2.7 Managing Audit Zones

Audit zones are logical groups of audit managers, agents for Privileged Access Manager, and managers for Privileged Access Manager. You can configure audit zone for your domains. Audit zones consist of audit managers, to which audit data is sent by hosts.

For example, if you configure audit zone as Zone 1 for domain 1, all the hosts in domain 1 send their audit data to audit managers of Zone 1. The advantages of configuring an audit zone for your domain include:

  • Defining destination criteria for domain's audit data based on geographical and organizational demographics. Defining this criteria allows restricting access to audit data, ensuring it reaches only the intended recipients.

  • Preventing distribution of huge audit data to audit managers.

You can configure one or more audit zones for a domain. If you have not configured any, the default Audit Zone is zero for all the domains and its respective agents and mangers.

IMPORTANT:You must maintain at least one audit manager within audit zone 0 at all times. This precaution is necessary because if there are no audit managers in the audit zone of any domain, the audit data for that domain is automatically routed to audit zone 0 preventing data loss.

Points to remember:

  • If you move a host or a sub-domain from a domain to another, the audit zone of that host or sub-domain automatically changes to the audit zone of the new domain that is associated.

  • If the audit managers of your audit zone are down, audit data is not sent to audit managers of audit zone 0. Instead, audit data for agent is sent to the audit managers of your audit zone when they are functional.

  • If you move an agent host such as an audit manager from one domain to another during a session, audit data is still sent to the audit manager. A new session data is sent to audit managers.

Here are few recommendations for configuring audit zones:

  • Each audit zone must have more than one audit manager.

  • If you have enabled video off-loading, ensure that each audit zone has one video off-loading agent.

To view the audit zone configuration information:

  1. On the home page of the console, click Hosts.

  2. In the navigation pane, select Hosts.

  3. Click Audit Zones Configurations in the task pane.

  4. Audit zone information is displayed, as shown in the following table.

    Field

    Description

    Audit Zones

    Name of the audit zone

    Audit Managers

    Audit managers that belong to the audit zone

    Domains

    Sub-domains that are associated to the domain

  5. Click Close.