cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
515
Views
0
Helpful
6
Replies

CSA Agent Start / Stop Service Logging - v5.2

kin.mak
Level 1
Level 1

Hello,

Is there a way for the CSA MC v5.2 to log and audit CSA agent clients when the agent service is manually stop or restart. Thanks,

6 Replies 6

tsteger1
Level 8
Level 8

Yes, use an Agent service control rule.

There should already be one in the Required System Module [W, V5.2 r262].

Tom

Thank you. I will check it out.

I was able to setup a rule - "Agent Service Control" to log attempt to modify local agent configuration. It logged when I disable the CSA agent, but not when I enable it back.

How can I log when the CSA agent is started. Thanks,

You can monitor a service or see Security levels other than medium on the summary screen, but the Agent Service Control rules log when securit is lowered, not raised.

There may be ways to do this but it may help if you would share what you are trying to accomplish.

Tom

Basically I am trying to logging when client's CSA agent service is manually stopped and restarted by administrators. Currently I am running 5.2 r225. The previous version 5.2 r203 we were using used to logged when the CSA agent service is stopped and started. Thanks,

If you did an upgrade, the rules should be in there somewhere or on the old MC.

You could also use an NT Event rule.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: