Product Information for etrust Audit Components 1.0 Introduction 1.1 etrust Audit Components 2.0 Policy Manager (Windows) 2.1 Components 2.2 System Requirements 3.0 Policy Manager (Solaris) 3.1 Components 3.2 System Requirements 4.0 Client (Windows) 4.1 Components 4.2 System Requirements 5.0 Client (AIX, HP-UX, Linux, Solaris, Tru64, UnixWare) 5.1 Components 5.2 System Requirements 6.0 Data Tools (Windows) 6.1 Components 6.2 System Requirements 7.0 Data Tools (AIX, HP-UX, Solaris) 7.1 Components 7.2 System Requirements 8.0 Contacting Customer Support 1.0 Introduction etrust Audit provides a highly flexible, multi-tiered architecture capable of supporting large numbers of clients, servers, and database stations that together serve as an enterprise-wide auditing hierarchy. Every computer in your network can potentially participate in the hierarchy as an audit event source, and any user in your network can potentially receive alerts, mail, and system status notifications from etrust Audit. The flexible architecture of etrust Audit makes a wide range of configuration choices available to you. You can implement etrust Audit on single machine, a small set of machines, or across your enterprise involving hundreds or thousands of machines. These more advanced configurations take advantage of the architectural elements of etrust Audit that are specifically designed to support hierarchical deployment. Using these hierarchies, you can route audit events from sources to collectors across all manner of boundaries, and store them in the etrust Audit event database for analysis and management.
1.1 etrust Audit Components There are four primary etrust Audit components: Policy Manager (includes Audit Administrator) Client Data Tools Reporter and Viewer The balance of this document provides descriptive, system requirement, and applicable platform information for each etrust Audit component. 2.0 Policy Manager (Windows) The etrust Audit Policy Manager component is available on Windows and Solaris platforms. 2.1 Components The following is a list of the subcomponents that make up the overall etrust Audit Policy Manager component: Policy Manager Policy Manager is a Web-based user interface that lets you centrally manage etrust Audit policies, audit nodes and mp files. Using the etrust Audit Policy Manager you can create, implement, and distribute your organization's etrust Audit policies and mp files. Distribution Server The etrust Audit Distribution Server interfaces with the etrust Audit Distribution Agent (on a client system) and coordinates delivery of etrust Audit policies. Audit Administrator The etrust Audit Administrator is a Web-based user interface for Audit management. Users will use COTS Web browsers such as Internet Explorer 6 SP1 to run the Audit Administrator and administer different aspects of Audit. The following subcomponents make up the etrust Audit Administrator: Configuration irecorder Administrator Post-Collection Utility Policy Template Manager
Policy Wizard Visualizer 2.2 System Requirements The following describes the supported operating systems and the minimum processor, memory, and disk space requirements for the Policy Manager. Operating System Requirements The following Windows operating systems are supported: Windows 2000 SP4 (x86) Windows 2003 SP1 (x86) Processor Requirements The following is the minimum processor required: Pentium 1 GHz Memory Requirements The following is the minimum memory required: 128 MB Disk Space Requirements The following is the minimum amount of disk space required: 300 MB etrust Audit Policy Manager Database The following is a list of the underlying databases that etrust Audit Policy Manager supports on Windows:
SQL Server 2000 SP4 SQL Server 2005 Note: A version of SQL Server is not included with this product. If you are using SQL Server as the underlying database requires that the SQL Server database product be properly licensed and previously installed. 3.0 Policy Manager (Solaris) The etrust Audit Policy Manager component is available on Windows and Solaris platforms. 3.1 Components The following is a list of the subcomponents that make up the overall etrust Audit Policy Manager component: Policy Manager Policy Manager is a Web-based user interface that lets you centrally manage etrust Audit policies, audit nodes and mp files. Using the etrust Audit Policy Manager you can create, implement, and distribute your organization's etrust Audit policies and mp files. Distribution Server The etrust Audit Distribution Server interfaces with the etrust Audit Distribution Agent (on a client system) and coordinates delivery of etrust Audit policies. Audit Administrator The etrust Audit Administrator is a Web-based user interface for Audit management. Users will use COTS Web browsers such as Internet Explorer 6 SP1 to run the Audit Administrator and administer different aspects of Audit. The following subcomponents make up the etrust Audit Administrator: Configuration irecorder Administrator Policy Template Manager Policy Wizard
3.2 System Requirements The following describes the supported operating systems and the minimum processor, memory, and disk space requirements for the Policy Manager. Operating System Requirements The following Solaris operating system is supported: Solaris 10 (SPARC) Processor Requirements The following is the minimum processor required: 1 GHz Memory Requirements The following is the minimum memory required: 512 MB Disk Space Requirements The following is the minimum amount of disk space required: 100 MB etrust Audit Policy Manager Database The following is a list of the underlying databases that etrust Audit Policy Manager supports on Solaris 10: Oracle 10g (10.2.0.2 or later) Note: A version of Oracle is not included with this product. If you are using Oracle as the underlying database requires that the Oracle database product be properly licensed and previously installed.
4.0 Client (Windows) The etrust Audit Client component is made up of several subcomponents that provide services. The services collect and forward audit event data that result in the generation of actions and alerts. 4.1 Components The following is a list of the subcomponents that make up the overall etrust Audit Client component on Windows platforms: etrust Audit NT Event Log irecorder The etrust Audit NT Event Log irecorder taps into the event data sent to the Windows Event Log. Any events sent to this standard system logging facility can be automatically harvested by etrust Audit for processing. etrust Audit Portmapper The etrust Audit Portmapper manages the logical communications channels required to provide a standard way for an etrust Audit client component to access RPC services that it might require. etrust Audit Redirector The etrust Audit Director can tap into local etrust Audit logs, (created by an etrust Audit Recorder service), or logs created by etrust Access Control running on Windows systems. The etrust Audit Redirector automatically redirects that audit data to an etrust Audit Router component on the same or an alternative machine. etrust Audit Log Router The etrust Audit Log Router acts as a filtered message forwarder. It analyzes configuration information that you provide (stored as.cfg files found under the \etrust Audit\cfg directory), and then uses that configuration information to examine audit events that are sent to its attention. Based on the configuration instructions you provide, the etrust Audit Log Router identify those records that should be: Filtered out Forwarded to the etrust Audit Action Manager Forwarded to other etrust Audit components etrust Audit Action Manager The etrust Audit Action manager processes events sent to it by the etrust Audit Log Router. You can direct the etrust Audit Action Manager to automatically perform a wide range of actions in response to receiving specific audit events. The etrust Audit Action Manager gets its instructions from the Policy Manager. etrust Audit Distribution Agent
The etrust Audit Distribution agent is receives policies from the etrust Audit Policy Manager, and places these policies into effect. The policies are sent to the etrust Audit Distribution Agent by the etrust Audit Distribution Server. 4.2 System Requirements The following describes the supported operating systems, and the minimum processor, memory, and disk space requirements for the etrust Audit Client component on Windows platforms. Operating System Requirements The following Windows operating systems are supported: Windows 2000 SP4 (x86) Windows XP SP2 (x86) Windows 2003 SP1 (x86) Processor Requirements The following is the minimum processor required: Pentium 1 GHz Memory Requirements The following is the minimum memory required: 128 MB Disk Space Requirements The following is the minimum amount of disk space required: 100 MB
5.0 Client (AIX, HP-UX, Linux, Solaris, Tru64, UnixWare) The etrust Audit Client component is made up of several subcomponents that provide services. The services collect and forward audit event data that result in the generation of actions and alerts. 5.1 Components The following is a list of the subcomponents that make up the overall etrust Audit Client component on AIX, HP-UX, Linux, Solaris, Tru64, and UnixWare platforms: etrust Audit Recorder The etrust Audit Recorder taps into the event data sent to the log files specified in syslog. Any events sent to these log files can be automatically harvested by etrust Audit for processing. etrust Audit Log Router The etrust Audit Log Router acts as a filtered message forwarder. It analyzes configuration information that you provide (stored as.cfg files found under the etrust Audit directory), and then uses that configuration information to examine audit events that are sent to its attention. Based on the configuration instructions you provide, the etrust Audit Log Router identify those records that should be: Filtered out Forwarded to the etrust Audit Action Manager Forwarded to other etrust Audit components etrust Audit Action Manager The etrust Audit Action Manager processes events sent to it by the etrust Audit Log Router. You can direct the etrust Audit Action Manager to automatically perform a wide range of actions in response to receiving specific audit events. The etrust Audit Action Manager gets its instructions from the etrust Audit Policy Manager. etrust Audit Distribution Agent The etrust Audit Distribution agent is receives policies from the etrust Audit Policy Manager, and places these policies into effect. The policies are sent to the etrust Audit Distribution Agent by the etrust Audit Distribution Server. 5.2 System Requirements The following describes the supported operating systems, and the minimum processor, memory, and disk space requirements for the etrust Audit Client component on AIX, HP-UX, Linux, Solaris, Tru64, and UnixWare platforms.
Operating System Requirements AIX The following AIX operating systems are supported: HP-UX AIX 5.2 (POWER) AIX 5.3 (POWER) The following HP-UX operating systems are supported: Linux HP-UX 11.11 (PA-RISC) HP-UX 11iv2 (11.23) (PA-RISC) HP-UX 11iv2 (11.23) (Intel Itanium IA-64) Note: etrust Audit Client along with its components automatically installs the irouter (packaged igateway 4.0). You must install the following patches on HP-UX 11.11 before installing the igateway: BUNDLE 11.i GOLDAPPS 11i HWEnable 11i Patch PHSS_26263 on HP11.11 The following Linux operating systems are supported: RedHat Linux EL 3.0 (x86) RedHat Linux EL 4.0 (x86) RedHat Linux EL 4.0 U3 (AMD64/EM64T) SuSe Linux ES 8 (x86) SuSe Linux ES 9 (x86) SuSe Linux ES 8 (OS/390-31 bit) SuSe Linux ES 9 (OS/390-31 bit) SuSe Linux ES 8 (z/os - 64 bit) SuSe Linux ES 9 (z/os - 64 bit)
Solaris The following Solaris operating systems are supported: Solaris 8 (SPARC) Solaris 9 (SPARC) Solaris 10 (SPARC) Note: etrust Audit Client along with its components automatically installs the irouter (packaged igateway 4.0). You must install the following patches on Solaris (SPARC) 8 before installing the igateway: Tru64 Patches 108434 and 109147, or latest Solaris Patch Cluster (downloadable from sunsolve.sun.com) The following Tru64 operating systems are supported: 5.1a DEC (Alpha) 5.1b DEC (Alpha) UnixWare The following UnixWare operating systems are supported: UnixWare 7.1 UnixWare 7.1.3 VMWare ESX Server The following VMWare ESX Server operating system is supported: VMWare ESX Server 3.0 Note: Use the package located on Linux folder to install etrust Audit Client on VMWare ESX Processor Requirements The following is the minimum processor required: 1 GHz Memory Requirements The following is the minimum memory required for AIX, HP-UX, Linux, Solaris, Tru64,
UnixWare, and VMWare ESX Server systems: 512 MB Disk Space Requirements The following is the minimum amount of disk space required for AIX, HP-UX, Linux, Solaris, Tru64, UnixWare, and VMWare ESX Server systems: 100 MB 6.0 Data Tools (Windows) The etrust Audit Data Tools on Windows platforms consist of the etrust Audit Collector database and supporting utilities and services. etrust Audit stores all the audit event data on the Collector database. 6.1 Components The following is a list of the subcomponents that make up the overall etrust Audit Data Tools component on Windows platforms. etrust Audit Collector Database Reporter and Viewer Security Monitor Health Monitor Data Tools GUIs The following describes the etrust Audit Data Tools components: etrust Audit Viewer The etrust Audit Viewer displays, sorts, and filters audit events fetched from the central etrust Audit central event databases. The etrust Audit Viewer supports the use of filters to let you focus on the events of interest to you. You can also save your own customized filters for future use. etrust Audit Reporter The etrust Audit Reporter lets you view, create, and schedule detailed, graphic reports from information extracted from the etrust Audit event database.
etrust Audit Security Monitor The etrust Audit Security Monitor lets you monitor the following can: Specific events sent from a variety of different etrust Audit recorders that have been designated important enough to bring to the attention of the etrust Audit Security Monitor. etrust Audit status and "self help" events. for example, you can monitor events related to the status of etrust Audit components, such as whether the etrust Audit Action Manager started. etrust Audit Health Monitor The Health Monitor allows you to view your etrust Audit Data Tools event sources and provides status information based on the rate of events received from each of the event sources, and an Action Summary so that you can track changes to your alert configurations. etrust Audit Collector Database The etrust Audit Collector Database is where etrust Audit stores all of the audit event data directed to it. etrust Audit supports the following underlying databases on Windows platforms: Microsoft SQL Server 2000 SP4 Microsoft SQL Server 2005 Oracle 9i Oracle 10g Note: Using Microsoft SQL Server 2000, Microsoft SQL Server 2005, or Oracle as the underlying database requires that these databases be properly licensed and previously installed. 6.2 System Requirements The following describes the supported operating systems, and the minimum processor, memory, and disk space requirements for the etrust Audit Data Tools component on Windows platforms.
Operating System Requirements The following Windows operating systems are supported: Windows 2000 SP4 (x86) Windows 2003 SP1 (x86) Processor Requirements The following is the minimum processor required: Pentium 1 GHz Note: For database processor requirements, given the high demands typically placed on the machine serving as the etrust Audit Collector database, we recommend that this machine is dedicated to this task. Memory Requirements The following is the minimum memory required: 256 MB Disk Space Requirements The following is the minimum amount of disk space required: 1000 MB Additional disk space is required for storing the etrust Audit records in the Collector database itself 7.0 Data Tools (AIX, HP-UX, Solaris) The etrust Audit Data Tools on the following UNIX platforms consist of the etrust Audit Collector database and supporting utilities and services. etrust Audit stores all the audit event data on the Collector database. AIX HP-UX Solaris
7.1 Components The following is a list of the subcomponents that make up the overall etrust Audit Data Tools component on UNIX platforms: etrust Audit Collector Database Reporter and Viewer (only on Solaris) Health Monitor Data Tools GUIs The following describes the etrust Audit Data Tools components: etrust Audit Viewer The etrust Audit Viewer displays, sorts, and filters audit events fetched from the central etrust Audit central event databases. The etrust Audit Viewer supports the use of filters to let you focus on the events of interest to you. You can also save your own customized filters for future use. etrust Audit Reporter The etrust Audit Reporter lets you view, create, and schedule detailed, graphic reports from information extracted from the etrust Audit event database. etrust Audit Health Monitor The Health Monitor allows you to view your etrust Audit Data Tools event sources and provides status information based on the rate of events received from each of the event sources, and an Action Summary so that you can track changes to your alert configurations. Note: Reporter and Viewer using IBM WebSphere Application Server 6.0 or Tomcat 5.0.28 are supported only on Solaris. etrust Audit Collector Database The following is a list of the underlying databases that etrust Audit supports on AIX, HP-UX, and Solaris platforms: Oracle 9i Oracle 10g Note: A version of Oracle is not included with this product. If you are using Oracle as the
underlying database requires that the Oracle database product be properly licensed and previously installed. Only Oracle 9i is supported on Solaris 8. 7.2 System Requirements The following describes the supported operating systems, and the minimum processor, memory, disk space, and database requirements for the etrust Audit Data Tools component on AIX, HP-UX, and Solaris platforms. Operating System Requirements AIX The following AIX operating systems are supported: HP-UX AIX 5.2 (POWER) AIX 5.3 (POWER) The following HP-UX operating systems are supported: HP-UX 11.11 (PA-RISC) HP-UX 11iv2 (11.23) (PA-RISC) HP-UX 11iv2 (11.23) (Intel Itanium IA-64) Note: Health Monitor is supported on PA-RISC only. Install PHSS_26263 on HP-UX 11.11 before deploying Health Monitor. Solaris The following Solaris operating systems are supported: Solaris 8 (SPARC) Solaris 9 (SPARC) Solaris 10 (SPARC) Note: On Solaris 8 install Solaris Patches 108434 and 109147, or Patch Cluster before deploying Health Monitor.
Processor Requirements The following is the minimum processor required: 1 GHz Memory Requirements The following is the minimum memory requirement for AIX, HP-UX, and Solaris systems: 1000 MB Disk Space Requirements The following is the minimum amount of disk space required for AIX, HP-UX, and Solaris systems: 1000 MB Additional disk space is required for storing the etrust Audit records in the Collector database itself. Database Requirements When installing the etrust Audit Collector database, a separately licensed version of Oracle must already be installed and properly configured to run. You or your Oracle DBA must perform the following pre-installation tasks before attempting to install the Data Tools for use with an Oracle database. Prepare the Oracle Database Environment The following administrative tasks must be performed by an Oracle database administrator (DBA) before you begin installing the etrust Audit Collector database: Create Oracle Tablespace Define Oracle User ID with DBA Privileges Collect Oracle Information Create Oracle Tablespace Create an Oracle tablespace for the etrust Audit Collector to use as a database to store events. The following sample illustrates the syntax for creating the required tablespace using the Oracle tools:
create tablespace ca_audit datafile '/oracle/oradata/yyy/ca_audit.dbf' size 100M; where: create tablespace Is the action you want the Oracle tools to perform. ca_audit Is the name of the Oracle database table being created. The etrust Audit Data Collector requires that you create the tablespace with this name. datafile '/oracle/oradata/yyy/ca_audit.dbf' Is the name to be assigned to the file that will contain the tablespace being created. Substitute for '/oracle/oradata/yyy/ca_audit.dbf' with whatever filename your Oracle DBA determines. size 100M Is the initial size of the tablespace, 100 megabytes. The 100 MB size provided in this example is a reasonable value to start with for most installations, but depending on the amount of audit data you will be collecting, you may want to increase or decrease this size. Define Oracle User ID with DBA Privileges Define a user ID Oracle DBA privileges that will be used the etrust Audit Collector to write to the tablespace. The tablespace just defined for use by the etrust Audit Collector must be the default tablespace for this user. The following sample illustrates the syntax for creating the requisite Oracle User ID with DBA privileges. create user AuditDBA identified by AuditDBA default tablespace ca_audit temporary tablespace temp; where: create user Is the action you want the Oracle tools to perform. AuditDBA This is the user ID to be created. You can substitute for AuditDBA as you deem appropriate, but this is the user ID that must be specified when asked for by the installation process of the etrust Audit Data Tools. default tablespace ca_audit Specifies that this user's default tablespace is ca_audit tablespace. The user ID must have this tablespace defined as its default tablespace. temporary tablespace temp;
Specifies that this user's temporary (work) tablespace is the temp table. Substitute for temp with whatever tablespace your Oracle DBA indicates should be used for temp. Collect Oracle Information To complete installation of the etrust Audit Collector Database, have the following information available: Oracle Home path; that is, where the Oracle client software is installed on this machine Oracle SID, if the Oracle database is running on this machine Oracle service name, if the Oracle database is running on a remote machine. Username and password of an Oracle database administrator that has the Oracle tablespace that you earlier created for use by the etrust Audit Collector database, defined as that user's default workspace. Note: If you do not have the information above, check with your Oracle database administrator. Define a user ID Oracle DBA privileges that will be used the etrust Audit Collector to write to the tablespace. The tablespace just defined for use by the etrust Audit Collector must be the default tablespace for this user. 8.0 Contacting Customer Support For online technical assistance and a complete list of locations and telephone numbers, contact Customer Support at http://ca.com/supportconnect. Customer Support is available 24 hours a day, 7 days a week. For telephone assistance, call: U.S. and Canada 1-800-645-3042 International (1) 631-342-4683 2007 Computer Associates International, Inc. All rights reserved.