Auditor Help: Daily Change Reports - Latest Data

This exercise explains how to view the most recent Change Reports, but also save disk space by generating the change report "in place"; essentially overwriting the previous report. (The previous report can still be generated if it is needed.) If the customer is using Change Reports to detect any and all changes in their environment (especially unplanned or unauthorized), the ideal situation would be to use the freshest data every time automatically. The following instructions use the scheduling feature to collect new data, overwrite the last data set, and generate a change report on that new data (daily, weekly, etc.).

Step 1. - Turn off the wizard.

  1. Run Auditor.
  2. Choose File... Settings....
  3. On the Preferences tab, disable the Run wizard to generate new reports option.

Step 2. - Set up a selection set containing the systems to include in the scheduled change report

  1. Choose Edit... Selection Sets...
  2. Right-click on the Selection Files header and choose New... Selection Set... Autodiscovery.
  3. Proceed through the dialog boxes, selecting what to report.
  4. Rename the selection set by highlighting the new_file.sel on the left and changing the name to reflect what is in the selection set (i.e. all_servers.sel - include the extension!).
  5. Close the selection set editor.

Step 3. - Set up a reference data set

  1. Click on Reports... Data Collection Only....
  2. In the Save Data To field, type in "reference."
  3. Use the drop-down menu to choose the above created selection set.
  4. Click OK and wait for the software to complete the data collection.

Step 4. - Set up the software to overwrite the reference data set each week.

  1. Choose on File... Settings... and select the Preferences tab.
  2. Enable the checkbox for Overwrite existing datasets and reports on name conflicts
  3. Click OK.

Step 5. - Set up the change report to run on a scheduled basis

  1. Click on the Scheduled Tasks tab.
  2. Click the New button.
  3. Name the task (i.e. Change Report, all servers).
  4. Use the Report Type drop-down menu to select Configuration Change Report.
  5. In the Change Report dialog, choose the data set you named "reference" as the reference data set.
  6. Gathering a new dataset, use the selection set drop-down menu to choose the above created selection set.
  7. Click Ok and set up the scheduled job through the Windows Task Scheduler to run as often as needed (daily, weekly, monthly).

Step 6. - Set a data set collection to overwrite the reference data set

  1. Click Tools... Schedule Tasks....
  2. Click the New button.
  3. Name the task (i.e. Reference Dataset, all servers).
  4. Use the Report Type drop-down menu to select Data Collection Only.
  5. Click Next >.
  6. Type "reference" in the Save Data To field.
  7. Use the drop-down list to choose the selection set created above.
  8. Click OK.
  9. Set the scheduled job throughWindows Task Scheduler to take place on the same day as the scheduled change report, but to happen AFTER the scheduled change report runs (i.e. change report at 12:00AM, data set collection at 5AM).