cancel
Showing results for 
Search instead for 
Did you mean: 

Audit reporting - Archived Items Access and trend reports show blank

Davismisbehavis
Level 4

I have enabled auditing for certain events on our EV 8.0 server using the following document.
http://seer.entsupport.symantec.com/docs/285115.htm

I waited a couple of days for audit data to build up and have now run the reports but they have come back blank saying there is no data available to display.

I've had a quick look in the database that was created and there is plenty of data in there showing query's carried out and items accessed, etc 

My question is why is this not appearing through the reporting services window as expected?

Anyone had this issue?

Thanks in advance

D.Misbehavis
 


 

1 ACCEPTED SOLUTION

Accepted Solutions

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified
Auditing view level is what i was talking about.  Sounds like it it fine to me.

What do you have for View Attachements? Looks like a bug.  ;)

http://support.veritas.com/docs/319209
When Auditing is enabled the View operation is not being logged properly.

Details:
This issue can be seen if Auditing has been enabled for Enterprise Vault (EV) and the View Category is being audited.   This operation is currently not being logged properly in the Audit database and will not show in the Enterprise Vault Audit Viewer.  

Workaround
The operation is being logged under the View Attachments Category and this can be used for auditing purposes.  

1.  Open the Vault Administration Console (VAC) and expand Directory on server_name > Site_name > Enterprise Vault Servers.

2.  Right-click on the EV server name and choose Properties.

3.  On the Auditing tab ensure that Summary is checked for the View Attachments Category.  

4.  Click OK to save the changes.  

The View operation can now be seen in the Enterprise Vault Audit Viewer under the View Attachment category for any future audits.  

 
Symantec Corporation has acknowledged that the above-mentioned issue is present in the current version(s) of the product(s) mentioned at the end of this article. Symantec Corporation is committed to product quality and satisfied customers.
Symantec Corporation currently plans to address this issue by way of a patch or hotfix to the current version of the software. Please be sure to refer back to this document periodically as any changes to the status of the issue will be reflected here. A link to the patch or hotfix download will be added to this document when it becomes available. Please note that Symantec Corporation reserves the right to remove any fix from the targeted release if it does not pass quality assurance tests.  Symantec's plans are subject to change and any action taken by you based on the above information or your reliance upon the above information is made at your own risk.

 

Supplemental Material:

System: Ref.# Description
ETrack: 1514550 8.0- Auditing is returning the Category as 'View Attachment' when it should be returned as 'View'

View solution in original post

10 REPLIES 10

Wayne_Humphrey
Level 6
Partner Accredited Certified
Hi Davismisbehavis,

I think you might have misunderstood something here, there is no gui for viewing audit data in the VAC.  Auditing also has nothing to do with reporting so I am a little confused as to what you getting at I guess.

Davismisbehavis
Level 4

Hi Wayne

Thanks for your response

I'm talking about the SQL reporting services reports called

"Archived Items Access" and "Archived Items Access Trends" these I am lead to believe provide an insight into how often people are dipping into the archive (i.e. sing audit data as a source)

At the moment they are completely blank and return no data even though the system is in use.  If the audit database is not the source for these reports can you tell me what is.

I'm a bit confused, If you cannot view audit data in the VAC and auditing has nothing to do with reporting can you tell me why EV has an auditing function included.  Is it for custom report writing only?

Thanks

D.Misbehavis



Wayne_Humphrey
Level 6
Partner Accredited Certified
Hi Davismisbehavis,

Ahhhh, now this makes a lot more sense.

Auditing which you enabled has nothing to do with Reporting :> The reason for auditing is as its name states, for auditing. 

Have you configured reporting correctly? Are other reports working?

Davismisbehavis
Level 4
Hi Wayne

All other operational reports are working perfectly just not these two.

I'm trying to find the original forum thread / support document that links these two reports not working to auditing not being configured.

In order to report on Archived item access and chart trends it surely has to use the audit data,  how else is it going to accurately know how many archived items have been accessed and when they were accessed?

Cheers

D.Misbehavis



TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified
Hey mate,

Since you have enabled auditing have you re-deployed reporting?

I would re-run the configuration and then check the EVDeployReports.Log to make sure it isn't still reporting that Auditing isn't present.

I think this is the doc you want were it talks about those reports don't work if Auditing isn't enabled.

ftp://exftpp.symantec.com/pub/support/products/Exchange_Mailbox_Archiving_Unit/288139.pdf



Davismisbehavis
Level 4
Hi Tony

Thanks for the link,  that is exactly the document I was looking at.

I have now redeployed the reports and have examined the log,  it contains the following which is a good sign.

Add User Domain\EVOps to the object EVReportingRole
Leaving DBAccess::GrantAccess
Granted access to EnterpriseVaultAudit db on ARCHIVE server. Try next vault server in list

Still nothing in the reports though,  any thoughts

Thanks for your help on this, much appreciated

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified
You do have a check box next to View?

Are there any errors or just blank?

Davismisbehavis
Level 4

Hi Tony

I'm confused by the check box next to view comment.  I've had a look through the auditing configuration on the server.  I have detailed ticked for View, Restore and Archive and summary set for Advanced Search.

I couldn't find any view check boxes related to the reporting services side of things.  below is a screenshot of what is returned when we run the report

imagebrowser image

Cheers

D.Misbehavis

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified
Auditing view level is what i was talking about.  Sounds like it it fine to me.

What do you have for View Attachements? Looks like a bug.  ;)

http://support.veritas.com/docs/319209
When Auditing is enabled the View operation is not being logged properly.

Details:
This issue can be seen if Auditing has been enabled for Enterprise Vault (EV) and the View Category is being audited.   This operation is currently not being logged properly in the Audit database and will not show in the Enterprise Vault Audit Viewer.  

Workaround
The operation is being logged under the View Attachments Category and this can be used for auditing purposes.  

1.  Open the Vault Administration Console (VAC) and expand Directory on server_name > Site_name > Enterprise Vault Servers.

2.  Right-click on the EV server name and choose Properties.

3.  On the Auditing tab ensure that Summary is checked for the View Attachments Category.  

4.  Click OK to save the changes.  

The View operation can now be seen in the Enterprise Vault Audit Viewer under the View Attachment category for any future audits.  

 
Symantec Corporation has acknowledged that the above-mentioned issue is present in the current version(s) of the product(s) mentioned at the end of this article. Symantec Corporation is committed to product quality and satisfied customers.
Symantec Corporation currently plans to address this issue by way of a patch or hotfix to the current version of the software. Please be sure to refer back to this document periodically as any changes to the status of the issue will be reflected here. A link to the patch or hotfix download will be added to this document when it becomes available. Please note that Symantec Corporation reserves the right to remove any fix from the targeted release if it does not pass quality assurance tests.  Symantec's plans are subject to change and any action taken by you based on the above information or your reliance upon the above information is made at your own risk.

 

Supplemental Material:

System: Ref.# Description
ETrack: 1514550 8.0- Auditing is returning the Category as 'View Attachment' when it should be returned as 'View'

Davismisbehavis
Level 4
Hi Tony

I checked the view attachments audit summary and this appears to have kicked started it all into life and reports are now showing data

Thanks for all your help and patience on this one,  hopefully someone else will stumble across this and it will prove useful.

Thanks again

Cheers

D.Misbehavis