3.4 Installing the ACDI Monitor

The ACDI Monitor stores processed data in third-party drivers. To monitor a driver, you need to include the ACDI Driver Monitor package in it. This section describes how to install and configure the ACDI Driver Monitor package in Designer.

Step 1: Importing the packages to Designer

  1. Launch Designer.

  2. Open the project, then right-click the Package Catalog and select Import package.

  3. Click Browse and locate the Designer folder under the AuditDriver folder in the extracted acdi_v24.2.zip. Select the following three packages:

    • SPACDMCS_<version>.jar

    • SPACDMON_<version>.jar

    • SPACDMUDA_<version>.jar

  4. Click Open > OK.

Step 2: Adding packages to the driver for monitoring

  1. Right-click the driver and select Driver > Properties.

  2. Select Packages.

  3. In the Select Packages window, select the ACDI Monitor option and click OK.

  4. Click Apply.

Step 3: Installing and Configuring the ACDI Monitor

  1. To install the ACDI Monitor, select the Install operation in the Package Management window.

  2. Choose Manual for the Auditing Mode.

  3. Specify the values for the parameters of the ACDI monitor.

    Driver alias Name for Audit

    Specify the driver’s name. Search for this name in ACDI to view data from this driver. For example, ActiveDirectory1.

    Operation Types to Audit (regex)

    Specify the events you want to display in ACDI.

    Status

    Specify the status level for the events.

  4. Click Next.

  5. Click Finish > Apply.

Step 4: Sending data to OpenSearch

To specify the type for transmitting from the driver to ACDI’s OpenSearch:

  1. In the Modeler, right-click the driver set and select Properties.

  2. Navigate to GCVs.

  3. In the ACDI Monitor > common settings, select one of the following modes for data transmission:

    • Put to ACDI Driver Cache

      The driver DN you define in the ACDI Driver parameter will process all events.

    • Send directly to OpenSearch and/or Logstash

      Specify the path to your OpenSearch, the type of file, the user with OpenSearch credentials, and the path to the KeyStore with the certificate and its password. These parameters are similar to those defined in the ACDI driver for OpenSearch.

    • Send to ES/LS, On timeout put it to the ACD Driver Cache

      Sends data to the OpenSearch and store in the ACD Driver Cache when a timeout occurs.

  4. Click OK.

  5. Click Live > Driver Configuration > Deploy Attributes.

  6. Click to restart the driver.

Checking Data on the ACDI Interface

  • Using the NetIQ Driver Dashboard

    NOTE:This dashboard is only available in the Advanced version or Trial mode.

    You can audit and monitor all events processed by the driver on the NetIQ Driver Dashboard, which is the default dashboard of ACDI. You must modify this dashboard according to the name set in the appropriate driver. For example, if you set the driver name to ActiveDirectory1 for the ACDI Monitor, this name will be displayed in the connected system on dashboard.

    To change how each panel is visualized, select Edit and then adjust the filter. You can change the panel's title, clone it, and delete the panel from the dashboard, among other modifications.

  • Using the reporting system

    On the ACDI interface, you can access the NetIQ Audit Driver Events report containing a list of all driver monitors located under the Connected System. You can filter the results by selecting a particular channel and the status of events you want to view. For example, to see all events with an error status for the Active Directory driver, select the status as error and the connected system as Active Directory, and click Run.

    You can also access the final event document, which contains information about the reason for the error.