CSA Agent Start / Stop Service Logging - v5.2

Unanswered Question
Jan 7th, 2009


Is there a way for the CSA MC v5.2 to log and audit CSA agent clients when the agent service is manually stop or restart. Thanks,

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
tsteger1 Wed, 01/07/2009 - 13:30

Yes, use an Agent service control rule.

There should already be one in the Required System Module [W, V5.2 r262].


kin.mak Thu, 01/08/2009 - 13:40

I was able to setup a rule - "Agent Service Control" to log attempt to modify local agent configuration. It logged when I disable the CSA agent, but not when I enable it back.

How can I log when the CSA agent is started. Thanks,

tsteger1 Thu, 01/08/2009 - 16:45

You can monitor a service or see Security levels other than medium on the summary screen, but the Agent Service Control rules log when securit is lowered, not raised.

There may be ways to do this but it may help if you would share what you are trying to accomplish.


kin.mak Fri, 01/09/2009 - 10:27

Basically I am trying to logging when client's CSA agent service is manually stopped and restarted by administrators. Currently I am running 5.2 r225. The previous version 5.2 r203 we were using used to logged when the CSA agent service is stopped and started. Thanks,

tsteger1 Sun, 01/11/2009 - 21:20

If you did an upgrade, the rules should be in there somewhere or on the old MC.

You could also use an NT Event rule.


This Discussion