6.5 Common Tasks

The tasks that are common with similar steps for all the remote management audit events include:

6.5.1 Editing or Deleting Remote Management Audit Events

To edit or delete the enabled events, select and click on edit or delete on the same page. For example, to edit or delete the enabled abnormal termination detected audit event:

  1. Click Abnormal Termination Detected on the Event Configuration page under the AgentEvents tab.

  2. Click Edit to display the edit properties dialog box and make the required changes.

  3. Click OK.

6.5.2 Viewing Details - Generated Remote Management Audit Events

After enabling a remote management audit event on a device or zone, you can view details of the generated remote management audit events.

For example,

To view event details of the generated abnormal termination detected audit event on a device:

  1. In ZENworks Control Center, click Devices> Workstations.

  2. Click any device, then click the Audit tab.

  3. Click Agent Events, then click the plus sign to expand the tree view structure of Agent Events.

  4. Click the plus sign next to Remote Management to view the Authentication Failure audit event listed under Authentication, if enabled.

To view event details of the generated abnormal termination detected audit event on a zone:

  1. In ZENworks Control Center, click Audit and Messages> Audit > Events > Agent Events. In the Agent Events Summary, events are categorized as Critical, Major, or Informational based on severity.

  2. Click Agent Events, then click the plus sign to expand the tree view structure of Agent Events.

  3. Click the plus sign next to Remote Management to view the Authentication Success audit event listed under Authentication, if enabled. Click any device, click the Audit tab.

  4. Click Authentication Success. The Authentication Success events logged in that zone are displayed.

6.5.3 Verifying the Enabled Remote Management Audit Events

If for some reason the details of the enabled remote management audit event for a zone or a device are not displayed in ZENworks control center, you can verify if that remote management audit event is enabled on the device. For example, to verify if the abnormal termination detected audit event is enabled on the device:

  1. On the device, open the following file:

    ZENWORKS_HOME\conf\audit\events\daudit.remote.abnormal.termn.detect.xml

  2. Verify that the event is enabled (Enable = true). If it is not enabled, repeat the steps listed under Enabling an Abnormal Termination Detected Audit Event.