One Identity Management Console for Unix 2.5.2 - Administration Guide

Listing events and replaying keystroke logs

Keystroke logs are related to events. When you run a command, such as sudo whoami, the policy server either accepts or rejects the command based on the rules in the policy. When the policy server accepts the command, it creates an event and a corresponding keystroke log. If it rejects the event, it does not create a keystroke log. In order to view a keystroke log, you must first list events.

To list events and replay keystroke logs

1. From the mangement console, navigate to Policy | Event Logs.

   Note: You can also access Event Logs from these context menus: From the host list on the All Hosts view, right-click a host name and choose Find event logs. From the console All Local Users tab, right-click a user name and choose Find event logs. From a host's properties Users tab, right-click a user name and choose Find event logs. From the console Active Directory tab, right-click an AD object name and choose Find event logs.

2. Select options in the search controls on the Find Event Logs pane, and click Find.

   For example, you can search for all events logged for a particular user, or all events logged on a particular host, or you can find events logged during a specific date and time.

   • In the Policy Group box, select a policy group name.
   • In the Where user is box, enter or select either a local user or Active Directory user.
   • In the Where Host is box, select or enter either a fully qualified host name format (myhost.mycompany.com) or a short name format (myhost), depending on how host names are resolved and the use of the short name setting in the pm.settings file.

     Note: Host names may appear in the event logs and keystroke log files in either format. To ensure you match a host name, when you specify host name search criteria, use the short host name format with an asterisk wild card (myhost*).

   • In the Log contains box, enter an optional keyword to search for in the contents of all logs.

     For example, you can find events that pertain to the usage of a specific command or content of the command output.

   • In the Log status box, choose to list all logs reporting Accepted events, Rejected events, or both types of events.

3. Click the Replay keystroke log button next to a listed event to load the log for replay.

   A Replay Log tab displays.

4. Click the Play button () to replay the log.

Replay log controls

To use the replay log controls

1. Click , the Play button, to start or pause the log replay.
2. Click , the Step Forward button, to step forward through the keystrokes.

   Note: The Step Forward and Step Backwards buttons are not enabled while the log is replaying.

3. Click , the Step Backwards button, to step backwards through the keystrokes.
4. Click , the Stop button, to stop the replay and reset the log back to the beginning.
5. Click , the Replay Speed button, to change the speed of the replay. Clicking this button repeatedly steps through speed selections of 1 to 5 times the normal speed.
6. Click , the Text View button, to display the entire replay log as text without replaying it.

   Note: To close a text view of a log, click the Text View button again.

Reporting

Management Console for Unix enables administrators to quickly and easily provide auditors with granular reports on Unix identity information, including the highly desirable assessment of which Active Directory user can authenticate on specific Unix systems. By consolidating the generation and viewing of reports within the console, Management Console for Unix reduces the time and effort required to create key reports that traditionally required multiple collections, data collation, and manual processes across multiple Unix systems.

The topics in this section explain how to export reports for the hosts managed through the mangement console. It also provides a description of the reports available on the Reporting tab.

Running reports

You can run various reports that capture key information about the Unix hosts you manage from the mangement console and the Active Directory domains joined to these hosts from the Reports view on the Reporting tab.

To run reports

1. Ensure the hosts for which you want to create reports have been recently profiled.

   Reports only generate data gathered from the clients during a Profile procedure. Profiling imports information about the host, including local users and groups.

   Note: You can configure the mangement console to profile hosts automatically. See Automatically profiling hosts for details.

2. From the mangement console, click the Reporting tab.
3. From the Reports view, expand the report group names to view the available reports, if necessary.
   • Host Reports

     Unix host information gathered during the profiling process

   • User Reports

     Local and Active Directory user information

   • Group Reports

     Local and Active Directory group information

   • Access & Privileges Reports

     User access information

   • License Usage Reports

     Product licensing information.

4. Use one of the following methods to select a report:
   • Double-click a report name in the list (such as the Unix Host Profiles report).
   • Right-click a report name and select Run report.
   • Click the report icon next to a report.

   The selected report name opens a new tab on the Reports view which describes the report and provides some report parameters you can select or clear to add or exclude details on the report.

5. Optionally clear parameters to exclude information from the report.
6. To create a report, either
   1. Click Preview to see a sample of the report in a browser.
   2. Open the Export drop-down menu and select the format you want to use for the report: PDF or CSV (if available).

   Note: If the CSV report does not open, you may need to reset your internet options. See CSV or PDF reports do not open for details.

   By default, the mangement console creates reports in the application data directory:

   • On Windows:

     %SystemDrive%:\ProgramData\Quest Software\Management Console for Unix\reports

   • On Unix/Linux:

     /var/opt/quest/mcu/reports

   Note: You may need to reconfigure your browser preferences to allow you to save the report in a specific folder.

   It launches a new browser or application page and displays the report in the selected format.