Summary of the content on the page No. 1
DSAuditor 4.5 User Guide
Summary of the content on the page No. 2
Copyright © 1994-2008 Embarcadero Technologies, Inc. Embarcadero Technologies, Inc. 100 California Street, 12th Floor San Francisco, CA 94111 U.S.A. All rights reserved. All brands and product names are trademarks or registered trademarks of their respective owners. This software/documentation contains proprietary information of Embarcadero Technologies, Inc.; it is provided under a license agreement containing restrictions on use and disclosure and is also protected by copyright law. Revers
Summary of the content on the page No. 3
Contents Welcome to DSAuditor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Additional Product Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Embarcadero Technologies Technical Support. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Dashboar
Summary of the content on the page No. 4
CONTENTS > Add a User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Change Another User’s Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Create a New Role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Summary of the content on the page No. 5
Welcome to DSAuditor DSAuditor helps to secure critical data, ensure data privacy, and enable regulatory compliance by monitoring database access and activity. DSAuditor's ability to detect suspicious behavior in real time minimizes the threat of data theft and tampering. Historical data auditing capabilities deliver detailed reports to comply with stringent internal policies and external regulatory requirements. And, DSAuditor's network-based approach enables reporting on sensitive events s
Summary of the content on the page No. 6
WELCOME TO DSAUDITOR > EMBARCADERO TECHNOLOGIES TECHNICAL SUPPORT To save you time, Embarcadero Technologies maintains a Knowledge Base of commonly-encountered issues and hosts Discussion Forums that allow users to discuss their experiences using our products and any quirks they may have discovered. To speak directly with Embarcadero Technical Support, see Contacting Embarcadero Technologies Technical Support below. NOTE: Evaluators receive free technical support for the term of their evaluat
Summary of the content on the page No. 7
WELCOME TO DSAUDITOR > EMBARCADERO TECHNOLOGIES TECHNICAL SUPPORT The Embarcadero Technologies Technical Support fax number is (415) 495-4418. EMEA Embarcadero Technologies Technical Support phone number is +44 (0)1628 684 499. The hours are Monday to Friday, 9 A.M. to 5:30 P.M. U.K. time. For licensing issues, including Product Unlock Codes, call +44 (0)1628-684 494. The hours are Monday to Friday, 9 A.M. to 5:30 P.M. U.K. time The Embarcadero Technologies Technical Support fax number is +44
Summary of the content on the page No. 8
Dashboard Charts View Charts DSAuditor includes 29 “dashboard” charts for commonly required performance-, privacy-, and security-related auditing tasks. NOTE: Several shared filters must be modified before these charts will be accurate and useful. For details, see Modify Default FIlters Used by Charts. To view a chart, hover the mouse pointer over Security, Privacy, or Performance in the top menu, then select a category from the submenu: Top Menu Submenu Chart (click for description) Performa
Summary of the content on the page No. 9
Modify a Chart To change the date range of a chart, change from chart to table view or vice-versa, or select a different chart type, click the Configure (wrench) icon in the upper-right corner of the chart. NOTE: If you set the date range so as to return an enormous amount of data, for example by selecting All Dates Through Today, after you save the configuration it may take several minutes for the chart to be updated. If the results are too dense to be readable, try switching to table view.
Summary of the content on the page No. 10
Top 25 Largest Data Returns: Queries returning a large amount of data can affect performance. Use a detailed report to analyze these queries and determine if they can be optimized. Top 25 Longest Running Queries: Long running queries affect application performance. By analyzing the full SQL statements in a detailed report you may be able to better optimize the queries for improved transaction times. Performance Charts - Table Joins If tables were joined less in the past month than in the same
Summary of the content on the page No. 11
Large Selects by Non-Privileged Users: Every organization will have a different definition of “large” and some databases will have a wider variation in their activity. However, once you have monitored SELECT activity for several weeks it should be relatively clear as to a threshold that represents an unusually large dataset return. This represents a likely download of the data to a local database or even Excel spreadsheet. Once the data is stored locally, you've likely lost the ability to pla
Summary of the content on the page No. 12
DASHBOARD CHARTS > CHART DESCRIPTIONS In the case of privileged users this represents a likely download of the data, possibly to use for testing purposes. In the case of sensitive data, communicate with the user to ensure they have a legitimate need for the data and understand the protection requirements for that data. Use of “live” customer names, addresses, and account IDs or Social Security numbers by development and test personnel may be a violation of privacy law or your organization's p
Summary of the content on the page No. 13
DASHBOARD CHARTS > CHART DESCRIPTIONS Login Source Information: This table provides you with metrics to spot likely use of a shared account. User IDs with a significant number of logins in one day or coming from multiple network users, multiple source IP addresses or multiple source applications are highly suspicious and should be investigated. It is also highly unlikely that a single user would log in from multiple domains during a single 24-hour period. Some of this may vary from organizati
Summary of the content on the page No. 14
DASHBOARD CHARTS > CHART DESCRIPTIONS Database account activity should be monitored including provisioning and deprovisioning users. When OS accounts are deprovisioned, the matching database accounts should be removed as well. If your organization is not growing, but you see many more roles and users created than dropped, you should review your de-provisioning process. Security Charts - Schema Changes Unauthorized and undetected changes to a database schema can cause system instability at the
Summary of the content on the page No. 15
REPORTS > UNDERSTANDING REPORTS Reports Understanding Reports For auditing requirements not met by the dashboard charts, you may create reports. These reports may include more detailed data, and allow you to “drill down” from summary to detailed data, in some cases all the way down to the individual query level. You may “publish” a report to share it with all other users, annotate reports with comments that are visible to other users, and save reports in HTML, PDF, comma-delimited text, or ri
Summary of the content on the page No. 16
REPORTS > CREATE AND PUBLISH A NEW REPORT • Content: Selects which fields will be included in each row of the subreport body. Which fields are available depends on the Type setting. For more information on these fields, see Subreport Attribute Value Descriptions. • Sort Order: Controls how the rows in the subreport body are sorted. Which sort options are available depends on the Type setting. For more information on these options, see Subreport Attribute Value Descriptions. • Row Limit: If All
Summary of the content on the page No. 17
REPORTS > SCHEDULE A REPORT 3Use the Table of Contents to navigate through the report and “drill down.” To view detailed metadata and statistics for an individual query, plus (if allowed by the DSAuditor server administrator) its SQL query text, click the contents of the first field of its row (typically the client application name). To update the report with the most recent data, under Actions click Refresh. To view the SQL query that generated the report, under Actions click Show SQL. To exp
Summary of the content on the page No. 18
REPORTS > IMPORT OR EXPORT A USAGE TRACKER TEMPLATE 6 If you wish to modify a subreport, click its name; under Operations, click Edit; set the subreport options as appropriate (for more information, see Understanding Reports); then click Save. (By default, the Edit command is available only when logged in with Power User or Administrator privileges; for more information, see .) Understanding Role-Based Security 7 If you wish to delete a subreport, click its name; under Operations, click Delet
Summary of the content on the page No. 19
FILTERS > CREATE OR EDIT A SHARED FILTER Filters Create or Edit a Shared Filter If the same filter will be used multiple subreports, you may define it once using the Filters tool. You may then modify the filters of all the subreports at once by editing the single predefined filter. The Web client includes many default filters that can easily be adapted to meet your filtering needs. NOTE: Some of the sample filters must be edited to meet your company’s requirements. For example, in its initial
Summary of the content on the page No. 20
FILTERS > MODIFY DEFAULT FILTERS USED BY CHARTS 5 When done setting the above options, click Save to create or modify the filter. Then test the filter by running or creating a report that uses it. Modify Default FIlters Used by Charts Many of the charts use default shared filters. (For details, see Shared Filters Used in Dashboard Charts.) The following three filters must be modified before running the charts that use them: • Authorized Applications: revise to reflect the DBMS clients, reporti
