AuditTrack for NetWare

Description

AuditTrack is a NetWare Loadable Module (NLM) that installs within minutes on any Novell 3.x or 4.x server. AuditTrack monitors activity at the server and provides complete auditing and reporting functionality that captures all server access and file manipulation activity. AuditTrack is designed to be implemented across an organization within minutes, without any changes to users’ workstations, access procedures, or usage patterns. There are no messy TSRs to install on workstations. Not only are network users unaffected by and unaware of its installation, they are unable to impede AuditTrack’s auditing capability.


AuditTrack is the simplest product of the bunch to install and run. The console component lets you filter, report and graph any event tracked by the AuditTrack NetWare Loadable Module (NLM), which runs on NetWare 3.X or 4.X.


When you first load the NLM, you must configure it, including setting the Master auditor password. This is supposed to keep unauthorized people from unloading the NLM, even if they gain access to the console. Of course, you can still use the server console to down the server and bring it back up without running AUTOEXEC.NCF, where the tracking NLM is loaded. The management console is also password protected.


Running the product is easy. AuditTrack report on server events such as file open, file run, file delete, user creation and trustee modification. It provide an interface for filtering and sorting events. It let you define audit sets - groups of events you want to watch. For example, you can report on just the user ''Kristin,'' or just on file attribute changes.


More difficult is deciphering the vast amount of data available in the reports. Remember how DOS searches for a program in the current directory first, then searches through the path until it has been found? Every time a user runs a program, AuditTrack reports ''invalid path or file name'' for each directory searched and then reports the run of the executable file when found. This produces an average of three extraneous error messages (current directory, local root, possibly local Windows and network search path) for every ''file run'' message.


There is a positive side to this. You can determine if your applications are being accessed in the most efficient manner and adjust your user menus and search paths accordingly. If you receive eight or nine ''file not found'' errors before every program execution, you should redesign the way your users are launching the applications.


AuditTrack keep track of every time you access or change screens inside of NetWare management utilities such as NWAdmin. For example, we used NWAdmin to verify that users could change their own passwords and AuditTrack reported the access, even though nothing changed. The plus side to this is that if someone is just sniffing around in advance of actually hacking, you'll notice, but we wish there were an option to report only changes.


Any tracked event can be turned into a report or a graph with a click of a button. AuditTrack lets you set up groups of tracked events as audit sets. An audit set can have one tracked event, such as file open, or several, such as all tracked directory services events.


AuditTrack can be configured to send broadcast alerts to a list of users, but more sophisticated alerts are unavailable without additional products.This product is not an enterprise solution because management is on a server-by-server basis.
Installation and Uninstallation:


"WebTrends and AuditTrack share a great deal of technology," explains e.g. Software's chief technical officer, Eli Shapira. "It made sense to combine the two high-end technologies and offer a complete solution for companies installing Novell-based Intranet and Extranet servers."


AuditTrack is currently installed on more than 7,000 Novell servers, and along with WebTrends, is used by major corporations and government institutions such as AT&T, Bank of America, Chemical Bank, Dow Corning, Federal Aviation Administration, Internal Revenue Service, McDonnell Douglas, Smith Kline Beecham, and the US Federal Reserve Bank. With thousands of users, WebTrends is the most popular Web traffic analysis product on the market. WebTrends real-time analysis and reporting can give up-to-the minute data on Web servers with log files greater than 4 Gbytes, up to 40 million hits a day.

Audit Track - Chemical Bank - Dow Corning

- required fields

Your Name Your E-Mail Rating Bad   Not Bad   Moderate   Almost Excellent   Excellent   Review

While LT Auditor+ v8.0 provides continuous, real-time Security Event Monitoring and Auditing to tell you WHO did WHAT, from WHERE and WHEN, LT Auditor+ Assessment for NetWare gives you a “snap shot” or “assessment” of your network.

Protector Plus 2000 Antivirus Software for NetWare is the ideal antivirus software to protect your server against threats by all types of malware like viruses, trojans and worms.

Norton AntiVirus for NetWare is the enterprise-wide solution for protecting shared files (DOS/Windows/Macintosh) across networks from known and unknown virus attacks.

Network Associates' award-winning NetShield provides an essential layer of anti-virus protection for both Novell NetWare and Windows NT servers.

Handy TCP socket utility for NetWare servers. Developed originally as a test tool for i-MailDS this has become a useful tool for diagnosing TCP links on NetWare servers