Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

CSA Agent Start / Stop Service Logging - v5.2

Hello,

Is there a way for the CSA MC v5.2 to log and audit CSA agent clients when the agent service is manually stop or restart. Thanks,

6 REPLIES
Blue

Re: CSA Agent Start / Stop Service Logging - v5.2

Yes, use an Agent service control rule.

There should already be one in the Required System Module [W, V5.2 r262].

Tom

New Member

Re: CSA Agent Start / Stop Service Logging - v5.2

Thank you. I will check it out.

New Member

Re: CSA Agent Start / Stop Service Logging - v5.2

I was able to setup a rule - "Agent Service Control" to log attempt to modify local agent configuration. It logged when I disable the CSA agent, but not when I enable it back.

How can I log when the CSA agent is started. Thanks,

Blue

Re: CSA Agent Start / Stop Service Logging - v5.2

You can monitor a service or see Security levels other than medium on the summary screen, but the Agent Service Control rules log when securit is lowered, not raised.

There may be ways to do this but it may help if you would share what you are trying to accomplish.

Tom

New Member

Re: CSA Agent Start / Stop Service Logging - v5.2

Basically I am trying to logging when client's CSA agent service is manually stopped and restarted by administrators. Currently I am running 5.2 r225. The previous version 5.2 r203 we were using used to logged when the CSA agent service is stopped and started. Thanks,

Blue

Re: CSA Agent Start / Stop Service Logging - v5.2

If you did an upgrade, the rules should be in there somewhere or on the old MC.

You could also use an NT Event rule.

155
Views
0
Helpful
6
Replies
CreatePlease to create content