Enabling\Configuring Auditing

[philt]

Hi All,

I've enabled & configured EV auditing as per the Administrator's Guide. No tables or views have been created in the EnterpriseVaultAudit database. I've enabled view, opened some archived items but still no record of this in the database. I've restarted EV windows services but still nothing. Do I need to wait? or should this just work?

Thanks in advanced.

Cheers,

Phil

[Rob_Hanson]

I know you said that you started the Services, but did you restart the Admin and Directory Services aswell?

Is the System DSN for the Audit database correct, and have you tested?

This should just work....  if all that has happened, I'd set up DTrace on EVMonitoring, Directory Service and Admin Service and restart the EV Services. 

Technical Support should be able to help you read the DTrace.

[philt]

Thanks Rob,

yes restarted Admin service, which restarts all the other EV service.

What DSN are you referring to?,  I'm viewing the database in SQL Enterprise Manager and no tables have been created.

Followed the documentation and thought it should just work too. I'll go down the Dtrace track and thanks for the advice.

Cheers,

Phil

PS Go Queensland

[andra_christie]

the odbc dsn for the auditing database.

also i am sure you did this, but just in case, please make sure to tick "audit entries based on the following categories", not just the categories below it :)

[philt]

Hi Andra,

I'm looking for the red smilie face with a foot in it's mouth :)

No I didn't tick "audit entries based on the following categories". but have now..."The Otherwise, check or uncheck the required audit cataegories" comment throw me.

Yes  ODBC DSN is there. Symantec tech most of created that when he was here.

Still nothing in the database and get the following error;

Event Type: Error
Event Source: Enterprise Vault
Event Category: Directory Service
Event ID: 13360
Date:  23/05/2007
Time:  9:47:32 AM
User:  N/A
Computer: HOEVAULT
Description:
An error was detected while accessing the Vault Database 'Provider=SQLOLEDB;Server=HOSQL;Database=EnterpriseVaultAudit;Trusted_Connection=yes' (Internal reference: .\ADODataAccess.cpp (CADODataAccess::ExecuteSQLCommand) [lines {1378,1380,1395,1413}] built Feb 22 02:44:10 2007):

Description: 

Could not find stored procedure 'spEvAudit'.
 
 
SQL Command:
 spEvAudit
 
 
Additional Microsoft supplied information:
 
Source:       Microsoft OLE DB Provider for SQL Server
Number:       0x80040e14
SQL State:    42000
Native Error: 00002812
HRESULT  0x80040e14
 

For more information, see Help and Support Center at http://evevent.veritas.com/rosetta/showevent.asp
.

Yes  ODBC DSN is there. Symantec tech most of created that when he was here.

[philt]

Hi Andra,

I've placed a support call and waiting on a contact. In the mean time I've come arcoss the following that might be of some help. The database is called EnterpriseVaultAudit, The ODBC points to this. I've found a SQL script in the Enterprise Vault directory that checks or creates SQL objects in the Audting database. The strange thing is that this script refers to the database as EVAudit not EnterpriseVaultAudit....maybe it's got nothing to do with the issue.

Cheers,

Phil