Forum Discussion

Davismisbehavis's avatar
16 years ago
Solved

Audit reporting - Archived Items Access and trend reports show blank

I have enabled auditing for certain events on our EV 8.0 server using the following document.
http://seer.entsupport.symantec.com/docs/285115.htm

I waited a couple of days for audit data to build up and have now run the reports but they have come back blank saying there is no data available to display.

I've had a quick look in the database that was created and there is plenty of data in there showing query's carried out and items accessed, etc 

My question is why is this not appearing through the reporting services window as expected?

Anyone had this issue?

Thanks in advance

D.Misbehavis
 


 

  • Auditing view level is what i was talking about.  Sounds like it it fine to me.

    What do you have for View Attachements? Looks like a bug.  ;)

    http://support.veritas.com/docs/319209
    When Auditing is enabled the View operation is not being logged properly.

    Details:
    This issue can be seen if Auditing has been enabled for Enterprise Vault (EV) and the View Category is being audited.   This operation is currently not being logged properly in the Audit database and will not show in the Enterprise Vault Audit Viewer.  

    Workaround
    The operation is being logged under the View Attachments Category and this can be used for auditing purposes.  

    1.  Open the Vault Administration Console (VAC) and expand Directory on server_name > Site_name > Enterprise Vault Servers.

    2.  Right-click on the EV server name and choose Properties.

    3.  On the Auditing tab ensure that Summary is checked for the View Attachments Category.  

    4.  Click OK to save the changes.  

    The View operation can now be seen in the Enterprise Vault Audit Viewer under the View Attachment category for any future audits.  

     
    Symantec Corporation has acknowledged that the above-mentioned issue is present in the current version(s) of the product(s) mentioned at the end of this article. Symantec Corporation is committed to product quality and satisfied customers.
    Symantec Corporation currently plans to address this issue by way of a patch or hotfix to the current version of the software. Please be sure to refer back to this document periodically as any changes to the status of the issue will be reflected here. A link to the patch or hotfix download will be added to this document when it becomes available. Please note that Symantec Corporation reserves the right to remove any fix from the targeted release if it does not pass quality assurance tests.  Symantec's plans are subject to change and any action taken by you based on the above information or your reliance upon the above information is made at your own risk.

     

    Supplemental Material:

    System: Ref.# Description
    ETrack: 1514550 8.0- Auditing is returning the Category as 'View Attachment' when it should be returned as 'View'

  • Hi Davismisbehavis,

    I think you might have misunderstood something here, there is no gui for viewing audit data in the VAC.  Auditing also has nothing to do with reporting so I am a little confused as to what you getting at I guess.
  • Hi Wayne

    Thanks for your response

    I'm talking about the SQL reporting services reports called

    "Archived Items Access" and "Archived Items Access Trends" these I am lead to believe provide an insight into how often people are dipping into the archive (i.e. sing audit data as a source)

    At the moment they are completely blank and return no data even though the system is in use.  If the audit database is not the source for these reports can you tell me what is.

    I'm a bit confused, If you cannot view audit data in the VAC and auditing has nothing to do with reporting can you tell me why EV has an auditing function included.  Is it for custom report writing only?

    Thanks

    D.Misbehavis



  • Hi Davismisbehavis,

    Ahhhh, now this makes a lot more sense.

    Auditing which you enabled has nothing to do with Reporting :> The reason for auditing is as its name states, for auditing. 

    Have you configured reporting correctly? Are other reports working?
  • Hi Wayne

    All other operational reports are working perfectly just not these two.

    I'm trying to find the original forum thread / support document that links these two reports not working to auditing not being configured.

    In order to report on Archived item access and chart trends it surely has to use the audit data,  how else is it going to accurately know how many archived items have been accessed and when they were accessed?

    Cheers

    D.Misbehavis



  • Hey mate,

    Since you have enabled auditing have you re-deployed reporting?

    I would re-run the configuration and then check the EVDeployReports.Log to make sure it isn't still reporting that Auditing isn't present.

    I think this is the doc you want were it talks about those reports don't work if Auditing isn't enabled.

    ftp://exftpp.symantec.com/pub/support/products/Exchange_Mailbox_Archiving_Unit/288139.pdf



  • Hi Tony

    Thanks for the link,  that is exactly the document I was looking at.

    I have now redeployed the reports and have examined the log,  it contains the following which is a good sign.

    Add User Domain\EVOps to the object EVReportingRole
    Leaving DBAccess::GrantAccess
    Granted access to EnterpriseVaultAudit db on ARCHIVE server. Try next vault server in list

    Still nothing in the reports though,  any thoughts

    Thanks for your help on this, much appreciated
  • Hi Tony

    I'm confused by the check box next to view comment.  I've had a look through the auditing configuration on the server.  I have detailed ticked for View, Restore and Archive and summary set for Advanced Search.

    I couldn't find any view check boxes related to the reporting services side of things.  below is a screenshot of what is returned when we run the report

    imagebrowser image

    Cheers

    D.Misbehavis

  • Auditing view level is what i was talking about.  Sounds like it it fine to me.

    What do you have for View Attachements? Looks like a bug.  ;)

    http://support.veritas.com/docs/319209
    When Auditing is enabled the View operation is not being logged properly.

    Details:
    This issue can be seen if Auditing has been enabled for Enterprise Vault (EV) and the View Category is being audited.   This operation is currently not being logged properly in the Audit database and will not show in the Enterprise Vault Audit Viewer.  

    Workaround
    The operation is being logged under the View Attachments Category and this can be used for auditing purposes.  

    1.  Open the Vault Administration Console (VAC) and expand Directory on server_name > Site_name > Enterprise Vault Servers.

    2.  Right-click on the EV server name and choose Properties.

    3.  On the Auditing tab ensure that Summary is checked for the View Attachments Category.  

    4.  Click OK to save the changes.  

    The View operation can now be seen in the Enterprise Vault Audit Viewer under the View Attachment category for any future audits.  

     
    Symantec Corporation has acknowledged that the above-mentioned issue is present in the current version(s) of the product(s) mentioned at the end of this article. Symantec Corporation is committed to product quality and satisfied customers.
    Symantec Corporation currently plans to address this issue by way of a patch or hotfix to the current version of the software. Please be sure to refer back to this document periodically as any changes to the status of the issue will be reflected here. A link to the patch or hotfix download will be added to this document when it becomes available. Please note that Symantec Corporation reserves the right to remove any fix from the targeted release if it does not pass quality assurance tests.  Symantec's plans are subject to change and any action taken by you based on the above information or your reliance upon the above information is made at your own risk.

     

    Supplemental Material:

    System: Ref.# Description
    ETrack: 1514550 8.0- Auditing is returning the Category as 'View Attachment' when it should be returned as 'View'

  • Hi Tony

    I checked the view attachments audit summary and this appears to have kicked started it all into life and reports are now showing data

    Thanks for all your help and patience on this one,  hopefully someone else will stumble across this and it will prove useful.

    Thanks again

    Cheers

    D.Misbehavis