ProActive Security Audit

Alerts

Selecting the Alerts menu option allows the disabling or enabling of the automatic interface and operator alerts. When the item is checked (default state) an alert will be issued whenever a monitored target is added, modified or deleted since the baseline was created.

Note: Interface alerts are available for all editions of the ProActive Security Audit. Operator alerts are only available in the Standard Edition.

Interface Alerts

If the ProActive Security Audit Utility is running at the time a discrepancy is first encountered an alert will be issued at the completion of the audit cycle. Subsequent audit cycles will not issue an alert for discrepancies recognized and reported in previous audit cycles.

If the utility is not running at the time a discrepancy is first encountered an alert will be issued whenever the utiltiy is started.

Note: Interface alerts are automatically displayed in the application log viewer because the current log may not contain the actual alert when the ProActive Security Audit Utility is started.

This situation can arise in three situations:

• If the utility is started and the agent is not currently running but has previously issued an alert.
• If a discrepancy is discovered and an alert is issued but the utility is not running at the time.
• If the first audit cycle [after restart of the service agent] has not yet completed the current log will have the message that there is not enough data collected to determine if problems exist.

The application log will also contain this message as well as the messages from previous audit cycles. Each running of the agent produces a uniquely numbered Error Log. Scroll down and examine the error logs to determine why the alert was issued.

Although optional, it is a good practice to archive the application log from time to time so that it will be less cluttered and eassier to read when an alert is issued. The archived logs will be available for viewing in the Archive Log Viewer. See a description of the archive log viewer in Archive Logs in the View Menu Options section.

Operator Alerts

Operator Alerts are written to the event log as they happen. Monitoring of the event log, either manually or automatically, will reveal an error messages for each discrepancy encountered. See a description of the event log in the Miscelanous Topics section. The operator log is provided so that if the audit is running on a server there will be a record of events as they happen. On a workstation it can be assumed that someone is will receive the alert. On a server that may not happen in a timely manner.