01-07-2009 12:58 PM - edited 03-09-2019 09:56 PM
Hello,
Is there a way for the CSA MC v5.2 to log and audit CSA agent clients when the agent service is manually stop or restart. Thanks,
01-07-2009 01:30 PM
Yes, use an Agent service control rule.
There should already be one in the Required System Module [W, V5.2 r262].
Tom
01-07-2009 01:57 PM
Thank you. I will check it out.
01-08-2009 01:40 PM
I was able to setup a rule - "Agent Service Control" to log attempt to modify local agent configuration. It logged when I disable the CSA agent, but not when I enable it back.
How can I log when the CSA agent is started. Thanks,
01-08-2009 04:45 PM
You can monitor a service or see Security levels other than medium on the summary screen, but the Agent Service Control rules log when securit is lowered, not raised.
There may be ways to do this but it may help if you would share what you are trying to accomplish.
Tom
01-09-2009 10:27 AM
Basically I am trying to logging when client's CSA agent service is manually stopped and restarted by administrators. Currently I am running 5.2 r225. The previous version 5.2 r203 we were using used to logged when the CSA agent service is stopped and started. Thanks,
01-11-2009 09:20 PM
If you did an upgrade, the rules should be in there somewhere or on the old MC.
You could also use an NT Event rule.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide