Quick User Guide for Audit Master
If you need help with installing Audit Master, please reference the following KB article:
Use Audit Master Viewer
From your desktop, find "Audit Master Viewer" to startup. Expand your server node, enter “Admin” and password. If you don't know the password, ask your admin. If you are the admin, call Netcellent.
One of the quirky things with Audit Master is that you cannot immediately view the real time auditing data. Instead, you need to first right click “Current View File” and choose “Update Current View File” in the drop down menu. A triangle warning sign icon will show up indicating that it is updating the Current View File. But the icon will never go away until you right click “Current View File” and choose “Update Status.”
Now right click and choose “Query…”. You will see the following window show up:
Since Audit Master accumulates a lot of data, usually you need to narrow down the data you want to look for by specifying in the following tabs:
- Who: Indicates the auditing data from which you specify users' data you'd like to see. Default is "All" users.
- Did What: Since Elliott uses the Btrieve engine only, you may narrow it down by using "Insert," "Delete," "Modifying Before" and "Modifying After." This is under "Operations," Pervasive SQL (BTRIEVE). In addition, under the "Tables" area, you may expand the "Elliott Business Software V8.2" node and select the changes to the specify the table you are interested in seeing.
- From Where: If you are interested in seeing the changes from a specific workstation and you know the IP address, you can use this tab.
- When: If you know the changes are taking place on a certain date and time period, you can narrow it down from this tab.
Finally, after you specify the filters in each tab, click on “Execute.” See sample screen on the result below:
Highlight the particular entries on the top that you are interested in seeing. In this example, it shows the date and the time that the user made a change to a customer record (ARCUSFIL) by dropping the value "USA" from CUS_COUNTRY field (Modify Before vs. Modify After).
In many cases, the data you would like to see may not appear in the current view, in which case you will have to go to the archive. By default, the archive data is in a compressed mode to save disk space. To access archive data, you will need to first right click on the archive file, and choose "Decompress." See sample screen below:
Then you will see the triangle warning icon show up to indicate that it is in the process of decompressing the file and asking you to wait. Unfortunately, this warning icon will never go away until you right click on that same archive file and choose "Update Status" in the drop down menu. See sample screen below:
Now you can right click on the uncompressed archive file and choose "Query..." in the drop down menu.
Use Audit Master Viewer Advanced Search
If you are specifically interested in what happens to a particular record. (i.e., you would like to know who made the changes that dropped the "USA" from the CUS_COUNTRY field with customer number 001500), then you should use "Advanced Search."
To use "Advanced Search," right click on the file and choose “Query…” in the drop down menu. Go to the “Advanced” tab. Check “Use Advanced Expression Builder.” See sample screen below:
Click on the “<Select Type>” drop down and choose “Data Fields.” In the popup window, expand “Elliott Business Software (8.2)” and further expand “<User Tables>.” There, you'll find the “ARCUSFIL” table and expand it. Then scroll down to the very end of this table and choose the “CUS_NO” column, and enter “001500” in the “=” field. Click OK to save. See sample screen below:
Now click "Execute" and see the result. If there are no records found, then you need to try other archive files. Since it can be tedious to look at various archive files, we suggest that the maximum audit data file size be 1,024 MB and the maximum number of archive files be set up as 10 in our Audit Master Installation and Setup KB article. If you can't find the change in the current view, or in all 10 archive files, then it means the change was before the earliest archive file we have.
Additional Technique
The Advanced Search allows you to focus on who and when the change took place. But often when you ask the user why he did what he did, he will tell you, "I don't know." To shed more light on the situation, one common technique is to use the "Who" and "When" tabs to see all related activities of what the user was doing at the time. By seeing the activities of the user, you will have a better sense of what the user did to cause the particular change. Sometimes, this can be a user procedure issue, in which case you might want to revise your operation procedure to prevent it from happening in the future. Sometimes, this is an Elliott bug. As long as you can identify the steps it takes to replicate the problem so that we can replicate the same in-house, we can address the issue for you quickly. This is why the Audit Master is an invaluable tool.
EMK