Audit Report - Archived Items Access

[Tonaco_pt]

Hi All,

I'm creating a report where among other things I want to indicate how many items have been access in the enterprise vault archive.

I tried the build in Archived Items Access report and just for today (10am) got the following report:

This mean 2 Individual user accessed the archive and made 86000+ access, when we check what access where made and by whom, we verify that one of the user was the enterprise vault service account with 86000+ access.

How can I prevent the enterprise vault service account access being the monitoring?

[TonySterling · Accepted solution]

AFAIK there is no way to exclude the EV VSA from being monitored.  You could submit an idea in the Ideas section but IMHO it will be a low priority item.

TS

[AndrewB]

"How can I prevent the enterprise vault service account access being the monitoring?"

what about using roles based access and setup accounts that have access to the archives instead of using the service account?

Roles-based administration

Article:HOWTO56620

|

Created: 2011-08-01

|

Updated: 2013-07-12

|

Article URL http://www.symantec.com/docs/HOWTO56620

[Tonaco_pt]

Hi AndrewB

If a delegate this role, what would appear in the Archived Items Access report would be that access of those account, right? I just want to know who is accessing the vault archive, need to determiner if the enterprise vault as many access, if I can be more aggressive in the archive policy. I don't need to know how many time enterprise vault access the item in the vault.

[AndrewB]

you could crank up IIS logging and parse through them yourself to see what's going on on your EV server instead. that way you can include only what's relevant to you.

[Tonaco_pt]

For now I ask the SQL team for help, the made a script that eliminate the Vault Service Account entries and compact the DB so it doesn't grow back to 100GB again.I'm purposing the idea. Thanks for your all for the help.