy with collected events you want to send to CA User Activity Reporting Module.

More information:

About the SAPI Router and Collector

Configure the SAPI Collector Service

Configure the SAPI Router Service