Setup and Initial Configuration

The initial setup and configuration of Ecora Auditor Professional are one of the most important steps in the software deployment since it allows the ability to fully customize all settings, report configuration, the output formats for all reports, location where all or part of the documentation is saved, whether or not to compress local data, and much more. All of the necessary steps are outlined bellow with the corresponding screen shots. For further information and reading, please consult also the sections Advanced Topics and Tips and Tricks of this manual.

Contents 1 Global Settings 1.1 Preparer 1.2 Preferences 1.3 Output Formats 1.4 Database 1.5 Logging 1.6 Alerting 1.7 Debugging 1.8 Configuration 1.9 Policies 2 Modules Management

Global Settings

Preparer

1. Choose File, then Settings from the main menu.

2. Click on the Preparer tab.

3. Fill in the desired preparer's name, email address, and organization. (This is required information; it will be used in the header information found in each report.)

4. Indicate whether to be prompted for preparer settings every time or always apply the settings without prompting. This feature would be useful in environment where multiple customers prepare reports and would like to differentiate those reports.

5. Enter your Ecora website login credentials to allow software upgrades and licensing.

6. If a proxy server or non-standard port is used to access the Internet, click on the Proxy Settings button. Enter the corresponding proxy server IP address, port, and valid proxy login credentials.

7. To change the default image on reports, click the Logo and locate the image file to be used. (The logo should have a maximum height of 60 pixels. The width can vary, depending on the size of IE window, however the maximum length allowed is 1000 pixels.)

Preferences

1. Click on the Preferences tab.

2. Activate the checkbox if you want the software to Remember Passwords used to access systems to document.

Note: Saved passwords are encrypted. If this option is disabled (grayed out), the Ecora software you are using does not save passwords to disk. (Blowfish-128 encryption)

3. Activate the checkbox if you want the software to Prompt for saving selections when collecting data, which allows you to save each set of systems for scheduling or later use.

4. Activate the checkbox Save credential changes in selection sets without notification, is designed to be used in the Cisco, Oracle and Unix modules only. Passwords are saved in Selection Sets only in these modules.

5. Accept or change the Number of Threads to use during data collection (more threads will allow much faster collections, but will consume more network bandwidth). The default number of threads is 10.

Note: This option is only enabled when choosing Preferences from the Windows module. Furthermore, it can be utilized only when collecting in Parallel mode (for more information on Serial and Parallel collection modes, please refer to the Collections section of this wiki)

6. Verify or change the Default Naming Convention for data and report folder.

7. Accept the default or use the Browse... button to select your Default Storage Location directory, in which to save your collected data and reports.

8. Activate the corresponding checkbox if you want the software to Overwrite existing data sets and reports on name conflicts. This options is most commonly used for creating change reports on a scheduled basis.

9. Activate the corresponding checkbox if you want the software to Show time estimate before collection. Based on various performance tests, a time estimate can be calculated for the report or collection you are attempting. This allows you to decide to proceed or schedule for later. Please note that as with any estimate based on a performance test, actual results may vary significantly depending on the hardware and software parameters of the machine running Auditor Professional, the remote machines, SQL server instance, etc.

10. Activate the corresponding checkbox if you want the software to Automatically check for software updates on Ecora's website each time Auditor Professional is started.

11. Activate the corresponding checkbox if you want the software to Enable Edit SQL feature for Fact-Finding reports to allow direct editing of the SQL queries that comprise FFR report definitions. This is an advanced feature, that will allow the user to modify the SQL queries directly, however once used reverting to the regular table mode for the corresponding report is impossible. For more information, please refer to Fact Finding Reports section of this wiki.

12. If desired, in the Security area, enter the login of the account that will be allowed to lock and unlock Auditor Professional console.

Output Formats

1. Click on the Output Formats tab.

2. In the 'Data Collection Mode, select One system per dataset (Serial Mode, does not utilize multi threading) or Multiple systems per dataset (Parallel Mode, utilizes multi threading) and activate the checkbox if you want to always be prompted for collection mode (Recommended). Parallel Mode creates a single report with sections / nodes for each system reported (as in part versions). Serial Mode creates a separate data set and report for each system and an index.html file that serves as an index for the system reports.

3. Enable the desired default report format: PDF and/or HTML.

4. The desired default configuration report format is Full, however it can be changed to any of the canned configuration report formats.

5. Choosing Advanced button will allow changing the default report style. The built-in default style itself cannot be changed, therefore first a new style needs to be created by selecting the New button, then giving the new style a name, e.g. "New Style". The new style can be renamed or deleted by selecting it, and then choosing the corresponding buttons. Once the new style appears in the left pane, it can be selected and edited by choosing the Edit button. It will open a menu allowing fully customizable report style. In the example bellow, the font in the body of the report has been set as 12 points Arial, in red color on white background and italic. Auditor Professional allows full customization of the report style per customer specifications.

6. Enabled Data Outputs allows the configuration of coma (or tab) separated Fact Finding Reports, as well as Excel compatible (*.xls) Fact Finding Reports. If tab separated CSV format is selected, the file extention for that report can be changed to *.csv or *.txt. Furthermore, a different directory for the CSV and XLS formatted reports can be selected, for example in scenarios where these reports are fed into an analysis tool that parses them.

Database

1. Click on the Database tab.

2. Activate the checkbox if you want to enable the data output Enable Configuration Database. This writes configuration data into the relational database you select.

3. Auditor Professional supports both Microsoft SQL Server and Oracle Database backends that need to be selected by ticking the corresponding checkbox.

4. Select the configuration database by selecting the Manage Data Sources button in the Configuration Database pane, and then select if an existing database source will be used (requires a pre-installed instance of Microsoft SQL server or Oracle Database) or if download and install of MSDE is preferred. The second option only appears if Microsoft SQL Server has been selected in step 3.

5. On the Server tab, enter a server instance or select one form the drop-down list. This is the server where collected data will be stored. Click the Discover Servers button to search the network for available servers. Servers found are added to the drop-down list automatically.

6. Click the corresponding button to use either Windows or SQL authentication methods. If Windows authentication method is selected, then the Windows user should be assigned serveradmin role on the SQL instance. If you chose SQL authentication, enter a login and password.

7. On the Database tab, tick the corresponding checkbox to choose whether to create a new database or use an existing database. If you choose to create a new database, enter a database name and path to the data directory (or use the Browse... button to locate a data directory).

8. If you choose to use an existing database, select a database from the drop-down list.

9. Alternatively, click the Advanced... button to use Microsoft's ODBC Data Source Administrator.

Logging

1. Click on the Logging tab.

2. Select the log for which you'd like to change settings from the drop-down list. There are log files for the main application Auditor Log, the service associated with alerts Monitor Log, the task scheduler Scheduler Service Log, the database Archiving Log, and the host Auto Importing Log, as well as Service Logs.

3. Select the logging level from the drop-down list (Standard Logging, Log Errors, Log Errors and Information, Log All Information, and Debugging Mode).

4. Enable the checkbox for warning on startup if you wish to be notified when the log level is set above standard. If the level has been raised for debugging, this reminder will prompt you to lower the level again so the files do not get as large. It is recommended to keep this box checked.

Tip: Leaving the logging level to Debug may increase the size of files to 100's of GB, therefore logging level should be decreased as soon as the issue has been investigated and resolved.

5. On the General tab, you can see the path, size, and age of the selected log file and/or Clear Log to reset the log file to empty.

6. In the Log Size area, set the maximum size you wish to allow log files to reach using the up/down arrows. Each maximum size must be set for each of the log types. Please note that the defaults are set high and you might want to lower the max size.

7. Select the preferred action when logs reach maximum size: overwrite as needed, overwrite older than N days (and enter the number of days), or manual clearing.

8. Select Restore Defaults if you wish to return all log settings to their status as shipped with the software.

9. Click the Filter tab, (also accessible via Tools --> Filter).

10. Choose (or verify) which of the logs is active to filter from the drop-down list in the top of the dialog box.

11. Click the checkbox for each type of event you wish to include in the log.

12. Choose a category from the drop-down list. These options vary based on the log selected; for example, the Auditor log categories include data or report failed or succeeded, whereas the Archiving log choices are the archive databases you've defined.

13. Enter Message Text to be searched for in the logs.

14. Enter the Process IDs you wish to search for in the logs (by Windows Event Log event codes).

15. Enter the Thread IDs you wish to search for in logs.

16. Use the From: and To: fields select all events from first to last or specify a date and time range.

17. Click in the Reverse Order checkbox if you wish to see the event listed descending from most recent to oldest.

18. Click Restore Defaults if you wish to return all log settings to their status as shipped with the software.

19. Click View Log to open the selected log in a separate window.

Alerting

1. Click on the Alerting tab.

2. In the Alerting area, click in the Enable checkbox to enable Alerts and Triggers. Alerts and Triggers are discussed in more detail in the Automation of Auditor Professional: Scheduling Tasks, Alerts and Triggers section of this wiki.

Debugging

1. Click on the Debugging tab. This debugging tool is mainly used for abnormal shutdowns of Auditor Professional.

2. Click the Enable debug information reporting checkbox to allow troubleshooting files to be created and sent to Ecora Technical Support.

3. Click the Enable basic debug information reporting checkbox to allow troubleshooting files to be created and sent to Ecora Technical Support.

4. If you enable basic debugging, enter a file size limit in KB.

5. Click in the Do not ask user when sending debug information checkbox if you wish to send the debug files without user notification and ability to cancel.

6. Click the SMTP Settings button to configure automatic file transfer.

7. Enter the name of the desired SMTP server, the port to be used, and enable the checkbox is SSL is required. If SMTP authentication is required, enable the checkbox, enter credentials, and, if appropriate, enable the Login with secure password checkbox.

8. Click the Enable extended debug information reporting checkbox to allow troubleshooting files to be created and sent to Ecora Technical Support.

9. If you enable extended debugging, enter a file size limit in MB.

10. Click the Do not ask user when sending debug information checkbox if you wish to send the files without user notification and ability to cancel.

11. Click the SMTP Settings button to configure automatic file transfer.

12. Enter the name of your SMTP server, the port to be used, and enable the checkbox is SSL is required. If SMTP authentication is required, enable the checkbox, enter credentials, and, if appropriate, enable the Login with secure password checkbox.

Configuration

1. Click the Configuration tab

2. All configuration information is listed in the window

Policies

1. Click the Policies tab. After Executive Dashboard (inCOMAND) is installed, you can change the threshold settings for Not Compliant/Marginal/Compliant. If one wishes not to have a marginal setting, make Compliant and Not Compliant setting different by 1. If Executive Dashboard is not being used, check the Hide main console policies tab. This will hide the tab while viewing Auditor.

2. Clicking on Built-in Policies will reload all canned policies.

Modules Management

Ecora Auditor Professional offers the convenience of all reportable platforms in one interface. Each operating system, device, application, or database type that can be reported with Ecora software is a "module" that extends your control over your infrastructure. The module selector in the main interface allows choosing which module is active and can be used to collect and report. Data from all modules are written to the configuration database and can be queried in cross-platform combination through Fact-Finding Reports. Each module is purchased, licensed, and updated separately.

To upgrade Auditor Professional or any of the components:

1. Run Auditor Professional.

2. Choose Tools --> Updates.

3. In the dialog that appears, look for any modules that display an Update Available button.

4. If one is available for a licensed module or component, and you want to upgrade, tick the box next to Update Available status.

5. The installation of the selected updates will now begin

6. To update or install a new module, select Tools-->Manage Modules...

7. From here, you can either Activate a new module, by ticking the Active checkbox, or check for updates by pressing the Check for Updates button (will have the same effect as described in 2. above)