User s Guide. Release 6.1. Pervasive Software Inc Riata Trace Parkway Building B Austin, TX USA

Transcription

1 Pervasive AuditMaster User s Guide Release 6.1 Pervasive Software Inc Riata Trace Parkway Building B Austin, TX USA Telephone: or Fax: info@pervasive.com Web:

2 disclaimer trademarks PERVASIVE SOFTWARE INC. LICENSES THE SOFTWARE AND DOCUMENTATION PRODUCT TO YOU OR YOUR COMPANY SOLELY ON AN AS IS BASIS AND SOLELY IN ACCORDANCE WITH THE TERMS AND CONDITIONS OF THE ACCOMPANYING LICENSE AGREEMENT. PERVASIVE SOFTWARE INC. MAKES NO OTHER WARRANTIES WHATSOEVER, EITHER EXPRESS OR IMPLIED, REGARDING THE SOFTWARE OR THE CONTENT OF THE DOCUMENTATION; PERVASIVE SOFTWARE INC. HEREBY EXPRESSLY STATES AND YOU OR YOUR COMPANY ACKNOWLEDGES THAT PERVASIVE SOFTWARE INC. DOES NOT MAKE ANY WARRANTIES, INCLUDING, FOR EXAMPLE, WITH RESPECT TO MERCHANTABILITY, TITLE, OR FITNESS FOR ANY PARTICULAR PURPOSE OR ARISING FROM COURSE OF DEALING OR USAGE OF TRADE, AMONG OTHERS. Btrieve, Client/Server in a Box, Pervasive, Pervasive Software, Pervasive AuditMaster, know who s doing what to your data when, where and how, and the Pervasive Software and the Pervasive AuditMaster logos are trademarks or registered trademarks of Pervasive Software Inc. Built on Pervasive Software, DataExchange, MicroKernel Database Engine, MicroKernel Database Architecture, Pervasive.SQL, Solution Network, Ultralight, and ZDBA are trademarks of Pervasive Software Inc. Microsoft, MS-DOS, Windows, Windows 95, Windows 98, Windows NT, Windows Millennium, Windows 2000, Windows XP, Win32, Win32s, and Visual Basic are registered trademarks of Microsoft Corporation. NetWare and Novell are registered trademarks of Novell, Inc. NetWare Loadable Module, NLM, Novell DOS, Transaction Tracking System, and TTS are trademarks of Novell, Inc. All other company and product names are the trademarks or registered trademarks of their respective companies. Copyright 2003 Pervasive Software Inc. All rights reserved. Reproduction, photocopying, or transmittal of this publication, or portions of this publication, is prohibited without the express prior written consent of the publisher. This product includes software developed by Powerdog Industries. Copyright 1994 Powerdog Industries. All rights reserved. This product includes software developed by KeyWorks Software. Copyright 2002 KeyWorks Software. All rights reserved. This product includes software developed by DUNDAS SOFTWARE. Copyright DUNDAS SOFTWARE LTD., all rights reserved. This product includes software developed by the Apache Software Foundation ( The ODBC Driver Manager for NetWare (ODBC.NLM) included in this product is based on the GNU iodbc software Copyright 1995 by Ke Jin <kejin@empress.com> and was modified by Simba Technologies Inc. in June This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. A copy of the GNU Lesser General Public License is included in your installation of Pervasive.SQL at \program files\common files\pervasive Software Shared\doc\lesser.htm. If you cannot find this license, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA USA. You may contact Pervasive Software Inc. using the contact information on the back cover of this manual. Pervasive AuditMaster User s Guide October

3 Table of Contents Preface... vii Who Should Use This Guide... vii Conventions Used in This Guide... viii For More Information... viii Chapter 1. Introduction to Pervasive AuditMaster Getting Started What Is Pervasive AuditMaster? Features of Pervasive AuditMaster Pervasive AuditMaster Components Starting AuditMaster Viewer Using the Start Menu Using the AuditMaster Tray Logging in to the Viewer Logging In Overview of the Pervasive AuditMaster Viewer Understanding the Menus and Their Options What Are Shortcut Menus? Using the Pervasive AuditMaster Tray Shortcut Menu Using the Toolbar What Is the Pervasive AuditMaster Data Tree? What Is the Server? What Is the Current View File? How to Use This Guide Section 1: Using Pervasive AuditMaster AuditMaster User s Guide iii

4 Section 2: Maintaining Pervasive AuditMaster Section 3: Appendix Chapter 2. Using Audit Records Getting Started Displaying Audit Records Customizing the Audit Record Grid Viewing Audit Records Security Policy and Audit Record User and Database Names Using AuditMaster Undo Performing Queries Performing a Simple Query Performing a Basic Query Using the Advanced Expression Builder Using the Script Tab Using the View Files Tab Running a Saved Query or Last Query Executed Working with Triggers Adding a New Trigger Associating an Alert Action with a Trigger Configuring an Alert Action Configuring a Run Program Action Editing Existing Triggers Stopping a Trigger Printing Reports Chapter 3. Using Pervasive AuditMaster Tools Getting Started Searching Audit Records Sorting Audit Records Exporting Audit Records to Other Applications Chapter 4. Maintaining Servers Getting Started iv AuditMaster User s Guide

5 Adding and Removing Servers Adding a Server Removing a Server Removing the Network Share Managing the Current View File Updating the Current View File Archiving the Current View File Working with Archived Files Changing Your Pervasive AuditMaster Password Chapter 5. Administering Pervasive AuditMaster Getting Started Reviewing System Activity Using the Status Log Working with Product Configurations Configuring Data Monitoring without Data Definitions Configuring Data Monitoring with Data Definitions Resolving Configuration Conflicts Importing Data Definitions into Pervasive AuditMaster Exporting a Data Dictionary from Pervasive.SQL Importing Data Definitions into AuditMaster Adding or Removing Users Maintaining the Server Settings Setting the Archived File Display Appendix A. Troubleshooting...A-1 Getting Started...A-1 General Tips...A-2 Handling Errors Relating to Paths...A-2 No Records Returned by Query Despite Changes to Application Data.A-3 Index... Index-1 AuditMaster User s Guide v

6 vi AuditMaster User s Guide

7 PREFACE About This Guide About This Chapter This chapter outlines the intended audience for this guide as well as conventions used within the guide. Topics include: Who Should Use This Guide Conventions Used in This Guide on page 1-viii For More Information on page 1-viii Who Should Use This Guide This guide is aimed at all Pervasive AuditMaster users. This includes regular users as well as administrators. The guide includes the following: Chapter 1: Introduction to Pervasive AuditMaster For all users. This chapter provides background information on Pervasive AuditMaster and an overview of the AuditMaster Viewer window. The guide is then divided into two sections: Section 1: Using Pervasive AuditMaster For all users. For user information, including querying, creating triggers, and printing reports, read chapters 2 4. Section 2: Maintaining Pervasive AuditMaster For administrators only. You should read this section if you are an administrator responsible for configuring the Pervasive AuditMaster installation. This section describes how to add users, review the product configuration, view the status log, and other administrative tasks. AuditMaster User s Guide vii

8 Conventions Used in This Guide The following conventions are used in this guide: If you see... It means... computer text Button or other part of a window appearing on your PC Command or information you should type in a window appearing on your PC. Italics Title of a book or other information resource, such as an online help topic Description of a value or variable that appears in a window on your PC. For example, filename refers to the name of a file on your PC. For More Information The following table outlines many additional resources for Pervasive AuditMaster and some of the other software products that work with Pervasive AuditMaster: Product Pervasive AuditMaster Information Resources Pervasive AuditMaster User s Guide Pervasive AuditMaster online help Pervasive.SQL Getting Started with Pervasive.SQL Pervasive.SQL User s Guide Pervasive.SQL SQL Language Reference Pervasive.SQL online help viii AuditMaster User s Guide

9 CHAPTER 1 Introduction to Pervasive AuditMaster About This Chapter This chapter provides an overview of Pervasive AuditMaster and its features. It steps you through starting and logging in to the Pervasive AuditMaster Viewer and navigating the viewer interface. It also provides an overview of the major tasks you can perform as a user and as an administrator. Getting Started To get started using the Pervasive AuditMaster Viewer, complete the following steps: 1. For a detailed look at Pervasive AuditMaster, its components, and how they work together, read What Is Pervasive AuditMaster? on page The viewer interface displays the Pervasive AuditMaster data. To start the viewer, see Starting AuditMaster Viewer on page For details on how to log in and a brief overview of the types of users, see Logging in to the Viewer on page To learn about the viewer interface and its features, read Overview of the Pervasive AuditMaster Viewer on page Once you are familiar with the viewer, you can use the viewer to monitor and manage your application data. For an overview of this guide and the tasks you can perform as a regular user and as an administrator, see How to Use This Guide on page AuditMaster User s Guide Introduction to Pervasive AuditMaster 1-1

10 . What Is Pervasive AuditMaster? What Is Pervasive AuditMaster? AuditMaster is a transaction intelligence and monitoring product for organizations that need to track access to and change in their mission-critical data. AuditMaster provides a detailed audit trail. For every transaction affecting your database, you can quickly identify the following things: Who accessed a record or performed a change What change has taken place When the access or change occurred Where the access or change originated How the change was made AuditMaster monitors databases, not client applications. As a result, it logs every change made to your data, even those made by third-party applications. It can also record the mere reading of records, even if no change is made. Figure 1. AuditMaster monitors the database, not its front-end applications. When AuditMaster monitors the database, it creates a comprehensive audit trail. Every time data is modified, AuditMaster logs a data record before and after the change. This before-and-after audit trail makes it possible to recover from posting or data entry errors, because you can find out who made what changes when and identify precisely what was modified. 1-2 Introduction to Pervasive AuditMaster AuditMaster User s Guide

11 What Is Pervasive AuditMaster? Features of Pervasive AuditMaster To provide a secure audit trail, AuditMaster includes the following features: A comprehensive logging system Stores the value of modified database records before and after the transaction is processed, even for transactions from third-party applications. A query builder Includes data filters for customizing queries and tracking errors. Customizable alerts Sends notifications to selected people in your organization when predefined events occur. Reports Details the who, what, when, where, and how behind every transaction in a report either displayed on-screen or for hardcopy printing. Archive manager Includes compression capability, for storage and retrieval of your historical information. Pervasive AuditMaster Components Three main components in AuditMaster work in conjunction with one another: Software Component Log event handler Data definition files Viewer Description Back-end component for monitoring and logging information about all database transactions. The AuditMaster log event handler runs on the database server at all times. Information required by AuditMaster Viewer to interpret readable data fields in monitored database records and to enable alerts set to specific fields within a record Front-end user interface for querying, presenting, and reporting database transactions logged by AuditMaster See Starting AuditMaster Viewer on page 1-4. AuditMaster User s Guide Introduction to Pervasive AuditMaster 1-3

12 Starting AuditMaster Viewer Starting AuditMaster Viewer AuditMaster Viewer is a client interface for querying, displaying, and reporting database transactions logged by the AuditMaster log event handler. AuditMaster Viewer can be started in two ways, described in the following sections: Using the Start Menu Using the AuditMaster Tray Use one of these methods to open the viewer, then the rest of this chapter will provide an overview of the main window of the user interface. Using the Start Menu To start AuditMaster from the Windows taskbar, select Start Programs Pervasive.SQL V8 AuditMaster Viewer. The AuditMaster Viewer main window appears. Before you can use AuditMaster Viewer, you must first log in. See Logging in to the Viewer on page 1-5. Using the AuditMaster Tray The AuditMaster Tray is an icon located in the services tray at the end of the Windows taskbar on your desktop. To start AuditMaster using the AuditMaster Tray, follow these steps: 1. If the tray icon is not available, activate it by selecting Start Programs Pervasive.SQL V8 AuditMaster AuditMaster Tray. 2. Right-click the AuditMaster Tray icon, and select Pervasive AuditMaster Viewer. The AuditMaster Viewer main window appears. Before you can use AuditMaster, you must first log in. See Logging in to the Viewer on page Introduction to Pervasive AuditMaster AuditMaster User s Guide

13 Logging in to the Viewer Logging in to the Viewer For security, AuditMaster Viewer requires user names and passwords. AuditMaster users are defined as either regular user or administrator, with differing privileges determining which AuditMaster menu commands are available for use. User A regular user is able to perform data monitoring tasks but does not have privileges to perform administrative tasks using the AuditMaster Viewer Admin menu. Administrator In addition to data monitoring, an AuditMaster administrator can use the Admin menu to manage system settings, define user names and passwords, configure monitored products, and view the status log. AuditMaster has a built-in user ID called admin, for which the installation sets the default password MASTER. The user name is not case-sensitive, but the password is.you will want to consider changing this default login for security reasons. Note: All AuditMaster accounts are for AuditMaster only and are not related to one's domain user login in the network environment nor to any local user login on the machine where AuditMaster and Pervasive.SQL are running. Logging In Follow these steps to log in: 1. In the list on the left-hand side of the window, right-click a server name and select Login from the shortcut menu. You may also double-click a server name. The following dialog box appears: Figure 1-1. AuditMaster Login 2. Enter a user name and password, and click OK. You now have access to the server configuration you selected. AuditMaster User s Guide Introduction to Pervasive AuditMaster 1-5

14 Overview of the Pervasive AuditMaster Viewer Toolbar Overview of the Pervasive AuditMaster Viewer The Pervasive AuditMaster Viewer is a Microsoft Windows client user interface for querying, managing, and examining access to and changes in monitored data. This section outlines the features of the typical viewer window. Main menu Figure 1-2. Viewer main window Data tree Current and archived files Audit record grid Audit data captured by AuditMaster Detail view Select an audit record in the grid to view its contents here The Pervasive AuditMaster Viewer main window is divided into the following areas: Main menu For a description of the menus and what tasks you can perform, see Understanding the Menus and Their Options on page 1-7. Toolbar The toolbar lets you perform common tasks quickly. For details on the meaning of each icon, see Using the Toolbar on page Data tree The data tree displays all audit data in tree form. For details, see What Is the Pervasive AuditMaster Data Tree? on page Audit record grid and detail view Audit records are displayed after running a query. For further details on using these views, see Chapter 2: Using Audit Records. 1-6 Introduction to Pervasive AuditMaster AuditMaster User s Guide

15 Overview of the Pervasive AuditMaster Viewer Understanding the Menus and Their Options The main menu contains the following menus and options: Figure 1-3. The main menu Menu Option Description File Query Selects for records containing specific information. A query may be based on user, date, action, and other criteria. For details, see Chapter 2: Using Audit Records. Trigger Graph Report Exit Builds an alert based on an audit record matching criteria that you define (e.g., a certain user has made a change or when a check is cashed for over $100,000). A triggered alert flags the monitored record with an icon and performs an action, either sending or starting a program. For details, see Chapter 2: Using Audit Records. Graphs the selected audit data records. The graphing feature is not available in the current release. Prints the selected audit data records. For details, see Chapter 2: Using Audit Records. Select Exit to log out and quit AuditMaster Viewer Edit Copy Copies selected text to the clipboard Select All Highlights all text Tools Search Searches for specific text within the audit record grid Sort Export Sorts the data in the grid Exports the Pervasive AuditMaster current view file or archive to a comma- or tab-delimited text file Continued >> AuditMaster User s Guide Introduction to Pervasive AuditMaster 1-7

16 Overview of the Pervasive AuditMaster Viewer Menu Option Description View Show Active Local Monitors Set Archives to Show Show AM Debug Messages Show AM Monitor Messages Displays the AuditMaster log event handlers installed on this server Sets how many archives are shown at one time in the Archives data tree node Sets whether debug messages are displayed in query results during certain integration development activities Sets whether internal messages are displayed in query results during certain integration development activities Server Add Adds a Pervasive AuditMaster server to configure to monitor data for a specific combination of database and application Remove Update Current View File Archive Current View File Archive and Compress View File Change Password Removes the server configuration so that its Pervasive AuditMaster data is no longer displayed by the viewer Refreshes the current view file to display the most up-todate information Archives the current view data in a separate file Archives and compresses the current view data in a separate file Changes the password for the user currently logged into the currently accessed server configuration 1-8 Introduction to Pervasive AuditMaster AuditMaster User s Guide

17 Overview of the Pervasive AuditMaster Viewer Menu Option Description Admin (Admin commands are grayed out unless user has administrator privileges.) Help (Adobe Acrobat Reader must be installed to use online help.) View Status Log Product Configuration User Maintenance Server Settings Contents Troubleshooting Index About Displays the status log of all Pervasive AuditMaster activity Defines the files you want the Pervasive AuditMaster server to monitor Allows you to add or remove users Maintains the key information and pathnames for the Pervasive AuditMaster server installed on the Pervasive.SQL server, as well as the AuditMaster user names and passwords Provides an online version of the user s guide Provides steps for troubleshooting common problems. For additional support, visit Displays the index of Pervasive AuditMaster help topics Displays the Pervasive AuditMaster version information AuditMaster User s Guide Introduction to Pervasive AuditMaster 1-9

18 Overview of the Pervasive AuditMaster Viewer What Are Shortcut Menus? Shortcut menus are an easy way to quickly perform common tasks. You can access a shortcut menu as follows: 1. Click an object in the viewer with your cursor. The object is selected. 2. On your mouse, click the right-most button. A shortcut menu appears with a list of commands. The commands vary depending on the context. The following shortcut menu appears when you right-click a server in the data tree. Figure 1-4. Server Configuration Shortcut Menu Shortcut menu options. This shortcut menu appears after right-clicking a server. 3. To perform a task from the shortcut menu, select an option from the menu. The window for that task appears. Using the Pervasive AuditMaster Tray Shortcut Menu In addition to using shortcut menus within the viewer, you can also use the Pervasive AuditMaster Tray shortcut menu to find information about the viewer, even when the viewer window is not open on the desktop. To access the Pervasive AuditMaster Tray shortcut menu, follow these steps: 1. In the services tray at the end of the Windows taskbar, right-click the Pervasive AuditMaster Tray. A shortcut menu displays the following list of commands: Active Local Monitors. Display all the local monitors on your current computer. Active Configurations. View the status log and product configuration information for registered or added servers. Pervasive AuditMaster Viewer. Open AuditMaster Viewer. About Pervasive AuditMaster. View release information for this version of Pervasive AuditMaster. Exit. Remove the Pervasive AuditMaster Tray icon from your taskbar. Pervasive AuditMaster Tray automatically starts with your operating system Introduction to Pervasive AuditMaster AuditMaster User s Guide

19 Overview of the Pervasive AuditMaster Viewer Using the Toolbar The toolbar lets you access common commands by clicking an icon. All of these commands appear in the AuditMaster Viewer menus. Figure 1-5. The Toolbar Icon Meaning Click to... New Query Build a new query for the current view file Trigger Manages triggers and actions Graph Report Graph the current or archived view file. Not available in the current release. Print the range of records you have defined Search Search your current view file for specific text or dates Sort Sort your audit record grid by columns Export Export the current view file to a text-based file User Maintenance Update Current View File Add, change, or remove a user name and password. Available to administrators only. Make the most recent Pervasive AuditMaster data available to query and display in the audit record grid AuditMaster User s Guide Introduction to Pervasive AuditMaster 1-11

20 Overview of the Pervasive AuditMaster Viewer What Is the Pervasive AuditMaster Data Tree? The Pervasive AuditMaster data tree presents the data collected by Pervasive AuditMaster in tree form. The tree consists of multiple branches that include the server on which the AuditMaster Log Event Handler has been installed, as well as the current view file and any archived files or saved queries. Server Database files are monitored for this location Click plus and minus signs to expand or contract details for a database server Click to view the list of archived files. Double-click an archive to view it. What Is the Server? Figure 1-6. Example Data Tree A server is the location in which the Pervasive AuditMaster Log Event Handler and configuration files are installed and running. The event handler records Pervasive AuditMaster data and logs it to a file which can then be displayed in the viewer. In the above example, the viewer is configured to access AuditMaster data created by the event handler on the local server in Budapest and the event handlers on the remote servers in Hong Kong, New York, and Toronto. The server is always the topmost branch in the data tree. What Is the Current View File? To have the active monitors listed, select the option in the View menu. Active monitors indicate the event handlers tracking this database. A green icon indicates the event handler is running. A red icon indicates the event handler is stopped. Current View File Click to query for the current audit records collected by the event handler Saved Queries. AuditMaster can save any queries performed on this set of files for future reuse. All Pervasive AuditMaster data recorded by the event handler is displayed in a current view file. To manage the size of the file, you can move the information to archives. Each server has branches for both current view and archived files. Note: For details on servers, managing the current view file, and creating archives, see Chapter 4: Maintaining Servers Introduction to Pervasive AuditMaster AuditMaster User s Guide

21 How to Use This Guide How to Use This Guide Once Pervasive AuditMaster has been set up and configured, you can log in and begin to track and record data activity. To help you find specific tasks, the rest of this guide is divided into three sections: Section 1: Using Pervasive AuditMaster This section is aimed at all users and describes tasks that any user can perform to manage, modify, and output Pervasive AuditMaster data. The following chapters are found in this section: Chapter 2: Using Audit Records Read this chapter to learn how to perform queries, build triggers, and print reports from audit record data. These tasks are performed using the File menu. Chapter 3: Using Pervasive AuditMaster Tools Proceed to this chapter to sort, search, or export the Pervasive AuditMaster data using the Tools menu. Chapter 4: Maintaining Servers Read this chapter to add or remove servers, or update or archive current view files using the Servers menu. Section 2: Maintaining Pervasive AuditMaster This section covers tasks performed using commands in the Admin menu. Only Pervasive AuditMaster administrators have access to this menu. The following chapter is found in this section: Chapter 5: Administering Pervasive AuditMaster This chapter describes how to configure monitoring of database products, add or remove users, maintain the server settings, or review the status log. Section 3: Appendix The following appendix is found in this section: Appendix A: Troubleshooting This appendix may have answers to common questions that you may encounter. AuditMaster User s Guide Introduction to Pervasive AuditMaster 1-13

22 How to Use This Guide 1-14 Introduction to Pervasive AuditMaster AuditMaster User s Guide

23 CHAPTER 2 Using Audit Records About This Chapter This chapter describes the tasks you can perform from the File menu to manage your AuditMaster audit records. This includes filtering audit record data, creating triggers, and printing reports. Getting Started To make good use of this chapter, we suggest the following steps: 1. Be sure you are familiar with the AuditMaster Viewer interface. For details, review Chapter 1: Introduction to Pervasive AuditMaster. 2. For the steps to view the current file or archive data, see Displaying Audit Records on page To filter the AuditMaster records by criteria such as a user, network address, program, or date, see Performing Queries on page To create alerts for specific events, see Working with Triggers on page To print a report, see Printing Reports on page AuditMaster User s Guide Using Audit Records 2-1

24 Displaying Audit Records Displaying Audit Records AuditMaster can track records that have been inserted, deleted, modified, or merely read in the monitored data. Once audit records are captured, an automatic mapping process applies business rules to transfer them to the current view file. You can manually run this process by selecting Server Update Current View File. New queries will then display the most recent audit records. To display audit records in the viewer, follow these steps: 1. Select Current View File or Archived Files in the viewer data tree. Current View File. The current view file contains audit records for the files you are monitoring under this server and product configuration. Archived Files. Archived files are saved versions of current view files. Archives can be compressed and are stored in encrypted format so that unauthorized users have no access outside of the AuditMaster system. 2. From the main menu, select File Query. The Query Builder window appears. Figure 2-1. Query Builder 2-2 Using Audit Records AuditMaster User s Guide

25 Displaying Audit Records 3. For this example, we will show all records in the current view file. Without selecting any options in the Query tabs, click Execute. For details on filtering records to view specific information, see Performing Queries on page 2-8. The viewer retrieves the requested current view file and displays it in the audit record grid. Visible column settings Figure 2-1. Audit Record Grid Current view file path name Trigger A trigger icon flags a record that matches trigger criteria. See Working with Triggers on page To change the record display, see Customizing the Audit Record Grid in the next section. 5. To view an individual record in detail, see Viewing Audit Records on page 2-4. AuditMaster User s Guide Using Audit Records 2-3

26 Displaying Audit Records Customizing the Audit Record Grid Audit records compiled by the AuditMaster log event handler are displayed in the audit record grid. Each column represents the information that AuditMaster tracked about the record and includes such items as the date, time, table name, operation, component, group name, and user name. To customize how the records are displayed in the audit record grid, see the following table: To Do... Set visible columns in the audit records grid Change column order in the audit record grid Search, sort, or export audit record data Do This... Click the Visible Columns drop-down arrow and select or clear the box beside each option to hide or show particular columns. Drag and drop each column to the position you prefer. See Chapter 3: Using Pervasive AuditMaster Tools. Viewing Audit Records To examine the fields of an audit record, click the record. The fields appear in the detail view in the lower part of the viewer window. Figure 2-2. Detail View Values Before changes Values After changes Along with each field name and field value, the detail view also uses Before and After columns to show any changes that have been made. The Before column shows the value before the change was made. The After column shows the value after the change. Changes are highlighted in red. 2-4 Using Audit Records AuditMaster User s Guide

27 Displaying Audit Records Security Policy and Audit Record User and Database Names If you run AuditMaster under the Pervasive.SQL V8 Security release, audit record values in the User Name and Database Name columns vary with the DefaultDB database security setting and the type of database operation. AuditMaster can provide the OS login or database login name for Btrieve operations on audited files. For SQL Engine operations, only the OS login user name is displayed, while the database name is not available (n/a). Btrieve Operations SQL Engine Operations Security Policy User Name Database Name User Name Database Name Database Database login One of the following: OS login n/a Mixed Database login Database name from Btrieve Login API or connection string OS login n/a Classic OS login Database name bound to Btrieve file on which operation executed, if any "DefaultDB" if other two unavailable OS login n/a Audited Btrieve operations include Select/Read, Insert, Update, Delete, Login, and Logout. For Begin Transaction, End Transaction, Abort Transaction, and Reset operations, which are not associated with a specific database, the database name is not available. Login errors are listed with the invalid user name and/or database name. Under Mixed security policy, database logins must match OS or network logins. Note: For more information on database operations in a Pervasive Security environment, see What s New in Pervasive.SQL V8.5 and all other documentation related to installing, configuring, and using the security features in that release AuditMaster User s Guide Using Audit Records 2-5

28 Using AuditMaster Undo Using AuditMaster Undo The Before and After columns in the detail view identify changes to application data fields, which the AuditMaster undo command can attempt to restore to the Before state. Results depend on the operation to be undone and the current state of the record, which may have changed again since the operation occurred. Operation Insert Delete Update Results of Undo Deletes the record, if it still exists Reinserts the record so long as it does not exist, or if it does, so long as duplicates are allowed Restores the Before state of the record, if the record still exists Warning: Before you attempt an undo in AuditMaster, consider the following: The Windows user name under which you log in and open AuditMaster Viewer must have write permission for the Pervasive.SQL database being monitored. Neither Windows nor the Pervasive.SQL server recognize administrator and regular user accounts created within AuditMaster. The data being monitored must not have been removed from its AuditMaster product configuration since the operation occurred. Undoing database application operations from within AuditMaster carries a risk of putting application data into an inconsistent or illogical state. You should be an advanced Pervasive.SQL user who understands the cautions regarding changing one part of an application database independently of another part. The undo capability is not available from an AuditMaster Viewer remote client. To undo an operation from AuditMaster Viewer, use these steps: 1. In the audit record grid, select one or more records, and right-click. The shortcut menu appears. 2-6 Using Audit Records AuditMaster User s Guide

29 Using AuditMaster Undo 2. Select Undo Operation(s). The system prompts you to confirm the undo attempt. 3. Select Yes, or select Cancel if you change your mind. If you selected multiple records to undo, you may select Yes to All to attempt to undo all of them without further interaction, or use the Skip and Yes buttons to work through them one at a time. Note: Undo operations are captured in the audit record and can be reversed by an additional undo. AuditMaster User s Guide Using Audit Records 2-7

30 Performing Queries Performing Queries Before you can display any current view file or archive in the audit record grid, you must first perform a query using the AuditMaster Query Builder. The query builder is a powerful tool you can use to search for and retrieve specific types of data from the AuditMaster current view or archive file. Queries are useful for sifting through large numbers of audit records, so you can narrow your analysis to only pertinent records. For example, you can search for records processed on a particular date, records from a single table or a select group of tables, or records that were changed by a particular user. The query builder guides you through the process of creating a query. To perform a simple query to display all the contents of a record, proceed to Performing a Simple Query on page 2-9. Once you know how to perform a simple query, proceed to the following sections to learn how to narrow your query: Performing a Basic Query on page 2-11 Using the Advanced Expression Builder on page 2-13 Using the Script Tab on page 2-15 The query builder also has the ability to save queries so that complicated ones can be reused without having to recreate them. For details on running a saved query or the last query executed, see Running a Saved Query or Last Query Executed on page Using Audit Records AuditMaster User s Guide

31 Performing Queries Performing a Simple Query The simplest query in the Query Builder window is to search for all users, operations, processes, and times as follows: 1. Select a current view file or archive. 2. Select File Query, or right-click and select Query. The Query Builder window appears. Figure 2-3. Query Builder Query Tabs Each tab filters for a specific criteria Execute Performs the query Save Saves the criteria with the database files for later reuse Cancel Exits the Query Builder Output Type Outputs the query result to the screen 3. Be sure the Output Type is set to Screen. This option displays the results in the audit record grid of the viewer window. 4. By default, all options in each tab are selected. To display all AuditMaster data for this file, simply select Execute. Audit records are displayed in the grid in the upper right-hand pane of the viewer. AuditMaster User s Guide Using Audit Records 2-9

32 Performing Queries You can further filter a file or archive by performing the following types of queries: Basic Query A basic query narrows a simple query by using the tabs Who, Did What, From Where, When, and How to filter the records in the current view file or a selected archive. These tabs allow you to find data input by specific users, specific operations or tables used, changes performed from specific network addresses, changes performed on specific dates and times, and specific processes or programs used. See Performing a Basic Query on page Advanced Query An advanced query uses the Advanced tab to create more complex queries than those one can build with the basic tabs. See Using the Advanced Expression Builder on page If you want to reuse a query, you can run a saved query or the last query executed. See Running a Saved Query or Last Query Executed on page Using Audit Records AuditMaster User s Guide

33 Performing Queries Performing a Basic Query A basic query uses one or more of the who, did what, from where, when, and how tabs to narrow a simple query. Follow these steps to create and run a basic query: 1. Select a combination of tabs to narrow the query. To find... Click this tab Perform these steps... Users All records that contain a specific user or users Operations, Groups, and Tables Specific operations, such as an insert or a delete, in a specific type of table, in a specific group Network Addresses Any information originating from a specific network address. Who To find a specific user or users, clear the All Users option. The list of database users is now available. Select a user or multiple users by checking the box beside their name. If necessary, you can add a user by clicking Add and typing in the specific user. Did What To find a specific type of operation, clear the All Operations option. You can also clear All Groups or All Tables option, as necessary. The list is now available. Select the operations and any objects affected by them by checking the box beside the option. Expand lists as necessary to select the appropriate options. From Where To find a specific network address, clear the All Network Addresses option. The list of network addresses is now available. Select one or more network addresses by checking the box beside the address. If necessary, you can add an address by clicking Add and typing in the specific network address. Continued... AuditMaster User s Guide Using Audit Records 2-11

34 Performing Queries To find... Click this tab Perform these steps... Specific Dates Any activity on a specific date or within a time range Processes or Programs The program or process identified by AuditMaster in the Process Name column of the audit record grid When To find a specific start and end date, clear the All Date Range option. The Start Date and End Date calendars are now available. Select a day, month, and year from the calendars. Use the arrows to click back and forth through the months. To find a specific time range, clear the Time Range option. Select a time from the Start Time and End Time fields. How To find a specific program or process, clear the All Processes option. The processes are now available. Select a program or process by clicking the box beside the option. If the process name identified by AuditMaster does not already appear, you can use the Add field at the bottom of the pane to enter it in the list. 2. Select an Output Type. Choose how to display the query result in the audit record grid. Only the screen option is available in the current release. 3. If you plan to reuse this query later, click Save. In the save dialog box, provide a descriptive name for the query and click OK. For details on using a saved query, see Running a Saved Query or Last Query Executed on page To perform this query, click Execute. The Query Builder performs the query and displays the results according to the selected output type Using Audit Records AuditMaster User s Guide

35 Performing Queries Using the Advanced Expression Builder The Advanced tab is used to build complex queries that cannot be built using the basic tabs. The Advanced tab uses expressions that find out specific information about a certain event and can be used to search for specific field values of monitored tables whose definitions have been imported into AuditMaster. The following steps walk you through the example for creating a query to search for all inserts into the database on the current day in which the query is executed. 1. Open the Query Builder window, and click the Advanced tab. The pane moves to the front. Figure 2-4. Advanced Query Builder Tab AuditMaster User s Guide Using Audit Records 2-13

36 Performing Queries 2. To customize your query, select the Use Advanced Expression Builder checkbox. The expression area becomes active. 3. In the Type column, double-click the <Select Type> placeholder to activate the dropdown list, and choose Date. A standard calendar dialog box appears, with the current date selected by default Using Audit Records AuditMaster User s Guide

37 Performing Queries 4. Click OK to accept the default date. The date appears in the Value column. 5. In the Operation column, select a logical operator, in this case, the equal sign =. The equal sign appears as the operator in the expression, which now should resemble the following: 6. After building your expression, decide whether to set it for Trigger Only. This option will select for records satisfying the defined conditions but display only those that have been triggered. For details on triggers, see Working with Triggers on page Select an Output Type. Leave the default selection Screen to view the results of this query in the audit record grid. 8. If you plan to reuse this query later, click Save. The query is saved with the name and location you provide. 9. To run this query, click Execute. The Query Builder executes the query and displays the results in the format you selected. Using the Script Tab The Script tab is a query string viewing window for users with strong expertise in query languages and a good understanding of AuditMaster data and its format. The tab displays the textual string constructed from graphical selections made in the other Query Builder tabs. Examining the text version of a query may be helpful when troubleshooting unexpected query results. The Script tab is for viewing only do not enter additional text or otherwise change the script string. The Script tab is available only to AuditMaster administrator logins. Note: The Script tab is unable to display certain long and complex query text strings in their entirety. AuditMaster User s Guide Using Audit Records 2-15

38 Performing Queries Using the View Files Tab The View Files tab allows you to select whether the current view file and any archived files are included in the query. By default, the current view file is selected, while any uncompressed archived files are not selected. Compressed archived files are not available for use in a query. To make them available, decompress them before opening the Query Builder. For more information, see Archiving the Current View File on page 4-15 and Working with Archived Files on page To select which audit records to include in the query, use the following steps. 1. From the Query Builder window, click the View Files tab. The View Files pane moves to the front. Figure 2-5. View Files Tab 2. Click checkboxes to make or clear file selections for the query, then continue with query settings in other tabs as needed Using Audit Records AuditMaster User s Guide

39 Performing Queries Running a Saved Query or Last Query Executed AuditMaster allows queries to be saved for reuse and also automatically saves the last query executed. This lets you keep specialized queries that you will continually run. These files are saved under the data tree branches, Saved Queries, and Previous Queries, respectively. To run either of these queries, complete the following steps. 1. From the data tree, select a query from the Saved Queries branch or Last Query Executed branch, as appropriate. 2. The Query Builder performs the query and displays the results in the format you defined. AuditMaster User s Guide Using Audit Records 2-17

40 Working with Triggers Working with Triggers The AuditMaster Trigger Builder enables you to create an alert to specific activity in a Pervasive.SQL database. Once a trigger is set, AuditMaster tests each newly monitored record for one or more of the conditions you defined for the trigger. When any condition is met, AuditMaster executes an alert action, which also is defined in the trigger. For example, you can create a trigger to alert you by whenever a record is deleted from the database. In the audit record grid, activated triggers are flagged with an icon, indicating that the selected alert action, either sending or starting a program, has been executed. Caution: Be forewarned that dramatic and undesirable consequences may arise from setting a trigger with a broad query likely to match conditions for a large number of audit records, especially when the alert action involves . Adding a trigger consists of two parts: 1. Enter a trigger name and description and use the Query Builder tabs to define its conditions. See Adding a New Trigger on page Define the alert action to take when a trigger condition is met. See Associating an Alert Action with a Trigger on page Once you have added triggers to your AuditMaster system, you can also do the following: Editing Existing Triggers on page 2-30 Stopping a Trigger on page 2-30 Note: Any time you create or change a trigger, it is necessary to exit from AuditMaster and restart the Pervasive.SQL services before the new trigger begins to operate successfully Using Audit Records AuditMaster User s Guide

41 . Working with Triggers Adding a New Trigger Follow these steps to create a trigger: 1. In AuditMaster Viewer, run a query to display the type of audit records for which you would like to create a trigger. 2. Select File Trigger. The Trigger Builder window appears. Figure 2-6. Trigger Builder 3. Click New. The New Trigger window appears. 4. Enter a name for this trigger. In this example, we create a trigger for new students in the Pervasive.SQL demonstration database. You may use any characters except `~!@#$%^&*()_+-={} \][:'"<>?/, a comma, or a period. You may use spaces. AuditMaster User s Guide Using Audit Records 2-19

42 Working with Triggers 5. Enter a description for this trigger. We recommend you describe the event the trigger is watching for. 6. Click Continue. The Query Builder window appears. 7. Define the criteria for this trigger using the tabs in the Query Builder. For details on using these tabs, see Performing Queries on page Using Audit Records AuditMaster User s Guide

43 Working with Triggers 8. When you are finished, click OK. The Action for Trigger window appears. 9. At this point, you may select and configure an alert action to associate with this trigger, but for now simply click OK and continue with the tutorial steps. The Trigger Builder shows the trigger that was just added. 10. You can now choose from one of the following tasks: Configuring actions. Associating an Alert Action with a Trigger on page Editing the name and description of a trigger. Editing Existing Triggers on page Removing triggers. Stopping a Trigger on page AuditMaster User s Guide Using Audit Records 2-21

44 Working with Triggers Associating an Alert Action with a Trigger Once you have added a trigger, you need to associate an alert action to be performed each time the AuditMaster event handler finds a match for the trigger condition or conditions. To associate an action with a trigger: 1. Select File Trigger if the Trigger Builder window is not open, and select a trigger to configure. 2. Click Edit. The Action for Trigger window appears Using Audit Records AuditMaster User s Guide

45 Working with Triggers 3. Select at least one of the built-in triggers, and click the Select button: Alert The Alert action sends an to a specified group of addresses when a trigger condition is met. To configure the alert action, proceed to Configuring an Alert Action on page Run Program The Run Program action runs a specified program when a trigger condition is met. To configure the program, proceed to Configuring a Run Program Action on page Click OK. Selected actions are now associated with the trigger, to be activated if the trigger condition is met. Note: Any time you create or change a trigger, it is necessary to exit from AuditMaster and restart the Pervasive.SQL services before the new trigger begins to operate successfully. Configuring an Alert Action To configure the groups and addresses for an alert, use these steps: 1. If the Trigger Builder is not open, select File Trigger, select the trigger to configure, click the Action button, click Alert, and click the Select button. The Alert action moves to the Selected Actions column. Figure 2-7. RunProgram Action for Trigger 2. With the Alert item still selected, click the Configure button. The Configure <group name> on Alert window appears. AuditMaster User s Guide Using Audit Records 2-23

46 Working with Triggers Figure 2-8. Configure Group on Alert 3. If an group to which you want to send alerts exists in the list, simply select it, click the right arrow (>) to move it to Selected Groups. You may also double-click the group name. When the trigger condition is met, addresses in this group will receive To set the SMTP server used to send out-going mail, click Set Global SMTP Server. 5. Add the server name for the SMTP server, and click OK. For example, if your out-going mail server is named smtp-server.companyname.com, then enter smtp-server in this field Using Audit Records AuditMaster User s Guide

47 Working with Triggers 6. To set the global domain used by your company, click Set Global Domain. 7. Add the domain name, such as pervasive.com, and click OK. Continuing with the example from the last step, here you would enter companyname.com. 8. To configure a group, click Configure Groups. The Configure Groups window appears. For this demonstration, sample values have been filled in. Figure 2-9. Configure Groups AuditMaster User s Guide Using Audit Records 2-25

48 Working with Triggers 9. In this window you can manage groups and addresses, as described in the following table. When you are finished, click OK to return to the Configure <group name> on Alert window. Task Steps Add New Group Click Add New Group. Enter a name for the new group. Click OK. Edit Group Name Select a group name. Click Edit Group Name. Enter a new name for this group. Click OK. Delete Group Select a group name. Click Delete Group. Click Yes to confirm. Add New Address With a group selected, click Add New Address... Enter the address. Click OK. Edit With a group selected, select an address from the list of addresses for that group. Click Edit . Enter a new address. Click OK. Remove Address With a group selected, select an address. Click Remove Address. Click Yes to confirm. Once an group is added for a trigger, it becomes available for all triggers. Also, deleting a trigger does not delete an group associated with its action. groups associated with an Alert action remain in the system for reuse. Note: Any time you create or change a trigger, it is necessary to exit from AuditMaster and restart the Pervasive.SQL services before the new trigger begins to operate successfully Using Audit Records AuditMaster User s Guide

49 Working with Triggers The following sample alert was triggered by an insert in the demodata database. If AuditMaster monitors a database without data definitions, the application record data in the alert does not display the hexadecimal content. If data definitions have been imported, then name fields appear, along with certain internally used Pervasive.SQL name indices and not-null indicators not displayed in AuditMaster Viewer. Figure Structure of an Alert Alert Header Information Audit Record Application Record Data Internal Data Not Displayed in the Audit Record Grid Additional Information AuditMaster User s Guide Using Audit Records 2-27

50 Working with Triggers Configuring a Run Program Action To configure a program to run as a trigger action, follow these steps: 1. If the Trigger Builder is not open, select File Trigger, select the trigger to configure, click the Action button, click RunProgram, and click the Select button. The RunProgram action moves to the Selected Actions column. 2. With the RunProgram item still selected, click the Configure button. The Configure Programs window appears Using Audit Records AuditMaster User s Guide

51 Working with Triggers 3. In the Configure Programs window you can select programs to run as alerts as described in the following table. To... Steps Select a program to run Click one of the available programs, and click the Select button. The program is moved to the Selected Programs list. When the condition for this trigger is met, this program will be executed. Add a new program to the list of Available Programs Remove a program from the list of Available Programs Set parameters for a program in the Selected Programs list Note: Use this option only if you are very familiar with program parameters. 4. When you are finished selecting and configuring a program to run as an alert, click OK to return to the Action for Trigger window. 5. Click Close to exit from Trigger Builder. Click the Add button. The Select an Executable File window appears, pointing to the C: directory. Select a program, or browse and find another. When you have selected the program, click OK. Select the program name. Click Remove. Click Yes to confirm. Select the program name. Click Set Parameters. Click the buttons to Add, Remove, or Change parameters for the program to be run. Enter any new or changed parameter in the field provided, and click OK. Note: Any time you create or change a trigger, it is necessary to exit from AuditMaster and restart the Pervasive.SQL services before the new trigger begins to operate successfully. AuditMaster User s Guide Using Audit Records 2-29

52 Working with Triggers Editing Existing Triggers You can edit the name and description of a trigger. However, you cannot change the query for the trigger. To monitor for a different query, delete the old trigger and enter a new one. To change the name and description of an existing trigger, follow these steps: 1. In the Trigger Builder, select a trigger from the list, and click the Edit button. The Edit Trigger window appears. 2. Edit the name and description for this trigger, and click OK. Stopping a Trigger To stop a trigger from running, you can disable its action or delete the trigger entirely. Note: Deleting a trigger does not delete any group associated with its action. groups associated with an Alert action persist in the system for reuse Using Audit Records AuditMaster User s Guide

53 Working with Triggers To disable a trigger action: 1. Select a trigger from the Trigger Builder list, and click the Edit button. The Edit Trigger window appears. 2. Clear the Enabled checkbox, and click OK. The trigger action is disabled. You can enable it again later. To delete a trigger: 1. Select a trigger from the Trigger Builder list. Click the trigger to select it. 2. Click the Delete button. A window prompts you to confirm the deletion. 3. Click Yes to confirm. The trigger is deleted and can no longer run. Note: Any time you create or change a trigger, it is necessary to exit from AuditMaster and restart the Pervasive.SQL services before the new trigger begins to operate successfully. AuditMaster User s Guide Using Audit Records 2-31

54 Printing Reports Printing Reports AuditMaster lets you define the data you want to include in a printed report. 1. Run a query and then select a range of columns and rows displayed in the audit record grid. 2. Select File Report. The Report Builder window appears. Figure Report Builder 3. If you want to load and customize a saved report, click the Open Report File button and select the settings file for an existing report. The report is loaded. 4. In the Report Title field, enter a name for this report. This name will appear at the top of your printout. 5. From the Available Columns list, select the columns to include in this report. If you selected a range of columns and rows, these are preselected in the Selected Columns list. The Available Columns list contains all columns from the audit record grid. You may double-click other column names to move them to the Selected Columns list. To move all columns to the Selected Columns list, click Select All Using Audit Records AuditMaster User s Guide

55 Printing Reports 6. Select the Rows to Print. All Rows. Click to select all rows of the columns you selected. A Range of Rows. Click to define a range of rows and change the row numbers shown, which by default indicate the rows you highlighted in the audit record grid before you opened Report Builder. 7. In the Report Format section, define what the report will look like. Table Border. If you want the tables to have borders, select the border type from the dropdown list. Print Page Numbers. Check the box beside the option to include the page number. Click whether you want the page number to appear in the Left Footer or Left Header of the printout. Also check whether you want the Date and Time included on this report. Print Report Title. Select whether you want the report title to appear On Every Page or On the First Page Only. Print Date and Time. Select if you want the date and time to appear in the footer of each printed report page. 8. When you are finished, click Print Preview. The Report Print Preview window displays the report on-screen as it will be printed. 9. From the File menu in the Report Print Preview window, you may do the following: Select Save Report As to save the current report settings for future reuse. Select Open Report to use the settings in a previously saved report. Select Page Setup to adjust standard page settings. Select Print Setup to adjust standard printer settings. Select Print to print the report. Select Exit to return to Report Builder Using Audit Records AuditMaster User s Guide

56 Printing Reports 2-34 Using Audit Records AuditMaster User s Guide

57 CHAPTER 3 Using Pervasive AuditMaster Tools About This Chapter This chapter describes the tasks you can perform from the Tools menu to search, sort, and export your AuditMaster data. Getting Started To make good use of this chapter, we suggest the following steps: 1. To search your AuditMaster data for specific text or values, see Searching Audit Records on page To sort columns of data, see Sorting Audit Records on page To export a current view file or archive to a text file, see Exporting Audit Records to Other Applications on page 3-5. AuditMaster User s Guide Using Pervasive AuditMaster Tools 3-1

58 Searching Audit Records Searching Audit Records You can use the search command to find particular users, operation types, or values for the current audit records grid view. AuditMaster uses a sophisticated search engine, so it is easy to use different search options and directions. Searches can also be made case-sensitive. Note: Depending on the number of records and the complexity of the search criteria, it may take some time to complete your search. Whenever possible, try to narrow your criteria. To search audit records: 1. Display a current view or archived file from the data tree. Run a query, if needed. 2. Select Tools Search. The Search window appears. Also, if you have clicked in the audit record grid, the field you clicked is highlighted in blue as the current column and its row is highlighted in yellow. Figure 3-1.Search Window 3. In the Search field, enter a text string to find. Your search entries are saved in the drop-down list for the current session. 4. If necessary, use the Search Options to narrow your search. In the Direction drop-down list, select a direction to start the search. These include, From Top row down, the Next row down, and the Previous row down. In the Position drop-down list, select a search position. Select Anywhere or Beginning of cell, as appropriate. To match upper and lower case spellings, select the Match Case checkbox. To match the entire search string instead of just part of a cell, select the Match Entire String checkbox. 3-2 Using Pervasive AuditMaster Tools AuditMaster User s Guide

59 Searching Audit Records 5. If necessary, use the Grid Area to narrow your search. Select Entire Grid to search all columns. Select Current Column to search only the column selected, which is indicated as a blue field in the yellow highlighted field that you have clicked. If this column is not the one you want to set as the current column to search, close the Search window, click the desired column, and search again. Select Specific Column and select a column name from the drop-down list. 6. When you are ready, click Find Next. The results are displayed in the audit record grid in the viewer. AuditMaster User s Guide Using Pervasive AuditMaster Tools 3-3

60 Sorting Audit Records Sorting Audit Records Audit records can be sorted on up to three visible data fields in either ascending or descending order. Reset Visible Columns in the AuditMaster toolbar if needed. Use these steps to sort audit records: 1. Select and display a current view file or archived file from the data tree. Run a query, if needed. 2. In the audit record grid, select a range of columns and data fields. 3. Select Tools Sort. The Sort window appears. Figure 3-2. Sort Window 4. In the Sort By area, select a column name from the drop-down list. The column information will be used to sort the information. For example, select Time to organize the columns by the time the event occurred. 5. Select Ascending or Descending order for sorting. For example, if you are sorting by time, to list times starting with most recent, select Descending. 6. To sort again using a second and third column name, select from each Then By dropdown list, including Ascending or Descending, and click OK. The audit record view grid displays the sorted records. 3-4 Using Pervasive AuditMaster Tools AuditMaster User s Guide

61 Exporting Audit Records to Other Applications Exporting Audit Records to Other Applications AuditMaster allows you to export the audit records of any data view to a comma- or tab-delimited text file. You can then import these files into other applications. Follow these steps to export audit data: 1. From the viewer data tree, select a current view file or archived file. 2. Select Tools Export. The Export window appears. Figure 3-3. Export Window 3. Select tab- or comma-delimited separators for fields in the exported audit data. 4. To include column names in the text file, leave the default selected, otherwise select None. 5. Click OK to export the file to filename.txt. The export file is saved to the location and name you provided. Note: You can also extract audit data directly by copying from the AuditMaster audit record grid and pasting the rows and columns into another application, such as Excel. AuditMaster User s Guide Using Pervasive AuditMaster Tools 3-5

62 Exporting Audit Records to Other Applications 3-6 Using Pervasive AuditMaster Tools AuditMaster User s Guide

63 CHAPTER 4 Maintaining Servers About This Chapter This chapter describes the tasks you can perform from the Server menu to add or remove specific servers, update or archive files, or change your password. Getting Started To make good use of this chapter, we suggest the following steps: 1. Servers listed in the data tree display AuditMaster data captured by the event handler on that server. To add or remove servers from the viewer display, see Adding and Removing Servers on page If you do not wish to use the shared folder installed by AuditMaster in your network environment because of security considerations or other policies, see Removing the Network Share on page To update or archive the current view file, see Managing the Current View File on page To change the password you use to login, see Changing Your Pervasive AuditMaster Password on page To change server keys, such as where archived files are located, or to define the number of archives that can be displayed by in the data tree, you must be an administrator. For details, see Chapter 5: Administering Pervasive AuditMaster. AuditMaster User s Guide Maintaining Servers 4-1

64 Adding and Removing Servers Adding and Removing Servers In AuditMaster terms, a server is a Pervasive.SQL server on which an AuditMaster log event handler is installed and running. The file amserver contains the server configuration settings used by AuditMaster. This file is typically located on the server in the data folder of the AuditMaster installation directory (e.g., default c:\pvsw\audit\data). This section provides instructions for the following topics: Adding a Server Removing a Server on page 4-4 Adding a Server When you add a server, you are enabling your local AuditMaster Viewer to use the file amserver for an AuditMaster server either on the local machine or elsewhere on your network. You can add any AuditMaster server to which you have network access. To add a server: 1. Check the server machine you wish to add to make sure that Pervasive.SQL services are running. You may use Pervasive Control Center for this verification. 2. From AuditMaster Viewer, select Server Add. The Locate amserver on Your AuditMaster Server dialog box appears. 3. Enter the path to the file \\server\pvswaudit$\data\amserver where server is the name of the Pervasive.SQL server with the database to be monitored, and click Open. 4-2 Maintaining Servers AuditMaster User s Guide

65 Adding and Removing Servers The server you selected is added to the list. 4. Right-click a server configuration and select Login. You may also double-click the configuration. The AuditMaster Login dialog box appears. 5. Enter a valid user name and password, and click OK. The AuditMaster Viewer menus become active. Note: AuditMaster has a built-in user ID called admin, for which the installation sets the default password MASTER. The user name is not case-sensitive, but the password is. You will want to consider changing this default login for security reasons. All AuditMaster accounts are for AuditMaster only and are not related to one's domain user login in the network environment nor to any local user login on the machine where AuditMaster and Pervasive.SQL are running. AuditMaster User s Guide Maintaining Servers 4-3

66 Adding and Removing Servers The new server is now ready for monitoring. Removing a Server When you remove a server from the viewer, you remove the ability of your viewer to monitor data on that server. You can add the server again at any time. To remove a server: 1. Select a server from the AuditMaster data tree. The server is one of the top branches in the tree. 2. From the Server menu, select Remove. A dialog box prompts you to confirm removing the server you selected. 3. Select Yes to remove the server. The server is removed from the data tree. 4-4 Maintaining Servers AuditMaster User s Guide

67 Removing the Network Share Removing the Network Share Although AuditMaster installs a hidden network share by default, it is not necessary that it be hidden, nor is a network share even required for successful operation. If you do not wish to use a shared folder in your network environment because of security considerations or other policies, you can replace it with an explicit local path name. After installing AuditMaster in the standard way, you may replace the default network share with a local path name using these steps: 1. Open AuditMaster Viewer in one of the following ways: Select Start Programs Pervasive.SQL V8 AuditMaster Viewer. Select Start Programs Pervasive.SQL V8 AuditMaster AuditMaster Tray, then right-click the service tray icon and select Pervasive AuditMaster Viewer. The Pervasive AuditMaster window appears, listing servers available for monitoring. 2. Right-click a server configuration and select Login. You may also double-click the configuration to log in. The AuditMaster Login dialog box appears. AuditMaster User s Guide Maintaining Servers 4-5

68 Removing the Network Share 3. Enter an AuditMaster administrative login name and password, and click OK. The AuditMaster Viewer menus become active. Note: AuditMaster has a built-in user ID called admin, for which the installation sets the default password MASTER. The user name is not case-sensitive, but the password is. You will want to consider changing this default login for security reasons. All AuditMaster accounts are for AuditMaster only and are not related to one's domain user login in the network environment nor to any local user login on the machine where AuditMaster and Pervasive.SQL are running. 4. Select Admin Server Settings. The Server Settings dialog box appears. On the left, the AMMON path settings are at the top of the list and are already highlighted. 5. For each of the settings in the Value column on the right, double-click the path name and change \\server\pvswaudit$ to drive:\pervasive.sql root directory\audit 4-6 Maintaining Servers AuditMaster User s Guide

69 Removing the Network Share where server is the name of the machine on which Pervasive.SQL server and the AuditMaster log event handler are installed and drive and Pervasive.SQL root directory are, respectively, the local drive letter and path name to the AuditMaster installation directory. In this example, the result would resemble the following: 6. In the list of sections on the left, select Common Settings. The dialog box displays the values on the right. AuditMaster User s Guide Maintaining Servers 4-7

70 Removing the Network Share 7. Double-click the value for the AuditMaster status log file and change it to drive:\pervasive.sql root directory\audit\amstatus.log. The result might resemble the following: 8. In the list of sections on the left, select TNBTMON Paths. The dialog box displays the values on the right. 4-8 Maintaining Servers AuditMaster User s Guide

71 Removing the Network Share 9. Double-click the value for each path name and change \\server\pvswaudit$ to drive:\pervasive.sql root directory\audit. The result might resemble the following: 10. After you have finished changing the values, click OK. The system displays a prompt to restart Pervasive.SQL services. 11. Click OK. Do not restart the services at this time. You will do so later in this task. AuditMaster User s Guide Maintaining Servers 4-9

72 Removing the Network Share 12. Select Server Add. The Locate amserver on Your AuditMaster Server dialog box appears. 13. Using the new path value that you have been implementing, enter drive:\pervasive.sql root directory\audit\data to navigate to the location of the file amserver, which contains all of the settings you have just changed. The path name you enter might resemble the following: 4-10 Maintaining Servers AuditMaster User s Guide

73 Removing the Network Share 14. Select the file amserver, and click Open. Based on the new server settings you have entered, and the new server appears. 15. Select the old server node with the network share in its name and then select Server Remove. The system prompts you to confirm removal of the old server configuration. AuditMaster User s Guide Maintaining Servers 4-11

74 Removing the Network Share 16. Click Yes. The server is removed from the list and the status field at the bottom of the main window indicates no server is active. 17. Exit from AuditMaster Viewer. In order to remove the network share, AuditMaster and Pervasive.SQL services must not be running. 18. If Pervasive Control Center (PCC) is not open, select Start Programs Pervasive.SQL V8 Control Center. 19. In the PCC namespace, expand the tree as needed, right-click the node for the database engine that you are monitoring, and select Tasks Stop All Pervasive Services. 20. In Windows Explorer, open the folder drive:\pervasive.sql root directory. The shared folder Audit appears in the list of files. 21. Right-click the shared folder icon and select Properties. The Properties window appears. 22. Select the Sharing tab. The Sharing pane comes to the front. 23. Select Do not share this folder, and click OK. The share is deleted and the Properties window closes Maintaining Servers AuditMaster User s Guide

75 Removing the Network Share 24. In the PCC namespace, right-click the node for the database engine that you are monitoring, and select Tasks Start All Pervasive Services. 25. After the services have restarted, verify that AuditMaster is working properly without a network share by opening the viewer and logging in using one of the following ways: Select Start Programs Pervasive.SQL V8 AuditMaster Viewer. Select Start Programs Pervasive.SQL V8 AuditMaster AuditMaster Tray, then right-click the service tray icon and select Pervasive AuditMaster Viewer. The Pervasive AuditMaster window appears, showing the available server. 26. Right-click the configuration and select Login. You may also double-click it to log in. The AuditMaster Login dialog box appears. 27. Enter an AuditMaster administrative user name and password, and click OK. The AuditMaster Viewer menus become active. AuditMaster User s Guide Maintaining Servers 4-13

76 Removing the Network Share Note: AuditMaster has a built-in user ID called admin, for which the installation sets the default password MASTER. The user name is not case-sensitive, but the password is. You will want to consider changing this default login for security reasons. All AuditMaster accounts are for AuditMaster only and are not related to one's domain user login in the network environment nor to any local user login on the machine where AuditMaster and Pervasive.SQL are running. The new AuditMaster server is now ready to configure data monitoring without a network share Maintaining Servers AuditMaster User s Guide

77 Managing the Current View File Managing the Current View File For each server in the data tree, the current view file displays AuditMaster event data captured in the AuditMaster log file for that server. To manage this file in either its current or archived states, see the following topics: Updating the Current View File Archiving the Current View File Working with Archived Files on page 4-16 Updating the Current View File The AuditMaster log processor works with the event handler to map newly captured audit data into the current view file. The default schedule for this transfer is once every three minutes, at which time all recently logged records are transferred to the current view file. However, you can choose to execute the mapping process at any time to update the current view file and refresh the audit record grid. To start the mapping process manually, follow these steps: 1. In the data tree for the server you would like to update, click the current view file. 2. Select Server Update Current View File, or click the double-arrow icon in the AuditMaster toolbar. The log processor retrieves the most recent audit data captured by the event handler and maps it into the current view file, next to which appears the icon to indicate the update has completed. 3. Run a query to refresh the audit record grid with the updated data. Note: The three-minute default interval for mapping fresh records into the current view file can be reset by selecting Admin Server Settings AMMON Settings and changing the value for Mapper Threshold. Archiving the Current View File Comprehensive database logging can generate large amounts of audit data. To manage the volume of data, the event handler uses an automated process that periodically saves the current view file to an archived file. Archiving resets the current view file to empty to begin receiving fresh audit records. The default current view file size for this automatic archiving is 75 MB. Archiving compresses the file to as little as 10 percent of its original size. Archiving also encrypts the file format to restrict unauthorized access. AuditMaster User s Guide Maintaining Servers 4-15

78 Managing the Current View File In addition to the automated archiving provided by the system, you can archive the current view file manually. You may want to do this for several reasons: The current view file has grown large and takes longer to manipulate, and you don t want to wait until the next automated archiving to regain performance speed. You prefer to do archiving by date rather than by size (e.g., a daily archive file to include in a backup system). You cannot run a query against a compressed archive file. You must first decompress it by right-clicking and selecting Decompress. If you archive manually, you can use the decompressed archive and then compress it later if needed to save disk space. To archive manually, select the current view file in the data tree and do one of the following: Select Server Archive Current View File, or right-click the file and select Archive. Select Server Archive & Compress Current View File, or right-click the file and select Archive & Compress. The file is automatically named according to the sequence of archives and data and appears in the Archived Files branch of the data tree. Working with Archived Files AuditMaster provides a number of commands for working with archived current view files. To view the available files, expand the Archived Files branch in the data tree. Figure 4-4. Archived Files Archived Files Click the + sign to expand and display the list of archives for each server You can use File and Tool menu commands on an archive file just as you would the current view file, including the following short-cut commands opened by rightclicking an archive file: 4-16 Maintaining Servers AuditMaster User s Guide

79 Managing the Current View File Query. Run a query on a decompressed archive. Compress. Compress an uncompressed archive file. Decompress. Decompress a compressed archive file. Get File Information. Show archive information, including viewable or compressed status, number of records, current file size, and dates of the first and last records. Delete. Permanently remove the file from the AuditMaster system. AuditMaster User s Guide Maintaining Servers 4-17

80 Changing Your Pervasive AuditMaster Password Changing Your Pervasive AuditMaster Password AuditMaster user access is password-protected. When you are logged in to an AuditMaster server, you can change your password for that particular server. Passwords on other AuditMaster server configurations are independently set and may be different. We suggest you change your password frequently to lessen risk of unauthorized access to AuditMaster data. To change your password: 1. Select Server Change Password. The Change Password dialog box appears. Figure 4-5. Change Password 2. Enter your current password in the field provided. 3. Enter a new password. The password is case-sensitive, can be up to 10 characters long, and may use any numbers or letters. 4. Reenter the new password. 5. Click OK. Your password is changed and must be used the next time you log in to AuditMaster. Note: AuditMaster has a built-in user ID called admin, for which the installation sets the default password MASTER. The user name is not case-sensitive, but the password is. You will want to consider changing this default login for security reasons. All AuditMaster accounts are for AuditMaster only and are not related to one's domain user login in the network environment nor to any local user login on the machine where AuditMaster and Pervasive.SQL are running Maintaining Servers AuditMaster User s Guide

81 CHAPTER 5 Administering Pervasive AuditMaster About This Chapter As an administrator, you may need to perform certain tasks to define how AuditMaster operates. This chapter describes the administrative tasks found under the Admin menu, which appears only if an AuditMaster administrative user is logged in to the AuditMaster system. Getting Started To use the Admin menu, see the following sections in this document: 1. To display a log of AuditMaster system activity, see Reviewing System Activity Using the Status Log on page To configure AuditMaster to monitor database access and change activity, see Working with Product Configurations on page To add or remove users, see Adding or Removing Users on page To maintain the pathnames for the AuditMaster log, archives and queries as well as for the database applications, see Maintaining the Server Settings on page To define the maximum number of archives to show in the data tree, see Setting the Archived File Display on page AuditMaster User s Guide Administering Pervasive AuditMaster 5-1

82 Reviewing System Activity Using the Status Log Reviewing System Activity Using the Status Log The Status Log Viewer provides a list of AuditMaster events. The status log displays the activity logging that AuditMaster performs on itself. 1. To open the status log, select Admin View Status Log. The Status Log Viewer window displays several types of messages. Normally, these are all status messages to provide information on current system operation. Figure 5-1. Status Log Viewer 2. To filter the log by the type of message, select the type of message from the Message Type list. You may choose to view debug and error messages, which can be helpful in troubleshooting any unexpected behavior in AuditMaster. 3. To filter by the Module Name, enter the name of the module. 4. To filter by the source file, enter the name of the source file. You can look at specific lines of the source file by entering the line numbers in the fields provided. 5. To filter by specific dates, select dates from the Earliest and Latest lists. Only activity logged between these two dates are displayed in the log. 5-2 Administering Pervasive AuditMaster AuditMaster User s Guide

83 Reviewing System Activity Using the Status Log 6. To filter by searching for message content, enter a text string, select checkboxes to indicate whether to match exact text and match case. 7. When you are finished, click Refresh. The log is refreshed and resorted according to the filtering options you selected. AuditMaster User s Guide Administering Pervasive AuditMaster 5-3

84 Working with Product Configurations Working with Product Configurations Configuring AuditMaster consists in working with product configurations. An AuditMaster product configuration combines four types of information: A Pervasive.SQL database server An application front-end to the database Files to monitor Data definitions imported from a Pervasive.SQL data dictionary (optional) Data definitions are not required to use AuditMaster. However, if a Pervasive.SQL data dictionary is available, you will be able to create a product configuration to use it by exporting the dictionary from the Pervasive.SQL database and importing the data definitions into AuditMaster. The use of data definitions enhances both audit record readability and the precision of triggers for alerts, as you will see later. Files monitored under a product configuration may be arranged into groups. For example, if you have a different group of files for each customer in your application, you can choose to give each customer s data files their own AuditMaster group. However, all groups under a single product configuration must use the same set of data definitions. Also, only one set of data definitions can be used in each product configuration. So, if you want to monitor a database using a different data dictionary, you will create a separate product configuration for that combination. We strongly recommend that you work through the following tutorials, in the order given, before you attempt to create your own AuditMaster product configurations for data monitoring: 1. Configuring Data Monitoring without Data Definitions on page Configuring Data Monitoring with Data Definitions on page Importing Data Definitions into Pervasive AuditMaster on page Administering Pervasive AuditMaster AuditMaster User s Guide

85 Configuring Data Monitoring without Data Definitions Configuring Data Monitoring without Data Definitions The tutorial in this section shows how to use an AuditMaster product configuration consisting of the following: A Pervasive.SQL V8 database server A Pervasive.SQL V8 client as the front-end application A group of database files for a fictional video store No data definitions The database used in this example is fictional. Simply read through the steps to become familiar with the product configuration procedure. In the next tutorial, Configuring Data Monitoring with Data Definitions on page 5-12, you will have sample files for hands-on practice. To use a product configuration without data definitions, follow these steps: 1. Open AuditMaster Viewer in one of the following ways: Select Start Programs Pervasive.SQL V8 AuditMaster Viewer. Select Start Programs Pervasive.SQL V8 AuditMaster AuditMaster Tray, then right-click the service tray icon and select Pervasive AuditMaster Viewer. The Pervasive AuditMaster window appears, showing the Pervasive.SQL server. AuditMaster User s Guide Administering Pervasive AuditMaster 5-5

86 Configuring Data Monitoring without Data Definitions 2. Right-click the server and select Login. You may also double-click it to log in. The AuditMaster Login dialog box appears. 3. Enter the default user name admin and the default password MASTER. The user name is not case-sensitive, but the password is. Note: Later you will want to consider using the Admin User Maintenance command to change the default login for security reasons. 4. Click OK. The AuditMaster Viewer menus become active. 5. Select Admin Product Configuration. The Product Configuration window opens, showing the available product definitions. 5-6 Administering Pervasive AuditMaster AuditMaster User s Guide

87 Configuring Data Monitoring without Data Definitions 6. In the left pane, right-click Pervasive.SQL Generic and select New Configuration. You may also double-click to open it. The Pervasive SQL Generic Configuration dialog box appears: 7. From the drop-down list, select the drive on which to choose new files to be monitored, and click OK. The system displays the Selection of Files to Be Monitored window. AuditMaster User s Guide Administering Pervasive AuditMaster 5-7

88 Configuring Data Monitoring without Data Definitions 8. Click Add Group. The Enter Group Name dialog box appears. A group is a set of one or more files to monitor. Group names are case-sensitive and can use any keyboard characters, including spaces, up to 40 characters in length. Since group names are globally visible, it is recommended that you name a group to reflect the product configuration under which you are creating it. 9. Enter a group name, and click OK. For this example, the group name Pvideo is used. The Selection of Files to Be Monitored window activates the Available Files area. 5-8 Administering Pervasive AuditMaster AuditMaster User s Guide

89 Configuring Data Monitoring without Data Definitions 10. In the Available Files area, navigate through the folder hierarchy to locate files to monitor. Only files in Btrieve format will be listed. You may also use the Show Files in Subdirectories button, after double-clicking a folder, to display a list of all Btrieve files from the double-clicked directory downward. 11. Highlight a file name, and click Select. You may also double-click to select a file. AuditMaster adds the file path name to the Files to Be Monitored list. You can also click Select All to select all of the files in the current list. If you decide not to monitor a file, select it and click Remove to delete it from the group. Remove All deletes all files from the group. AuditMaster User s Guide Administering Pervasive AuditMaster 5-9

90 Configuring Data Monitoring without Data Definitions 12. When you are finished, click Close. In the Product Configuration window, the Configured Components area identifies the new configuration for the product definition. Expanding the newly added group in the Monitored Files area lists the file that was added to the group. AuditMaster is now set to monitor the Pervasive.SQL file. The file and its group are associated only with this particular product configuration. 13. If you wish to change the product configuration, do the following: In the list of product definitions, select the one that contains the product configuration for which you want to change a group or file, then click the Select Files button to display the Selection of Files to Be Monitored window and return to step Administering Pervasive AuditMaster AuditMaster User s Guide

91 Configuring Data Monitoring without Data Definitions 14. When you are finished with entries in the Product Configuration window, click Close. The window closes and the system prompts you to restart the Pervasive.SQL services. 15. Click OK. 16. Exit from AuditMaster Viewer. For the following steps to be successful, AuditMaster must not be running. 17. If Pervasive Control Center (PCC) is not open, select Start Programs Pervasive.SQL V8 Control Center to open it. 18. In the PCC namespace, expand the tree as needed, right-click the node for the database engine that you are monitoring, and select Tasks Restart Pervasive Services. After the services restart, the new AuditMaster configuration becomes active and log event handling begins. AuditMaster User s Guide Administering Pervasive AuditMaster 5-11

92 Configuring Data Monitoring with Data Definitions Configuring Data Monitoring with Data Definitions The tutorial in this section shows how to use an AuditMaster product configuration consisting of the following: A Pervasive.SQL V8 database server A Pervasive.SQL V8 client as the front-end application A group of demonstration files included with your Pervasive.SQL V8 installation A set of data definitions already imported with your AuditMaster installation Your Pervasive.SQL V8 installation included a set of tables for demonstration purposes, which are stored in a directory demodata in the Pervasive.SQL root directory. For the purpose of this tutorial, the data definitions for these tables have already been imported into your AuditMaster installation so that AuditMaster can use them to configure, monitor, and display audit records for the demonstration database. Following this tutorial, Importing Data Definitions into Pervasive AuditMaster on page 5-21 shows how to create a new product configuration that uses your own application and its data definitions. To use a product configuration with data definitions, follow these steps: 1. Open AuditMaster Viewer in one of the following ways: Select Start Programs Pervasive.SQL V8 AuditMaster Viewer. Select Start Programs Pervasive.SQL V8 AuditMaster AuditMaster Tray, then right-click the service tray icon and select Pervasive AuditMaster Viewer Administering Pervasive AuditMaster AuditMaster User s Guide

93 Configuring Data Monitoring with Data Definitions The Pervasive AuditMaster window appears, showing the server available. 2. Right-click the configuration and select Login. You may also double-click it to log in. The AuditMaster Login dialog box appears. 3. Enter the default user name admin and the default password MASTER. The user name is not case-sensitive, but the password is. Note: Later you will want to consider using the Admin User Maintenance command to change the default login for security reasons. 4. Click OK. The AuditMaster Viewer menus become active. AuditMaster User s Guide Administering Pervasive AuditMaster 5-13

94 Configuring Data Monitoring with Data Definitions 5. Select Admin Product Configuration. The Product Configuration window opens. 6. In the left pane of the Product Configuration window, right-click Pervasive.SQL Demo and select New Configuration. You may also double-click to open it. The Pervasive.SQL Demo Configuration dialog box appears: 5-14 Administering Pervasive AuditMaster AuditMaster User s Guide

95 Configuring Data Monitoring with Data Definitions 7. If you have a standard Pervasive.SQL installation, click OK to accept the default drive C: for the Pervasive.SQL Demo drive location (e.g., C:\PVSW\demodata) and the version of Pervasive.SQL (i.e., 8.0). Otherwise, use the drop-down list to change to the appropriate location for your Pervasive.SQL database. The system displays the Selection of Files to Be Monitored window. AuditMaster User s Guide Administering Pervasive AuditMaster 5-15

96 Configuring Data Monitoring with Data Definitions 8. Click Add Group. The Enter Group Name dialog box appears. A group is a set of one or more files to monitor. Group names are case-sensitive and can use any keyboard characters, including spaces, up to 40 characters in length. Since group names are globally visible, it is recommended that you name a group to reflect the product configuration under which you are creating it. 9. Enter the group name Demodata, and click OK. 10. In the Available Files area, navigate through the folder hierarchy to locate files to monitor. Only files in Btrieve format will be listed. You may also use the Show Files in Subdirectories button, after double-clicking a folder, to display a list of all Btrieve files from the double-clicked directory downward. For this example, select the Pervasive.SQL demonstration directory C:\PVSW\demodata Administering Pervasive AuditMaster AuditMaster User s Guide

97 Configuring Data Monitoring with Data Definitions 11. Click the file name student.mkd, and click Select. You may also double-click it. AuditMaster adds the file path name to the Files to Be Monitored list. You can also click Select All to select all of the files in the current list. Each file can be a member of only one group. If you select a file that is already listed in another group, AuditMaster informs you of a configuration conflict. Should this occur, see Resolving Configuration Conflicts on page If you decide not to monitor a file, select it and click Remove to delete it from the group. Remove All deletes all files from the group. AuditMaster User s Guide Administering Pervasive AuditMaster 5-17

98 Configuring Data Monitoring with Data Definitions 12. When you are finished selecting files, click Close. In the Product Configuration window, the Configured Components area identifies the new configuration. Expanding the newly added group in the Monitored Files area lists the files. AuditMaster is now set to monitor the file. 13. If you wish to change the product configuration, do the following: In the product configurations, select the one that contains the group and file you want to change, then click the Select Files button to display the Selection of Files to Be Monitored window and return to step 10. Note: All groups and files in a product configuration that uses a set of data definitions must use the same set. If you try to add a file that does not match the data definitions for the product configuration, AuditMaster informs you that the file is "not registered for monitoring." 5-18 Administering Pervasive AuditMaster AuditMaster User s Guide

99 Configuring Data Monitoring with Data Definitions 14. When you are finished with entries in the Product Configuration window, click Close. The window closes and the system prompts you to restart the Pervasive.SQL services. 15. Click OK. 16. Exit from AuditMaster Viewer. For the following steps to be successful, AuditMaster must not be running. 17. If Pervasive Control Center (PCC) is not open, select Start Programs Pervasive.SQL V8 Control Center to open it. 18. In the PCC namespace, expand the tree as needed, right-click the node for the database engine that you are monitoring, and select Tasks Restart Pervasive Services. After the services restart, the new AuditMaster configuration becomes active and log event handling begins. You are now ready to attempt to create a product configuration for your own Pervasive.SQL database server, application, database files, and data definitions. Proceed to Importing Data Definitions into Pervasive AuditMaster on page AuditMaster User s Guide Administering Pervasive AuditMaster 5-19

100 Configuring Data Monitoring with Data Definitions Resolving Configuration Conflicts Each file selected for monitoring can belong to only one group and one product configuration. If you attempt to select it for any other group, the following window appears: You have two options for resolving the conflict: Click the Close button to cancel the selection and leave the file in its original group. Move the file to the new group by selecting it and clicking the Convert button. The file is removed from its original group and added to the new one Administering Pervasive AuditMaster AuditMaster User s Guide

101 Importing Data Definitions into Pervasive AuditMaster Importing Data Definitions into Pervasive AuditMaster Pervasive.SQL databases can use data dictionary files (DDFs) to define parts of a data record. AuditMaster can use these data definitions for two purposes: to make the contents of audited records readable with field names and ASCII field values and to enable you to set triggers based on changes to individual fields within a record. When data definitions are not used, the contents of audited records appear as hexadecimal characters without field names and you cannot set alerts for individual data fields. Earlier in this chapter, the example Configuring Data Monitoring without Data Definitions on page 5-5 used an example of monitoring files in a fictional video store database. Lacking data definitions, an AuditMaster audit record for the insert of a new customer in the database would resemble the following: After the data definitions from the database are imported into AuditMaster, however, then new audits of inserted records can be displayed as follows: Use of data definitions is accomplished in two parts: 1. Exporting a Data Dictionary from Pervasive.SQL on page Importing Data Definitions into AuditMaster on page 5-26 AuditMaster User s Guide Administering Pervasive AuditMaster 5-21

102 Importing Data Definitions into Pervasive AuditMaster Exporting a Data Dictionary from Pervasive.SQL The following example guides you through the steps for exporting of DDFs from a Pervasive.SQL database. This example uses the same fictional video store as in the previous tutorial, and no actual files are provided for hands-on practice, but after reviewing the steps, you should be ready to attempt exporting DDFs from your own application. Following this section, Importing Data Definitions into AuditMaster on page 5-26 provides an example to guide you through the steps of importing DDFs as data definitions into AuditMaster. Note: If you are using Pervasive.SQL V8 Security with Pervasive.SQL security policy on the DefaultDB database set to Mixed or Database, then before working with data definitions for a product configuration, you must first add their path to the list of data locations for DefaultDB. For more information, see Running AuditMaster under Pervasive.SQL Security in Chapter 2 of Getting Started with Pervasive AuditMaster. 1. Open the Export Data Definitions wizard. Select Start Programs Pervasive.SQL V8 AuditMaster Utilities Data Definition Export. The Export Data Definitions wizard window appears. 2. Enter a name for the product configuration. This name will appear in the Product Configuration list after Pervasive.SQL Demo and Pervasive.SQL Generic, which were included in your installation. Use it to identify the type of application for which you want to monitor data files. 3. Enter a description for the product configuration. This description will appear in the tree of servers on the left-hand side of the AuditMaster main window. Use it to identify your Pervasive.SQL server Administering Pervasive AuditMaster AuditMaster User s Guide

103 Importing Data Definitions into Pervasive AuditMaster 4. Enter a version for the product configuration. The version number will help to identify the release version of your application and distinguish it from other versions if your network environment supports more than one release. The following values are used in this example. 5. Click Next. The wizard prompts for a DDF source location and password. The source location is the directory where the database data dictionary resides (e.g., file.ddf, field.ddf, index.ddf). If the security feature in the Pervasive.SQL V8 source database has been enabled for the data dictionary, enter the password here. If security is not enabled, no password is needed. AuditMaster User s Guide Administering Pervasive AuditMaster 5-23

104 Importing Data Definitions into Pervasive AuditMaster 6. Enter a directory path name or use the browse button to navigate to the correct folder, then enter the optional password if desired, and click Next. The wizard prompts for a file name. If you enter no path name before the file name, the default path will be your chosen installation location drive:\pervasive.sql root directory\audit\bin (e.g., C:\PVSW\Audit\Bin in a standard installation). 7. Enter a file name, and click Next. The wizard confirms the product name, description, and version you entered, as well as the source directory and the file name for the file it saved. The saved file in this example is pvideo.add. The suffix.add stands for "AuditMaster data definitions." 5-24 Administering Pervasive AuditMaster AuditMaster User s Guide

105 Importing Data Definitions into Pervasive AuditMaster 8. Click Finish. The wizard completes the export process. AuditMaster User s Guide Administering Pervasive AuditMaster 5-25

106 Importing Data Definitions into Pervasive AuditMaster Importing Data Definitions into AuditMaster The following steps guide you through an example of importing into AuditMaster the fictional video store data definitions exported from Pervasive.SQL in the last section. 1. Open the Import Data Definitions wizard. Select Start Programs Pervasive.SQL V8 AuditMaster Utilities Data Definition Import. The Import Data Definitions wizard window appears Administering Pervasive AuditMaster AuditMaster User s Guide

107 Importing Data Definitions into Pervasive AuditMaster 2. Enter a file name for the.add file to import, or use the browse button to navigate to its folder. This example uses the pvideo AuditMaster data definitions file created in Exporting a Data Dictionary from Pervasive.SQL on page It was saved in the chosen installation location drive:\pervasive.sql root directory\audit\bin (e.g., C:\PVSW\Audit\Bin in a standard installation), 3. Click Next. The wizard prompts for the target directory into which to import the.add file. Use the location chosen at installation time, drive:\pervasive.sql root directory\audit\data (e.g., C:\PVSW\Audit\DATA in a standard installation). AuditMaster User s Guide Administering Pervasive AuditMaster 5-27

108 Importing Data Definitions into Pervasive AuditMaster 4. After entering the import target path name, click Next. The wizard confirms the source and target directories. 5. Click Finish. The wizard completes the import process 6. Click Close. AuditMaster is now ready to use the imported data definitions. To use the imported data definitions, you will need to find the product configuration you created, add a group, and then select a table to monitor. Once these steps are completed, audit records for the monitored table will display readable content rather than raw hexadecimal bytes, as shown in the examples on page Note: Importing data definitions does not change the display of already captured application records in the audit log, which remain in hexadecimal format. Only new audit records will use the data definitions once they are imported Administering Pervasive AuditMaster AuditMaster User s Guide

109 Adding or Removing Users Adding or Removing Users As part of AuditMaster s security, only trusted personnel are allowed access to the AuditMaster system. As administrator, you must define user names and provide a password for each user. You must also decide whether each user shall also have your same administrator privileges. To add or remove a user: 1. Select Admin User Maintenance. The User Maintenance window appears. Figure 5-2. User Maintenance 2. To add a user: Enter a user name and password in the fields provided. The user name is not case-sensitive, but the password is. Enter the password again to confirm it. Click Create User. You are asked whether this user will have administrator privileges. Click Yes or No as appropriate. The new user appears in the list of current users. 3. To delete a user: Select a user from the Delete User list. Click Delete User. You are asked to confirm the deletion. Click OK. The user is removed from the list. AuditMaster User s Guide Administering Pervasive AuditMaster 5-29

110 Maintaining the Server Settings Maintaining the Server Settings The Server Settings window displays a number of AuditMaster settings, some of which can be adjusted to manage system behavior. Server settings define where AuditMaster maintains important components of its server installations. It is important to leave these settings as defaults unless you are sure of their function. To view or change server settings: 1. Select Admin Server Settings. The Server Settings window appears. Figure 5-3. Server Settings 2. Select a section on the left to display setting keys and values on the right. The list offers the following sections of settings: Ammon Paths Ammon Settings Errors to Audit Operations to Audit TNBTMON Paths 3. Double-click a key you want to modify. If the key can be modified, the value field becomes active. 4. Enter a new value, and press Enter Administering Pervasive AuditMaster AuditMaster User s Guide

111 Maintaining the Server Settings 5. When you are finished, click OK to save the new settings. The system prompts you to apply the new settings. 6. To apply the new settings, exit from AuditMaster Viewer. For the following steps to be successful, AuditMaster must not be running. 7. If Pervasive Control Center (PCC) is not open, select Start Programs Pervasive.SQL V8 Control Center to open it. 8. In the PCC namespace, expand the tree as needed, right-click the node for the database engine that you are monitoring, and select Tasks Restart Pervasive Services. After the services restart, the new AuditMaster settings become active and log event handling begins. AuditMaster User s Guide Administering Pervasive AuditMaster 5-31

112 Setting the Archived File Display Setting the Archived File Display Archived files are listed in the data tree lists under the current view file. Figure 5-4. Data Tree Showing Uncompressed and Compressed Archived Files Depending on how frequently archiving takes place, you may find the list grows too long and want to shorten it. Other times, you may find it too short and want to show more files. The default setting for the number of archived files shown in the tree is 15. Reducing this number does not delete the extra archived files but only removes them from the display. They remain in the \arch and \comp folders in the AuditMaster root directory (e.g., default c:\pvsw\audit). Raising the setting displays them again. To set the number of archived files to show, complete the following steps. 1. Select View Set Archives to Show. The Archives to Show dialog box appears. Figure 5-5. Archives to Show 2. Select or enter the maximum number of archives to show, and click OK. The minimum setting is 2. The maximum is Administering Pervasive AuditMaster AuditMaster User s Guide