VMware AirWatch Reports and Analytics Guide

Transcription

1 VMware AirWatch Reports and Analytics Guide AirWatch v9.1 Have documentation feedback? Submit a Documentation Feedback support ticket using the Support Wizard on support.air-watch.com. This product is protected by copyright and intellectual property laws in the United States and other countries as well as by international treaties. VMware products are covered by one or more patents listed at VMware is a registered trademark or trademark of VMware, Inc. in the United States and other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies. 1

2 Revision Table The following table displays revisions to this guide since the release of AirWatch v9.1. Date Reason April 2017 Initial upload. 2

3 Table of Contents Chapter 1: Overview 5 What's New with Reports & Analytics in AirWatch v9.1 6 Introduction to Reports and Analytics 7 Introduction to File Storage 7 Requirements for File Storage 8 Enable File Storage for Reports 9 Chapter 2: AirWatch Reports 11 Reports Overview 12 New Reports 12 Subscribe to a New Report 14 Deprecated Reports 15 Generate Reports 17 Subscribe to an Old Report 18 Manage Reports 20 Reports Storage Overview 20 Reports Storage Requirements 20 Enable Reports Storage 21 Troubleshooting Reports 23 Enable Background Processing Service 24 Chapter 3: Event Logs 26 Event Logs Overview 27 Use Device Events 27 Use Console Events 28 Chapter 4: Syslog 29 Syslog Integration Overview 30 Configure Syslog 30 Chapter 5: AirWatch DataMart 32 AirWatch DataMart Overview 33 3

4 DataMart Requirements 33 Install DataMart 34 DataMart Tables 38 DataMart Entity Relationship Diagram 44 Accessing Other Documents 46 4

5 Chapter 1: Overview What's New with Reports & Analytics in AirWatch v9.1 6 Introduction to Reports and Analytics 7 Introduction to File Storage 7 Requirements for File Storage 8 Enable File Storage for Reports 9 5

6 Chapter 1: Overview What's New with Reports & Analytics in AirWatch v9.1 With AirWatch v9.1, Reports & Analytics supports several new features. The list below describes these features and where you can find them: Store your reports in a dedicated storage to improve performance. AirWatch now supports a dedicated Reports Storage solution that stores your reports in a dedicated file storage. Use Reports Storage to improve performance and reduce bandwidth on your AirWatch database. For more information, see Reports Storage Overview on page 20. 6

7 Chapter 1: Overview Introduction to Reports and Analytics AirWatch Reports and Analytics provide access to reports on various section of your AirWatch solution. Use these reports to analyze patterns from the AirWatch Console. Reports and Analytics Basics Three components provide the information needed to access the health of your AirWatch solution. The reports provide detailed information about users, devices, applications. The event logs list each admin and device action taken in the AirWatch Console. AirWatch DataMart provides scheduled exports of data for analysis. You can also integrate and Security Information and Event Management (SIEM) tools into your AirWatch solution using the AirWatch Syslog settings. Reports The reports functionality allows you to access detailed information about the devices, users, and applications in your AirWatch solution. The exports of these reports are in CSV format. Recently, the 15 most popular reports were combined into three new reports. These new reports are labeled in the AirWatch Console as New. For more information, see Reports Overview on page 12. Event Logs The event logs provides records of administrative and device actions that the AirWatch Console stores in logs. You can export event logs as CSV files or you can configure the AirWatch Console to send these event logs to your Security Information and Event Management tools or Business Intelligence systems. For more information, see Event Logs Overview on page 27. Syslog Integration Security Information and Event Management (SIEM) technology gathers information about security alerts generated by network hardware and software components. It centralizes this data and generates reports to help you monitor activity, perform log audits, and respond to incidents. AirWatch integrates with your SIEM tools by sending event logs using Syslog. For more information, see Syslog Integration Overview on page 30. AirWatch DataMart AirWatch DataMart that enables scheduled automatic data exports from the AirWatch database for statistical analysis and reporting. To use the tool, load DataMart on the server hosting the AirWatch database or in a separate network location. Successful installation creates two SQL Server Agent jobs on the server. For more information, see AirWatch DataMart Overview on page 33. Introduction to File Storage Certain AirWatch functionality can use a dedicated file storage service to handle processing and downloads, which reduces the overall burden on your AirWatch database and increases its performance. This includes certain AirWatch 7

8 Chapter 1: Overview reports, internal application deployment, and AirWatch managed content. When you enable file storage for any of these functionalities, it is applied to the others automatically. Setting up file storage causes all reports, all internal applications, and all AirWatch managed content to be stored there. Setting up file storage is only applicable to on-premises customers. It is automatically configured for SaaS customers. AirWatch Reports In v9.0.2, AirWatch added three new reports that appear the same as existing reports but use a completely revamped back end framework. This new framework generates reports with greater reliability and faster download times. To take advantage of these benefits, you must set up file storage. For more information about these reporting updates, see the following Knowledge Base article: Internal Applications When file storage is enabled, all internal application packages (.ipa,.pak,.appx,.msi..exe, and so on) that you upload through the AirWatch Console are stored in a file storage location. File storage is required to deploy Win32 applications from the Apps & Books area of the AirWatch Console. This feature is called software distribution. AirWatch Managed Content You can separate AirWatch managed content from the AirWatch database by storing it in a dedicated file storage location. Uploading large amounts of AirWatch managed content may cause issues with database performance. In this case, on-premises customers can free up space in the database by moving AirWatch Managed Content to an integrated local file storage solution. AirWatch personal content also moves to the file storage solution is enabled. By default, personal content is stored in the SQL database. If you have a Remote File Storage enabled, personal content is stored in the RFS and not in the file storage or SQL database. Requirements for File Storage Meet the following requirements to set up local file storage. Create the Shared Folder on a Server in your Internal Network File storage can reside on a separate server or the same server as one of the other AirWatch application servers in your internal network. It should only be accessible to components that require access to it, such as the Console and Device Services servers. If the Device Services server, Console server, and the server hosting the shared folder are not in the same domain, then establish Domain Trust between the domains to avoid authentication failure. If the Device Services server or Console server are not joined to any domain, then supplying the domain during service account configuration is sufficient. 8

9 Chapter 1: Overview Configure the Network Requirements If using Samba/SMB TCP: 445, 137, 139. UDP: 137, 138 If using NFS TCP and UDP: 111 and 2049 Allocate Sufficient Hard Disk Capacity Your specific storage requirements may vary depending on how you plan to use file storage. The file storage location should have enough space to accommodate the internal apps, managed content, or reports you intend to use. Take into the account the following considerations: If you enable caching for internal apps or content, then a best practice is to size the Device Services server for 120 percent of the cumulative size of all the apps/content you need to publish. For storing reports, your storage requirements depend on the number of devices, the daily amount of reports, and the frequency with which you purge them. As a starting point, you should plan to allocate at least 50 GB for deployment sizes up to 250,000 devices running about 200 daily reports. Adjust these numbers based on the actual amount you observe in your deployment. Apply this sizing to your Console server as well if you enable caching. Create a Service Account with Correct Permissions Create an account with read and write permissions to the shared storage directory. Create the same local user and password on the Console, Device Services, and the server that is being used for File Storage. Give the local user read/write/modify permissions to the file share that is being used for the File Storage Path. Configure the File Storage Impersonation User in AirWatch with the local user You can also use a domain service account instead of a local user account. Configure File Storage at the Global Organization Group Configure file storage settings at the Global organization group level in the AirWatch Console. Enable File Storage for Reports Configure file storage for reports using the procedure below. Reports Storage is a storage designed and optimized for storing reports. 1. At the Global organization group level, navigate to Groups & Settings > All Settings > Installation > File Path and scroll to the bottom of the page. 9

10 Chapter 1: Overview 2. Select File Storage Enabled and configure the settings. Setting File Storage Path File Storage Caching Enabled File Storage Impersonation Enabled File Storage Impersonation Username Password Description Enter your path in the following format: \\{Server Name}\{Folder Name}, where Folder Name is the name of the shared folder you created on the server. When enabled, a local copy of the files requested for download is stored on the Console server as a cache copy. Subsequent downloads of the same file retrieve it from the Console server as opposed to file storage. If you enable caching, accommodate for the amount of space needed on the server where these files cache. For more information, see Requirements for File Storage on page 8. Select to add a service account with the correct permissions. Provide for a valid service account with both read and write permissions to the shared storage directory. Provide for a valid service account with both read and write permissions to the shared storage directory. 3. Select the Test Connection button to test the configuration. 10

11 Chapter 2: AirWatch Reports Reports Overview 12 New Reports 12 Subscribe to a New Report 14 Deprecated Reports 15 Generate Reports 17 Subscribe to an Old Report 18 Manage Reports 20 Reports Storage Overview 20 Reports Storage Requirements 20 Enable Reports Storage 21 Troubleshooting Reports 23 Enable Background Processing Service 24 11

12 Chapter 2: AirWatch Reports Reports Overview The reports functionality allows you to access detailed information about the devices, users, and applications in your AirWatch solution. The exports of these reports are in CSV format. AirWatch Reports allows you to review the state of your AirWatch deployment. The reports gather information on your devices, applications, users, and console actions. Use this information to troubleshoot your deployment and make informed decisions on what actions to take. In AirWatch v9.0.2, AirWatch added three new reports that appear the same as existing reports but use a completely revamped back end framework. This new framework generates reports with: More intuitive interface Improved report generation reliability Easier filter selection Faster download times Enhanced export status tracing capability Streamlined reports subscription functionality The storage of your reports depends on the storage solution you use. By default, AirWatch stores the reports in the AirWatch database. The reports remain in the database until they expire. Once expired, the reports are automatically deleted. Depending on the size of your deployment it is recommended to use storage as an extension to your database to improve performance. To configure storage, you can also enable File Storage which stores reports, content, and application in a separate file storage server or Reports Storage, which stores AirWatch Reports in a dedicated file store separate from all other content. To improve performance, consider enabling the reports storage. This storage uses a dedicated server to store all AirWatch Reports and increase performance. For more information, see Reports Storage Overview on page 20. Important: If you are using AirWatch v9.0.2 or v9.0.3, you must enable File Storage to use AirWatch Reports. For more information, see Introduction to File Storage on page 7 New Reports New reports are indicated by a New tag in front of them on the AirWatch Console. These reports combine multiple deprecated reports. To see the new reports, navigate to Hub > Reports & Analytics > Reports > List View. Navigate to Hub > Reports & Analytics > Exports to see the exported new reports. 12

13 Chapter 2: AirWatch Reports AirWatch offers three new reports: Application Details By Device Device Inventory Devices with User Details The following table shows the available columns for each of these new reports. New Reports Organization Group ID Organization Group Name Friendly Name Serial Number App Name App Identifier Deployed By Air Watch Managed App Assigned Version Device Type OS Version Device Last Seen address Device Inventory Device ID Application Details By Device Installed Version Bundle Size (KB) Dynamic Size (KB) Total Size Install Status Install Status Reason App First Seen App Updated Date Device ID Device Model Ownership Type Username Device Inventory Last Seen Asset Number 13

14 Chapter 2: AirWatch Reports New Reports Organization Group ID Organization Group Name Friendly Name Serial Number Device Type Device Model Phone Number Owner OS Version Enrollment Date Compliance Status Enrollment Status Unenrollment Date Managed By Username address Organization Group ID Organization Group Name Friendly Name Device ID Username User Id First Name Last Name Address User Phone Number Is Compromised Find My iphone Country MDMManaged YN Device Identifier Home Carrier Current Carrier MAC Address Wi-Fi IP Address IMEI Sim Card Number GPRS Connection Device Capacity(GB) Available Capacity(GB) Battery Life Percent Device Identifier Devices with User Details User Status Platform Device Model OS Version Ownership Type Serial Number IMEI Enrollment Status Compliance Status Date Enrolled Subscribe to a New Report Subscribe to a new report to receive alerts from the Hub page of the AirWatch Console. Subscription enables you to access important information regarding usage and other technical parameters. 14

15 Chapter 2: AirWatch Reports For security reasons, the subscription for new reports does not contain the report as a file attachment. The provides a link to download the report. This link requires authentication to download. Only admins with valid credentials can access the reports. Procedure 1. Navigate to Hub >Reports & Analytics > Reports > List View > All Reports. 2. Choose a desired new report and select the Report Subscriptions icon. 3. On the Parameters tab, configure applicable settings to set criteria for the scope of the report. These settings vary depending on the report. 4. On the Schedule tab, configure the following settings. Setting From To Description Specifies from whom the subscription is sent Specifies who receives the subscription Recurrence Defines when the AirWatch Console sends the subscription. Available options are once, daily, weekly, and monthly. You can also set the time of day for the report and the end of recurrence. Date/Time Subject Message If the recurrence is set to specific days of the month such as the 31st day of a month when the month only has 30 days, you will not receive a report for that month. Specifies when to start sending subscriptions Specifies a subject to help identify the subscription when the AirWatch Console delivers it Defines the message to explain the subscription when the AirWatch Console delivers it Important: Administrators with the appropriate role permissions and organization group access can view and edit other administrator's subscriptions. Deprecated Reports The reports whose data columns are now part of the New reports are indicated with a 'Deprecated' tag on the AirWatch Console. Consider using the new reports as all the data columns are same. 15

16 Chapter 2: AirWatch Reports The deprecated reports are: Application Compliance Application Deployment Status Device Application Detail Device Application Summary Device Details By Location Device Enrollment User Summary Device Inventory Detail Device Inventory Detail with Organization Group Device Inventory Detail with Applications Device Inventory Detail with User Information Device Inventory Summary Device Inventory Summary with Device Type Device Inventory Summary By Location Devices Enrolled Devices Last Seen Devices Unenrolled 16

17 Chapter 2: AirWatch Reports Note: In future releases, no bug fixes or enhancements will happen for the deprecated reports. Generate Reports The AirWatch reports and analytics solution includes the ability to export data from many sections in the AirWatch Console. From the Exports page on the AirWatch Console, you can download the generated reports once reports are successfully generated, links to download are available in the Export grid. To generate, view, and export a report: 1. Navigate to Hub > Reports & Analytics > Reports > List View and select the desired report. 2. On the report screen, complete the applicable settings. These settings vary depending on the report. 3. Click Download to export the report to the Exports page. 4. Navigate to Hub > Reports & Analytics > Exports and select the desired report. Click Complete available under Status column against the selected report to download it. Note: The exported new reports are mentioned as New Reports and the existing reports are mentioned as Reports under Export Type column. Note: From v9.0, the reports (.csv file) are available for download in zipped format. 17

18 Chapter 2: AirWatch Reports Subscribe to an Old Report Subscribe to a report to receive alerts from the Hub page of the AirWatch Console. Subscription enables you to access important information regarding usage and other technical parameters. Important: Any subscriptions associated with a deprecated report should function as it is. Instead, they are marked as deprecated. Consider using new reports and creating new subscriptions to use them. Procedure 1. Navigate to Hub > Reports & Analytics > Reports > List View > All Reports. 2. Choose a desired report and select the Report Subscriptions icon. 3. On the General tab, configure the following settings. Setting Description Description Defines a descriptive name for the subscription. Render Format Defines the format for the report. The default file format is.csv. Reply To Subject Message Body Specifies who receives the subscription. Specifies a subject to help identify the subscription when the AirWatch Console delivers it. Defines the message to explain the subscription when the AirWatch Console delivers it. 4. On the Parameters tab, configure applicable settings to set criteria for the scope of the report. These settings vary depending on the report. 5. On the Execution tab, configure the following settings. Setting Once Daily Weekly Monthly Description Recurrence Select this option to subscribe to this report a single time Select this option to receive the report every time a set number of days pass. Select this option to receive the report on specific days of the week. Select this option to receive the report on a specific day of the month. You can also set the schedule to First, Second, Third, Fourth, or Last week day of the month. If the recurrence is set to a day that does not occur in the month, you will not receive a report. For example, if you set recurrence to the Fourth Friday of a month, and the month only has 3 Fridays, you will not receive a report for that month. This also applies to specific days of the month such as the 31st day of a month when the month only has 30 days. 18

19 Chapter 2: AirWatch Reports Setting Description Range Date/Time Set the specific day and time to receive the report. Range Set the end date for the subscription to the report. 6. On the Distribution List tab, use one or all the parameters to make a distribution list to receive the subscription. Setting Choose Role Choose User Enter Address Search List Distribution List Description Select a role from the menu and click Add to List to add it to the distribution list. Select individual users and click Add to List to add them to the distribution list. Enter the addresses of subscription recipients manually, if you know the address and click Add to List to add them to the distribution list. Enter text to search the distribution list to find individual entries and to delete entries from the distribution list. Define to whom AirWatch sends the subscription. Create this list using the role, user, and address entries. Note: Admins can edit failed or inactive subscriptions and can save them again to fix the error. 19

20 Chapter 2: AirWatch Reports Manage Reports You can navigate to Hub > Reports & Analytics > Reports > List View page to view reports in the AirWatch Console. You can export data in various formats and perform the following actions. Report Subscriptions Configure a report to run on a specified interval with defined parameters. Add to My Reports Add reports to the My Reports tab for quick access. Reports Storage Overview Optimize the storage of your AirWatch Reports through reports storage. This storage feature increases the performance of AirWatch Reports. This storage is different than file storage used by reports, internal applications, and content. You do not need to enable reports storage if you already use file storage. Consider enabling reports storage if you see a performance impact on your AirWatch database when using reports. Reports storage applies to reports only, helps increase overall reports performance, and reduces the burden on your AirWatch database. If you enable both file storage and reports storage, reports storage overrides file storage when storing reports. Report storage requires a dedicated server to host the service and storage the reports. Reports Storage Requirements To deploy the reports storage solution, ensure your server meets the requirements. 20

21 Chapter 2: AirWatch Reports Create the Shared Folder on a Server in your Internal Network Report storage can reside on a separate server or the same server as one of the other AirWatch application servers in your internal network. It should only be accessible to components that require access to it, such as the Console and Device Services servers. If the Device Services server, Console server, and the server hosting the shared folder are not in the same domain, then establish Domain Trust between the domains to avoid authentication failure. If the Device Services server or Console server are not joined to any domain, then supplying the domain during service account configuration is sufficient. Configure Reports Storage at the Global Organization Group Configure reports storage settings at the Global organization group level in the AirWatch Console. Create a Service Account with Correct Permissions Create an account with read and write permissions to the shared storage directory. Create the same local user and password on the Console, Device Services, and the server that is being used for report storage. Give the local user read/write/modify permissions to the file share that is being used for the Report Storage Path. If you give the user modify permission, AirWatch automatically deletes old reports from the storage. If you do not give the user modify permissions, consider monitoring report storage to prevent running out of space. Configure the Report Storage Impersonation User in AirWatch with the local user You can also use a domain service account instead of a local user account. Allocate Sufficient Hard Disk Capacity Your specific storage requirements may vary depending on how you plan to use reports storage. The reports storage location should have enough space to accommodate the reports you intend to use. For storing reports, your storage requirements depend on the number of devices, the daily amount of reports, and the frequency with which you purge them. As a starting point, you should plan to allocate at least 50 GB for deployment sizes up to 250,000 devices running about 200 daily reports. Adjust these numbers based on the actual amount you observe in your deployment. Also apply this sizing to your Console server if you enable caching. Enable Reports Storage Enable reports storage to store your reports on a dedicated server and increase performance. To enable reports storage: 1. Navigate to Groups & Settings > All Settings > Installation > Reports. 2. Set Report Storage Enabled to Enabled. 21

22 Chapter 2: AirWatch Reports 3. Configure the report storage settings: Serttings Report Storage File Path Report Storage Caching Enabled Report Storage Impersonation Enabled Report Storage Impersonation Username Report Storage Impersonation Password Description Enter your path in the following format: \\{Server Name}\{Folder Name}, where Folder Name is the name of the shared folder you created on the server. When enabled, a local copy of the files requested for download is stored on the Console server as a cache copy. Subsequent downloads of the same file retrieve it from the Console server as opposed to file storage. If you enable caching, accommodate for the amount of space needed on the server where these files cache. For more information, see Reports Storage Requirements on page 20. Enable to add a service account with the correct permissions. Enter the username of a valid service account with both read, write and modify permissions to the shared storage directory. Displays when Report Storage Impersonation Enabled is enabled. Enter the password of a valid service account with both read, write, and modify permissions to the shared storage directory. Displays when Report Storage Impersonation Enabled is enabled. 4. Select the Test Connection button to test the configuration. 22

23 Chapter 2: AirWatch Reports Troubleshooting Reports If background processing service is not enabled, what steps should be taken? see Enable Background Processing Service on page 24 for more information. Where can I reference logs in case an error occurs in report processing? You can refer to the following logs: Web Console Logs For troubleshooting purpose, refer to these logs when any console error occurs. These logs can be referred for both new and existing reports. Logs can be located at: \AirWatch\Logs\WebConsole\WebConsoleLog.txt Detailed error logs on new reports Refer to logs located at: \AirWatch\Logs\Services\BackgroundProcessorServiceLogFile.txt Detailed error logs on old reports Refer to logs on reports server located at: \Microsoft SQL Server\MSRS12.ABC\Reporting Services\LogFiles 23

24 Chapter 2: AirWatch Reports Enable Background Processing Service AirWatch Reports requires the background processing service running on the AirWatch Console server. The installation process automatically enables this process but if it is not running, you must enable it to use AirWatch Reports. Each AirWatch Console server requires the background processing service. Each server processes reports and writes them to their respective queue before sending them to the database, file storage, or reports storage. To enable the background processing service, perform the following steps: 1. Press Windows key + R on the console server box. 2. Run the command "services.msc". 3. A screen appears listing all services running on the Console Server box. Locate Airwatch Background Processor Service and select Properties. 4. A screen appears showing if the service status. Make sure status of this service is Running. If status is Stopped, ensure to Start the service. 24

25 Chapter 2: AirWatch Reports 25

26 Chapter 3: Event Logs Event Logs Overview 27 Use Device Events 27 Use Console Events 28 26

27 Chapter 3: Event Logs Event Logs Overview Events are records of administrative and device actions that the AirWatch Console stores in logs. You can export event logs as CSV files or you can configure the AirWatch Console to send these event logs to your Security Information and Event Management tools or Business Intelligence systems. The event logs show both device events and AirWatch Console events. Device events show the commands sent from the AirWatch Console to devices, device responses, and device user actions. The AirWatch Console events show actions taken from the AirWatch Console including login sessions, failed login attempts, admin actions, system settings changes, and user preferences. You can filter the severity level, category, or module. Severity levels include: Critical Indicates a failure in a primary AirWatch Console system. Error Indicates a failure in a non-primary AirWatch Console system. Warning Indicates an issue in the future if action is not taken. Notice Indicates unusual conditions. Information Indicates normal operational data. Debug Indicates useful information for troubleshooting. Use Device Events Device events show Mobile Device Management (MDM) commands to devices, device responses, and device user actions. You can filter the log by date range, the severity level, category, or module. Severity levels include the following descriptions. Emergency Indicates a catastrophic MDM failure requiring immediate attention. Alert Indicates a failure of a foundational MDM system requiring attention. Critical Indicates a failure in a primary MDM system. Error Indicates a failure in a non-primary MDM system. Warning Indicates an issue in the future if action is not taken. Notice Indicates unusual conditions. Information Indicates normal operational data. Debug Indicates useful information for troubleshooting. To use the device event log. 1. Navigate to Hub > Reports & Analytics > Events > Device Events. 2. Filter the information to focus and narrow the list of devices. Filter by Data Range, Severity, Category, and Module. 3. Select the Friendly Name option to view data about a specific device. 27

28 Chapter 3: Event Logs 4. Select the User option to perform various functions, including Add Device, Edit options, and Change Organization Group. You can also view device information from this option. Use Console Events Console events show MDM actions from the AirWatch Console that include the following examples: Login sessions, Failed login attempts, Admin actions, System settings changes, and User preferences. Severity levels include the following descriptions: Critical Indicates a failure in a primary AirWatch Console system. Error Indicates a failure in a non-primary AirWatch Console system. Warning Indicates an issue in the future if action is not taken. Notice Indicates unusual conditions. Information Indicates normal operational data. Debug Indicates useful information for troubleshooting. To use a console event: 1. Navigate to Hub > Reports & Analytics > Events > Console Events. 2. Filter the information to focus and narrow the list of devices. Filter by Data Range, Severity, Category, and Module. 3. Click the Event Data option to view information for a specific console event. 28

29 Chapter 4: Syslog Syslog Integration Overview 30 Configure Syslog 30 29

30 Chapter 4: Syslog Syslog Integration Overview Security Information and Event Management (SIEM) technology gathers information about security alerts generated by network hardware and software components. It centralizes this data and generates reports to help you monitor activity, perform log audits, and respond to incidents. AirWatch integrates with your SIEM tools by sending event logs using Syslog. The event messages that are sent are the same ones that you can see from the Event Logs page in the AirWatch Console and also harness the same Event Categories. During syslog configuration, you can opt to send Console events, Device events, or both. Any events generated by the AirWatch Console are sent to your SIEM tool according to the scheduler settings. The only way for you to control which events send messages is to customize the logging levels at the Events Settings system settings page. On the Events Settings page, you can select a logging level for both the Console and Devices. Any logging level you select applies to what is shown in AirWatch, stored in the AirWatch database, and sent to your SIEM tool. Currently, you cannot opt to generate and store all events in AirWatch while sending a separate batch of select messages to your SIEM tool, or conversely. Integrating Advantages Event logs are sent to a SIEM tool for security and convenience: Security Keep logs off site in a secure location in your SIEM systems. Convenience Store logs in a central location for easy access. Configure Syslog During syslog configuration, you can opt to send Console events, Device events, or both. Any events generated by the AirWatch Console are sent to your SIEM tool according to the scheduler settings. Syslog can be configured for both onpremises and SaaS deployments. To configure syslog: 1. Navigate to Hub > Reports & Analytics > Events > Syslog. 2. On the General tab, configure the following syslog settings: Setting Syslog Integration Description Enable or disable syslog integration. Host Name Enter the URL for the SIEM tool in the Host Name field. Protocol Port Select the required protocol from available options to send the data. It is to be noted that support for TLS v1.1 is provided. Enter the port number to communicate with the SIEM tool in the Port field. 30

31 Chapter 4: Syslog Setting Syslog Facility Message Tag Message Content Description Select the facility level for the feature from the Syslog Facility menu. The syslog protocol defines the syslog facility. The widespread use and manipulation of the syslog protocol can clutter the meaning of the syslog facility. However, it can roughly suggest from what part of a system a message originated and it can help distinguish different classes of messages. Some administrators use the syslog facility in rules to route parts of messages to different log files. Enter a descriptive tag to identify events from the AirWatch Console in the Message Tag field. For example, "AirWatch". Enter the data to include in the transmission in the Message Content field. This is how the message data gets formatted when sent using syslog to your SIEM tool. Use lookup values to set the content. In case of Secure TCP, New line (CRLF) formatting using Enter, \n, \r does not work and gets automatically converted to tab, \t for secure TCP. 3. On the Advanced tab, configure the following settings: Setting Console Events Select Console Events to Send to Syslog Description Select whether to enable or disable the reporting of Console events. Visible if you enable Console Events. For each sub-heading, select the specific events that you want to trigger a message to syslog. Use Select All or Clear All to select or unselect all the events all at once. To select or unselect specific events, enable or disable the checkboxes. Note: On enabling the Console Events, by default, all events under all categories of console events are selected. Device Events Select Device Events to Send to Syslog Select whether to enable or disable the reporting of Device events. Visible if you enable Device Events. For each sub-heading, select the specific events that you want to trigger a message to syslog. Use Select All or Clear All to select or unselect all the events all at once. To select or unselect specific events, enable or disable the checkboxes. Note: On enabling the Device Events, by default, all events under all categories of device events are selected. 4. Select Save and use the Test Connection button to ensure successful communication between the AirWatch Console and the SIEM tool. 31

32 Chapter 5: AirWatch DataMart AirWatch DataMart Overview 33 DataMart Requirements 33 Install DataMart 34 DataMart Tables 38 DataMart Entity Relationship Diagram 44 32

33 Chapter 5: AirWatch DataMart AirWatch DataMart Overview AirWatch DataMart that enables scheduled automatic data exports from the AirWatch database for statistical analysis and reporting. To use the tool, load DataMart on the server hosting the AirWatch database or in a separate network location. Successful installation creates two SQL Server Agent jobs on the server. There are multiple options for data export. You can choose to export data in.csv format or as database tables. If data is exported in.csv format, you can choose to save exported data on the AirWatch database server or in a separate network location. If you select a separate network location, the network folder entered in the.csv path should be accessible by the SQL Server Agent s Log On as Windows Account. You use these account credentials to access the destination folder for CSV file output. If data is exported in database table format, you can access the DataMart exports by following the information in relevant pages. DataMart export is available for both on-premises and SaaS (dedicated) AirWatch deployments. Note: To locate the SQL Server Agent s Log On as Windows Account, open Services on the AirWatch database server and double-click the SQL Server Agent service. Select This Account and choose the Log On tab to locate the Log On as Windows Account. DataMart Requirements Before using DataMart, ensure your system meets the requirements. General Requirements Login credentials with both public and sysadmin server roles enabled in SQL Server. Database server requirements for the AirWatch DataMart are identical to the host server requirements for the AirWatch Console. No additional hardware or upgrades are necessary. Software Requirements Windows Server 2008 R2, 2012 (64-bit), and 2014 (64-bit) with the latest service packs and recommended updates from Microsoft ( Framework 3.5 & 4. A Windows post-installation update is required to update additional software components for.net Framework 4. Microsoft SQL Server 2012, 2014, or 2016 with Client Tools (SQL Management Studio, Reporting Services, Integration Services, SQL Server Agent, latest server packs). Important: For dedicated SaaS installations DataMart should only be installed one time. Subsequent clients are added to the DataMart database manually. 33

34 Chapter 5: AirWatch DataMart Install DataMart You need the AirWatch DataMart Installer to receive this feature. You can configure the AirWatch DataMart Installer to run an Extract, Transform, and Load (ETL) job daily to export data as a CSV file or as a cube (.cub) for your SQL Server Analysis Services (SSAS). For on-premises deployments, the DataMart is installed on your AirWatch database server according to settings you configure when you install the application. You can install AirWatch DataMart on the AirWatch database server or any server from which the AirWatch database is accessible. Note: Dedicated SaaS deployments receive a data mart in only.csv format and can access it in their specified folder from the AirWatch secure FTP location. If your company is interested in this feature, contact your AirWatch Account Services Manager. To run the AirWatch DataMart: 1. Run the DataMart installation executable file and select Next. 2. Read the End-User License Agreement, accept the terms to use the feature, and then select Next. 3. Select Change if desired, navigate to a destination folder where you want to place the installer log, and then choose Next. Note: If you export to a separate network location, the destination folder must be accessible to the SQL Agent service. 4. Ensure the database server to which you are installing DataMart is correct. Note: This is the AirWatch database and not the reporting database. 5. Select Browse and navigate to the AirWatch Console SQL instance if needed. 6. Select Windows authentication credentials of current user. 34

35 Chapter 5: AirWatch DataMart If you have enough rights to update the database before you continue with the installation, a warning message appears. 3. Select OK. You are directed to the Tenant DB Information screen. 4. Configure the source database for DataMart. 35

36 Chapter 5: AirWatch DataMart Tenant DB Server Enter the name of the SQL server hosting the AirWatch database. Tenant DB Name Enter the name of the AirWatch database. Tenant Name Enter the name of the tenant (used for reference in the DataMart database). Tenant Root LG Enter the root organization group ID of the tenant for which you are installing. a. On-premises installations normally enter 7 (Global). b. SaaS installations enter the root organization group ID (normally the ID of the organization group with the group type of customer). 5. Configure the following Publish Options for DataMart: Load Frequency Select Daily or Hourly as the frequency for publishing data. Report Option Select CSV or Tables as the format for the exported data. Browse to drop folder This option allows admins to browse to the folder that has the CSV files. On-premises installations should use this option. Map a drive This option allows admins to specify a drive path and drop folder. Dedicated SaaS installations should use this option. o o o Drive Letter Specify the letter of the drive to be mapped. Drive Path Specify the drive path. Do not specify the client folder in this path. Client Drop folder Specify the client drop folder. The folder name must not contain spaces.s 36

37 Chapter 5: AirWatch DataMart Browse to drop folder option Database Table to Database Server option Map a drive options 6. Select Install to begin installation. 7. Select Finish to exit the installation wizard. After the installation finishes, the process creates two SQL Server Agent Jobs that run daily at midnight or hourly. DataMart creates applicable exports in the specified folder. 37

38 Chapter 5: AirWatch DataMart DataMart Tables Access DataMart exports as database tables in AirWatch_DataMart_source on the database server housing the AirWatch database or as CSV files in the network location selected during installation. The following table highlights key table/.csv export results and associated columns within. DB Table/CSV File Data Columns ApplicationDevices Provides the identification number of devices, date, and time of first-time enrollment. ApplicationVersionKey TenancyKey LoadDate LoadHour DeviceID FirstSeen ApplicationDim ApplicationFact Provides application name and identifier. Provides details about device applications such as authorized applications to use and the number of applications installed and uninstalled. ApplicationKey Identifier Name ApplicationVersionKey TenancyKey LocationGroupKey CategoryKey LoadDate LoadHour DeviceTypeKey IsBlacklisted IsPublished InstalledDeviceCount RemovedDeviceCount AssignedCount ApplicationTypeKey 38

39 Chapter 5: AirWatch DataMart DB Table/CSV File Data Columns ApplicationVersion Displays the version of applications listed in the database and available to the device end users. ApplicationVersionKey ApplicationKey Version ApplicationTypeDim Provides application type and name. ApplicationTypeKey ApplicationTypeName CarrierDim Displays a list of carriers. TenancyKey CarrierKey Carrier DeviceDetails Displays device enrollment data and specifications of devices enrolled. Examples include the serial number, the model, and the MAC address. TenancyKey LoadDate LoadHour DeviceID Carrier OSKey CorpEmp LocationGroupKey Platform DeviceName EnrollmentUser SerialNumber DeviceIdentifier DeviceModel MACAddress IMEI_ESN PhoneNumber LastSeen 39

40 Chapter 5: AirWatch DataMart DB Table/CSV File Data Columns DeviceDetails (cont.) Displays device enrollment data and specifications of devices enrolled. Examples include serial number, model and MAC address. DeployedProfileCount IsMDMEnrolled EnrollmentDate AvailableSpace TotalSpace SpaceSampleTime GPSLongitude GPSLatitude GPSSampleTime WLANEnabled VoiceRoamingEnabled DataRoamingEnabled IsRoaming CellSampleTime BatteryLifePercent OnACPower PowerSampleTIme WLANSignalStrength SignalStrengthSampleTime TotalPhysicalMemory AvailablePhysicalMemory MemorySampleTime BackupBatteryLifePercent UserName EnrollmentUserKey AssetNumber 40

41 Chapter 5: AirWatch DataMart DB Table/CSV File Data Columns DeviceFact Provides device compliance status in addition to details about device activity. OSKey OwnershipKey LocationGroupKey TenancyKey LoadHour LoadDate IsCompliant IsCompromised Active24hrs Active30days DeviceCount DeviceTypeDim Provides device type and name. DeviceTypeKey PlatformName LocationGroupDim Provides details about the location group. LocationGroupKey TenancyKey LocationGroupID Name TypeName DefCountryCode DefCountryName RegionCode RegionName Status CustomerCode CultureCode CultureName CultureNativeName EffectiveStartDate EffectiveEndDate 41

42 Chapter 5: AirWatch DataMart DB Table/CSV File Data Columns LocationGroupFlat Displays details about the hierarchy, culture, language, and organization groups. TenancyKey ParentLocationGroupID ChildLocationGroupID ParentKey ChildKey LGlvl OSDim Provides details about the OS OSKey OSMajorVersion OSMinorVersion OSBuildNumber PlatformName OSName OwnershipDim EnrollmentUserDim Provides details about the device ownership type Provides details about the enrollment user. PicklistItemID Value Text SortOrder LabelKey Description TenancyKey LocationGroupKey EnrollmentUserKey UserName FirstName MiddleName LastName Address LastLoginDate DeviceCount 42

43 Chapter 5: AirWatch DataMart DB Table/CSV File Data Columns AdministratorDim PolicyFact Provides details about the Administrator. Provides the identification number of the devices as well as compliant status of the devices. TenancyKey LocationGroupKey AdministratorKey UserName FirstName MiddleName LastName Address LastLoginDate TenancyKey LocationGroupKey LoadDate PolicyKey DeviceID Compliant PolicyDim Provides details about the Policy. TenancyKey PolicyKey PolicyName PolicyDescription Platform 43

44 Chapter 5: AirWatch DataMart DataMart Entity Relationship Diagram 44

45 Chapter 5: AirWatch DataMart 45

46 Accessing Other Documents Accessing Other Documents While reading this documentation you may encounter references to documents that are not included here. The quickest and easiest way to find a particular document is to navigate to and search for the document you need. Each release-specific document has a link to its PDF copy on AirWatch Resources. Alternatively, you can navigate to AirWatch Resources on myairwatch (resources.air-watch.com) and search. When searching for documentation on Resources, be sure to select your AirWatch version. You can use the filters to sort by PDF file type and AirWatch v