2.5

Table Of Contents
VMware, Inc. 81
Appendix: Database Schema and Audit Event Log Data
Querying the Audit Event Log Data
YoucanusetheACEServerComponenttocreateanaudittrailforalltransactionsthat
theserverperforms.Youcanusethissystemtotrackusage,securitybreaches,policy
errors,performance,andsoon.
TheACEServerComponentEventLogginginfrastructureisflexibleenoughtoprovide
detailedloggingwhennecessary,
withoutoverwhelmingthesystembyslowing
performance.
Theeventloggingmechanismcapturesenoughinformationtoanswerthefollowing
questions:
Whoactivatedaninstance?
Whenwasaninstanceactivated?
Whorevokedaninstance?
Whoturnedoffcopyprotectionpolicy?
Whatchangestopolicyweremadeonaparticulardate?
Whoisfailingtoauthenticate?
Themechanismdoesnotnecessarilyanswerthesequestionsdirectly,butprovides
enoughdatasothatanadministratorcanvieweventlogsandfindanswers.Thedata
beingloggedmeetsthefollowingrequirements:
Providesdetailsofeachtransactionserved.
Centralizesthegatheringofev entlogdatawhenmultipleserversareused.
Providesameansforadministratorstoselectwhichtypeoftransactionsare
logged.
Canbeconfiguredtoprovidemoreorfewerlogswhennecessary.
Someofthisaudittrailisalreadyvisiblethroughotherfeaturesoftheproduct.For
example,theinstanceviewerdisplaysthedateofthelastpolicygetoperation,orthe
expirationdate,andsoon.Theeventloggingmechanismcan
answermoredifficult
questions,suchaswhichadministratormadewhichpolicychangesandwhich
administratordeletedanACEinstance.