From 77b12f3ff839c2e433af3832e89e833080c4d9f7 Mon Sep 17 00:00:00 2001 From: Nikolay Budeev Date: Mon, 24 Aug 2026 19:02:28 +0200 Subject: [PATCH 01/11] Update NAS FSA Unity Security Event Log configuration docs Expand the procedure to cover file path, maximum size, and retention across 10.7-10.9, add verification steps via Computer Management, and fix grammar/spelling issues. Generated with AI Co-Authored-By: Claude Code --- .../delldatastorage/securityeventlog.md | 46 +++++++++++++------ .../delldatastorage/securityeventlog.md | 46 +++++++++++++------ .../delldatastorage/securityeventlog.md | 46 +++++++++++++------ 3 files changed, 99 insertions(+), 39 deletions(-) diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md index ec3ee353a8..8347f33878 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md @@ -1,25 +1,45 @@ --- -title: "Configure Security Event Log Maximum Size" -description: "Configure Security Event Log Maximum Size" +title: "Configure Security Event Log" +description: "Configure Security Event Log" sidebar_position: 20 --- -# Configure Security Event Log Maximum Size +# Configure Security Event Log -Follow the steps to configure Event Log maximum size: +Follow the steps to configure Event Log file path, maximum size, and retention: -**Step 1 –** On your file server, create a new file system where the security log will be stored. +**Step 1 -** On your file server, create a new file system (e.g., with name _events_) where the security log will be stored +with a minimum size of `4GiB`: **Unisphere Web UI -> Storage -> File -> File System Tab** and press "+" -**Step 2 –** Mount this file system on a mount point, e.g., **/events**. +**Step 2 -** Make sure that it is accessible with DPA via the **\\\C$\events** UNC path. -**Step 3 –** Make sure that it is accessible via the **\\``\C$\events** UNC path. - -**Step 4 –** On the computer where Auditor Server is installed, open **Registry Editor**: navigate +**Step 3 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate to **Start → Run** and type _"regedit"_. -**Step 5 –** Navigate to **File → Connect Network Registry** and specify the file server name. +**Step 4 -** Navigate to **File → Connect Network Registry** and specify the _"file server name"_. + +**Step 5 -** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security** + +**Step 6 -** Set the **File** value to _"C:\events\security.evt"_. + +**Step 7 -** Set the **MaxSize** value to _ffff0000 (hex) or 4 294 901 760 (decimal)_. + +**Step 8 -** Set the **Retention** value to _0 (hex or decimal)_ + + +You can also verify Event Log settings using **Computer Management** console: + +**Step 1 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate +to **Start → Run** and type _"compmgmt.msc /computer="_ or right-click _Start_ +and select _"Computer Management"_ in the menu. + +**Step 2 -** Navigate to **System tools -> Event Viewer -> Classic Event Viewer**, expand the "Global Log" list and +right-click _Security_ and select _Properties_ -**Step 6 –** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security** -and set the **File** value to _"C:\events\security.evt"_. -**Step 7 –** Set the **MaxSize** value to _"4 000 000 000 (decimal)"_. +**NOTE:** +- You can't change the **"Log name"** (_File_ in the registry) in the **"Security Properties"**, +set it using **Registry Editor** +- **Maximum log size** corresponds to _MaxSize_ in the registry and shows in KBytes in the **"Security Properties"**, +whereas in **"Registry Editor"** it shows in Bytes: _4 294 901 760 Bytes = 4 194 240 KB_ +- **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry \ No newline at end of file diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md index ec3ee353a8..8347f33878 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md @@ -1,25 +1,45 @@ --- -title: "Configure Security Event Log Maximum Size" -description: "Configure Security Event Log Maximum Size" +title: "Configure Security Event Log" +description: "Configure Security Event Log" sidebar_position: 20 --- -# Configure Security Event Log Maximum Size +# Configure Security Event Log -Follow the steps to configure Event Log maximum size: +Follow the steps to configure Event Log file path, maximum size, and retention: -**Step 1 –** On your file server, create a new file system where the security log will be stored. +**Step 1 -** On your file server, create a new file system (e.g., with name _events_) where the security log will be stored +with a minimum size of `4GiB`: **Unisphere Web UI -> Storage -> File -> File System Tab** and press "+" -**Step 2 –** Mount this file system on a mount point, e.g., **/events**. +**Step 2 -** Make sure that it is accessible with DPA via the **\\\C$\events** UNC path. -**Step 3 –** Make sure that it is accessible via the **\\``\C$\events** UNC path. - -**Step 4 –** On the computer where Auditor Server is installed, open **Registry Editor**: navigate +**Step 3 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate to **Start → Run** and type _"regedit"_. -**Step 5 –** Navigate to **File → Connect Network Registry** and specify the file server name. +**Step 4 -** Navigate to **File → Connect Network Registry** and specify the _"file server name"_. + +**Step 5 -** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security** + +**Step 6 -** Set the **File** value to _"C:\events\security.evt"_. + +**Step 7 -** Set the **MaxSize** value to _ffff0000 (hex) or 4 294 901 760 (decimal)_. + +**Step 8 -** Set the **Retention** value to _0 (hex or decimal)_ + + +You can also verify Event Log settings using **Computer Management** console: + +**Step 1 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate +to **Start → Run** and type _"compmgmt.msc /computer="_ or right-click _Start_ +and select _"Computer Management"_ in the menu. + +**Step 2 -** Navigate to **System tools -> Event Viewer -> Classic Event Viewer**, expand the "Global Log" list and +right-click _Security_ and select _Properties_ -**Step 6 –** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security** -and set the **File** value to _"C:\events\security.evt"_. -**Step 7 –** Set the **MaxSize** value to _"4 000 000 000 (decimal)"_. +**NOTE:** +- You can't change the **"Log name"** (_File_ in the registry) in the **"Security Properties"**, +set it using **Registry Editor** +- **Maximum log size** corresponds to _MaxSize_ in the registry and shows in KBytes in the **"Security Properties"**, +whereas in **"Registry Editor"** it shows in Bytes: _4 294 901 760 Bytes = 4 194 240 KB_ +- **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry \ No newline at end of file diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md index ec3ee353a8..8347f33878 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md @@ -1,25 +1,45 @@ --- -title: "Configure Security Event Log Maximum Size" -description: "Configure Security Event Log Maximum Size" +title: "Configure Security Event Log" +description: "Configure Security Event Log" sidebar_position: 20 --- -# Configure Security Event Log Maximum Size +# Configure Security Event Log -Follow the steps to configure Event Log maximum size: +Follow the steps to configure Event Log file path, maximum size, and retention: -**Step 1 –** On your file server, create a new file system where the security log will be stored. +**Step 1 -** On your file server, create a new file system (e.g., with name _events_) where the security log will be stored +with a minimum size of `4GiB`: **Unisphere Web UI -> Storage -> File -> File System Tab** and press "+" -**Step 2 –** Mount this file system on a mount point, e.g., **/events**. +**Step 2 -** Make sure that it is accessible with DPA via the **\\\C$\events** UNC path. -**Step 3 –** Make sure that it is accessible via the **\\``\C$\events** UNC path. - -**Step 4 –** On the computer where Auditor Server is installed, open **Registry Editor**: navigate +**Step 3 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate to **Start → Run** and type _"regedit"_. -**Step 5 –** Navigate to **File → Connect Network Registry** and specify the file server name. +**Step 4 -** Navigate to **File → Connect Network Registry** and specify the _"file server name"_. + +**Step 5 -** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security** + +**Step 6 -** Set the **File** value to _"C:\events\security.evt"_. + +**Step 7 -** Set the **MaxSize** value to _ffff0000 (hex) or 4 294 901 760 (decimal)_. + +**Step 8 -** Set the **Retention** value to _0 (hex or decimal)_ + + +You can also verify Event Log settings using **Computer Management** console: + +**Step 1 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate +to **Start → Run** and type _"compmgmt.msc /computer="_ or right-click _Start_ +and select _"Computer Management"_ in the menu. + +**Step 2 -** Navigate to **System tools -> Event Viewer -> Classic Event Viewer**, expand the "Global Log" list and +right-click _Security_ and select _Properties_ -**Step 6 –** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security** -and set the **File** value to _"C:\events\security.evt"_. -**Step 7 –** Set the **MaxSize** value to _"4 000 000 000 (decimal)"_. +**NOTE:** +- You can't change the **"Log name"** (_File_ in the registry) in the **"Security Properties"**, +set it using **Registry Editor** +- **Maximum log size** corresponds to _MaxSize_ in the registry and shows in KBytes in the **"Security Properties"**, +whereas in **"Registry Editor"** it shows in Bytes: _4 294 901 760 Bytes = 4 194 240 KB_ +- **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry \ No newline at end of file From aa79d9183e50a5847b8b231b2b0729c1512ac649 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 17:07:26 +0000 Subject: [PATCH 02/11] fix(vale): auto-fix style issues (Vale + Dale) --- .../delldatastorage/securityeventlog.md | 14 +++++++------- .../delldatastorage/securityeventlog.md | 14 +++++++------- .../delldatastorage/securityeventlog.md | 14 +++++++------- 3 files changed, 21 insertions(+), 21 deletions(-) diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md index 8347f33878..f6dd3210fa 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md @@ -6,12 +6,12 @@ sidebar_position: 20 # Configure Security Event Log -Follow the steps to configure Event Log file path, maximum size, and retention: +Configure the Event Log file path, maximum size, and retention: -**Step 1 -** On your file server, create a new file system (e.g., with name _events_) where the security log will be stored -with a minimum size of `4GiB`: **Unisphere Web UI -> Storage -> File -> File System Tab** and press "+" +**Step 1 -** On your file server, create a new file system with a minimum size of `4GiB` (e.g., with name _events_) +to store the security log: **Unisphere Web UI -> Storage -> File -> File System Tab** and press "+" -**Step 2 -** Make sure that it is accessible with DPA via the **\\\C$\events** UNC path. +**Step 2 -** Ensure it's accessible with DPA via the **\\\C$\events** UNC path. **Step 3 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate to **Start → Run** and type _"regedit"_. @@ -38,8 +38,8 @@ right-click _Security_ and select _Properties_ **NOTE:** -- You can't change the **"Log name"** (_File_ in the registry) in the **"Security Properties"**, -set it using **Registry Editor** +- Set the **"Log name"** (_File_ in the registry) using **Registry Editor**. The **"Security Properties"** +dialog doesn't let you change it. - **Maximum log size** corresponds to _MaxSize_ in the registry and shows in KBytes in the **"Security Properties"**, whereas in **"Registry Editor"** it shows in Bytes: _4 294 901 760 Bytes = 4 194 240 KB_ -- **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry \ No newline at end of file +- **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md index 8347f33878..f6dd3210fa 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md @@ -6,12 +6,12 @@ sidebar_position: 20 # Configure Security Event Log -Follow the steps to configure Event Log file path, maximum size, and retention: +Configure the Event Log file path, maximum size, and retention: -**Step 1 -** On your file server, create a new file system (e.g., with name _events_) where the security log will be stored -with a minimum size of `4GiB`: **Unisphere Web UI -> Storage -> File -> File System Tab** and press "+" +**Step 1 -** On your file server, create a new file system with a minimum size of `4GiB` (e.g., with name _events_) +to store the security log: **Unisphere Web UI -> Storage -> File -> File System Tab** and press "+" -**Step 2 -** Make sure that it is accessible with DPA via the **\\\C$\events** UNC path. +**Step 2 -** Ensure it's accessible with DPA via the **\\\C$\events** UNC path. **Step 3 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate to **Start → Run** and type _"regedit"_. @@ -38,8 +38,8 @@ right-click _Security_ and select _Properties_ **NOTE:** -- You can't change the **"Log name"** (_File_ in the registry) in the **"Security Properties"**, -set it using **Registry Editor** +- Set the **"Log name"** (_File_ in the registry) using **Registry Editor**. The **"Security Properties"** +dialog doesn't let you change it. - **Maximum log size** corresponds to _MaxSize_ in the registry and shows in KBytes in the **"Security Properties"**, whereas in **"Registry Editor"** it shows in Bytes: _4 294 901 760 Bytes = 4 194 240 KB_ -- **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry \ No newline at end of file +- **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md index 8347f33878..f6dd3210fa 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md @@ -6,12 +6,12 @@ sidebar_position: 20 # Configure Security Event Log -Follow the steps to configure Event Log file path, maximum size, and retention: +Configure the Event Log file path, maximum size, and retention: -**Step 1 -** On your file server, create a new file system (e.g., with name _events_) where the security log will be stored -with a minimum size of `4GiB`: **Unisphere Web UI -> Storage -> File -> File System Tab** and press "+" +**Step 1 -** On your file server, create a new file system with a minimum size of `4GiB` (e.g., with name _events_) +to store the security log: **Unisphere Web UI -> Storage -> File -> File System Tab** and press "+" -**Step 2 -** Make sure that it is accessible with DPA via the **\\\C$\events** UNC path. +**Step 2 -** Ensure it's accessible with DPA via the **\\\C$\events** UNC path. **Step 3 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate to **Start → Run** and type _"regedit"_. @@ -38,8 +38,8 @@ right-click _Security_ and select _Properties_ **NOTE:** -- You can't change the **"Log name"** (_File_ in the registry) in the **"Security Properties"**, -set it using **Registry Editor** +- Set the **"Log name"** (_File_ in the registry) using **Registry Editor**. The **"Security Properties"** +dialog doesn't let you change it. - **Maximum log size** corresponds to _MaxSize_ in the registry and shows in KBytes in the **"Security Properties"**, whereas in **"Registry Editor"** it shows in Bytes: _4 294 901 760 Bytes = 4 194 240 KB_ -- **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry \ No newline at end of file +- **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry From 5bff0087a0371ac11243198ac0d88ebab66a533c Mon Sep 17 00:00:00 2001 From: Nikolay Budeev Date: Mon, 24 Aug 2026 20:03:08 +0200 Subject: [PATCH 03/11] Sync Dell Data Storage Security Event Log docs across 10.7-10.9 Propagate the 10.9 Security Event Log rewrite to 10.7 and 10.8, and fix inbound links in overview.md/objectaccess.md that still used the old "Configure Security Event Log Maximum Size" title as link text. Generated with AI Co-Authored-By: Claude Code --- .../delldatastorage/objectaccess.md | 2 +- .../fileservers/delldatastorage/overview.md | 2 +- .../delldatastorage/securityeventlog.md | 38 +++++++++---------- .../delldatastorage/objectaccess.md | 2 +- .../fileservers/delldatastorage/overview.md | 2 +- .../delldatastorage/securityeventlog.md | 38 +++++++++---------- .../delldatastorage/objectaccess.md | 2 +- .../fileservers/delldatastorage/overview.md | 2 +- .../delldatastorage/securityeventlog.md | 38 +++++++++---------- 9 files changed, 63 insertions(+), 63 deletions(-) diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md index 9df7b2d40e..be94b25b0e 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md @@ -53,4 +53,4 @@ node on the left and navigate to **Policies → Windows Settings → Security Se You can configure advanced audit policy to narrow the range of events tracked and recorded by the product, thus preventing your AuditArchive and the Security event log from overfilling. See the -[Configure Security Event Log Maximum Size](/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md) topic for additional information. +[Configure Security Event Log](/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md) topic for additional information. diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md index 0f93beaf94..a7c0c9a7ae 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md @@ -71,7 +71,7 @@ deletion. To collect comprehensive audit data, you must configure your file shares for monitoring. Consider the following: -**Step 1 –** [Configure Security Event Log Maximum Size](/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md) to avoid overwriting +**Step 1 –** [Configure Security Event Log](/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md) to avoid overwriting of the security logs; it is recommended to set security log size to a maximum (4GB). Auditor does not clean Dell Unity logs automatically, the log will start overwriting when it goes beyond the limit. See the diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md index f6dd3210fa..73253ca7be 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md @@ -1,45 +1,45 @@ --- title: "Configure Security Event Log" -description: "Configure Security Event Log" +description: "Configure Event Log path, maximum size, and retention on Dell Data Storage devices" sidebar_position: 20 --- # Configure Security Event Log -Configure the Event Log file path, maximum size, and retention: +## Configure Event Log path, maximum size, and retention using "Registry Editor" -**Step 1 -** On your file server, create a new file system with a minimum size of `4GiB` (e.g., with name _events_) -to store the security log: **Unisphere Web UI -> Storage -> File -> File System Tab** and press "+" +**Step 1 -** On your file server, create a new file system (e.g., with name _events_) where the security log will be stored +with a minimum size of `4GiB`: **Web UI -> Storage -> File -> File System Tab** and press "+". -**Step 2 -** Ensure it's accessible with DPA via the **\\\C$\events** UNC path. +**Step 2 -** Ensure it's accessible with the account for collecting data via +the **"\file_server_name\C$\events"** UNC path. **Step 3 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate -to **Start → Run** and type _"regedit"_. +to **Start -> Run** and type _"regedit"_. **Step 4 -** Navigate to **File → Connect Network Registry** and specify the _"file server name"_. -**Step 5 -** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security** +**Step 5 -** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security**. **Step 6 -** Set the **File** value to _"C:\events\security.evt"_. -**Step 7 -** Set the **MaxSize** value to _ffff0000 (hex) or 4 294 901 760 (decimal)_. +**Step 7 -** Set the **MaxSize** _ffff0000 (hexadecimal)_ or _4,294,901,760 (decimal)_. Select the matching Base option in the _"Edit DWORD Value"_ dialog before entering the value. -**Step 8 -** Set the **Retention** value to _0 (hex or decimal)_ +**Step 8 -** Set the **Retention** value to _0 (hex or decimal)_. This configures the log to overwrite events as needed instead of retaining them. -You can also verify Event Log settings using **Computer Management** console: +## Verify Event Log settings using **Computer Management** console -**Step 1 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate -to **Start → Run** and type _"compmgmt.msc /computer="_ or right-click _Start_ +**Step 1 -** On the computer where Auditor Server is installed, open **Computer Managment**: navigate +to **Start -> Run** and type _"compmgmt.msc /computer=file_server_name"_ or right-click _Start_ and select _"Computer Management"_ in the menu. **Step 2 -** Navigate to **System tools -> Event Viewer -> Classic Event Viewer**, expand the "Global Log" list and -right-click _Security_ and select _Properties_ +right-click _Security_ and select _Properties_. -**NOTE:** -- Set the **"Log name"** (_File_ in the registry) using **Registry Editor**. The **"Security Properties"** -dialog doesn't let you change it. -- **Maximum log size** corresponds to _MaxSize_ in the registry and shows in KBytes in the **"Security Properties"**, -whereas in **"Registry Editor"** it shows in Bytes: _4 294 901 760 Bytes = 4 194 240 KB_ -- **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry +**NOTE:** Set the **"Log name"** (_File_ in the registry) using **Registry Editor**. The **"Security Properties"** dialog doesn't let you change it. + +**NOTE:** **Maximum log size** corresponds to _MaxSize_ in the registry. Security Properties displays it in KB, whereas **Registry Editor** displays it in bytes: _4,294,901,760 Bytes = 4,194,240 KB_ + +**NOTE:** **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md index fb700bc191..b75b15b1ed 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md @@ -53,4 +53,4 @@ node on the left and navigate to **Policies → Windows Settings → Security Se You can configure advanced audit policy to narrow the range of events tracked and recorded by the product, thus preventing your AuditArchive and the Security event log from overfilling. See the -[Configure Security Event Log Maximum Size](/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md) topic for additional information. +[Configure Security Event Log](/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md) topic for additional information. diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md index 6d763ac158..d106de0478 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md @@ -71,7 +71,7 @@ deletion. To collect comprehensive audit data, you must configure your file shares for monitoring. Consider the following: -**Step 1 –** [Configure Security Event Log Maximum Size](/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md) to avoid overwriting +**Step 1 –** [Configure Security Event Log](/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md) to avoid overwriting of the security logs; it is recommended to set security log size to a maximum (4GB). Auditor does not clean Dell Unity logs automatically, the log will start overwriting when it goes beyond the limit. See the diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md index f6dd3210fa..73253ca7be 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md @@ -1,45 +1,45 @@ --- title: "Configure Security Event Log" -description: "Configure Security Event Log" +description: "Configure Event Log path, maximum size, and retention on Dell Data Storage devices" sidebar_position: 20 --- # Configure Security Event Log -Configure the Event Log file path, maximum size, and retention: +## Configure Event Log path, maximum size, and retention using "Registry Editor" -**Step 1 -** On your file server, create a new file system with a minimum size of `4GiB` (e.g., with name _events_) -to store the security log: **Unisphere Web UI -> Storage -> File -> File System Tab** and press "+" +**Step 1 -** On your file server, create a new file system (e.g., with name _events_) where the security log will be stored +with a minimum size of `4GiB`: **Web UI -> Storage -> File -> File System Tab** and press "+". -**Step 2 -** Ensure it's accessible with DPA via the **\\\C$\events** UNC path. +**Step 2 -** Ensure it's accessible with the account for collecting data via +the **"\file_server_name\C$\events"** UNC path. **Step 3 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate -to **Start → Run** and type _"regedit"_. +to **Start -> Run** and type _"regedit"_. **Step 4 -** Navigate to **File → Connect Network Registry** and specify the _"file server name"_. -**Step 5 -** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security** +**Step 5 -** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security**. **Step 6 -** Set the **File** value to _"C:\events\security.evt"_. -**Step 7 -** Set the **MaxSize** value to _ffff0000 (hex) or 4 294 901 760 (decimal)_. +**Step 7 -** Set the **MaxSize** _ffff0000 (hexadecimal)_ or _4,294,901,760 (decimal)_. Select the matching Base option in the _"Edit DWORD Value"_ dialog before entering the value. -**Step 8 -** Set the **Retention** value to _0 (hex or decimal)_ +**Step 8 -** Set the **Retention** value to _0 (hex or decimal)_. This configures the log to overwrite events as needed instead of retaining them. -You can also verify Event Log settings using **Computer Management** console: +## Verify Event Log settings using **Computer Management** console -**Step 1 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate -to **Start → Run** and type _"compmgmt.msc /computer="_ or right-click _Start_ +**Step 1 -** On the computer where Auditor Server is installed, open **Computer Managment**: navigate +to **Start -> Run** and type _"compmgmt.msc /computer=file_server_name"_ or right-click _Start_ and select _"Computer Management"_ in the menu. **Step 2 -** Navigate to **System tools -> Event Viewer -> Classic Event Viewer**, expand the "Global Log" list and -right-click _Security_ and select _Properties_ +right-click _Security_ and select _Properties_. -**NOTE:** -- Set the **"Log name"** (_File_ in the registry) using **Registry Editor**. The **"Security Properties"** -dialog doesn't let you change it. -- **Maximum log size** corresponds to _MaxSize_ in the registry and shows in KBytes in the **"Security Properties"**, -whereas in **"Registry Editor"** it shows in Bytes: _4 294 901 760 Bytes = 4 194 240 KB_ -- **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry +**NOTE:** Set the **"Log name"** (_File_ in the registry) using **Registry Editor**. The **"Security Properties"** dialog doesn't let you change it. + +**NOTE:** **Maximum log size** corresponds to _MaxSize_ in the registry. Security Properties displays it in KB, whereas **Registry Editor** displays it in bytes: _4,294,901,760 Bytes = 4,194,240 KB_ + +**NOTE:** **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md index e26d0eb700..6d793d1069 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md @@ -53,4 +53,4 @@ node on the left and navigate to **Policies → Windows Settings → Security Se You can configure advanced audit policy to narrow the range of events tracked and recorded by the product, thus preventing your AuditArchive and the Security event log from overfilling. See the -[Configure Security Event Log Maximum Size](/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md) topic for additional information. +[Configure Security Event Log](/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md) topic for additional information. diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md index 77787cd96a..6d4014a59e 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md @@ -71,7 +71,7 @@ deletion. To collect comprehensive audit data, you must configure your file shares for monitoring. Consider the following: -**Step 1 –** [Configure Security Event Log Maximum Size](/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md) to avoid overwriting +**Step 1 –** [Configure Security Event Log](/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md) to avoid overwriting of the security logs; it is recommended to set security log size to a maximum (4GB). Auditor does not clean Dell Unity logs automatically, the log will start overwriting when it goes beyond the limit. See the diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md index f6dd3210fa..73253ca7be 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md @@ -1,45 +1,45 @@ --- title: "Configure Security Event Log" -description: "Configure Security Event Log" +description: "Configure Event Log path, maximum size, and retention on Dell Data Storage devices" sidebar_position: 20 --- # Configure Security Event Log -Configure the Event Log file path, maximum size, and retention: +## Configure Event Log path, maximum size, and retention using "Registry Editor" -**Step 1 -** On your file server, create a new file system with a minimum size of `4GiB` (e.g., with name _events_) -to store the security log: **Unisphere Web UI -> Storage -> File -> File System Tab** and press "+" +**Step 1 -** On your file server, create a new file system (e.g., with name _events_) where the security log will be stored +with a minimum size of `4GiB`: **Web UI -> Storage -> File -> File System Tab** and press "+". -**Step 2 -** Ensure it's accessible with DPA via the **\\\C$\events** UNC path. +**Step 2 -** Ensure it's accessible with the account for collecting data via +the **"\file_server_name\C$\events"** UNC path. **Step 3 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate -to **Start → Run** and type _"regedit"_. +to **Start -> Run** and type _"regedit"_. **Step 4 -** Navigate to **File → Connect Network Registry** and specify the _"file server name"_. -**Step 5 -** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security** +**Step 5 -** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security**. **Step 6 -** Set the **File** value to _"C:\events\security.evt"_. -**Step 7 -** Set the **MaxSize** value to _ffff0000 (hex) or 4 294 901 760 (decimal)_. +**Step 7 -** Set the **MaxSize** _ffff0000 (hexadecimal)_ or _4,294,901,760 (decimal)_. Select the matching Base option in the _"Edit DWORD Value"_ dialog before entering the value. -**Step 8 -** Set the **Retention** value to _0 (hex or decimal)_ +**Step 8 -** Set the **Retention** value to _0 (hex or decimal)_. This configures the log to overwrite events as needed instead of retaining them. -You can also verify Event Log settings using **Computer Management** console: +## Verify Event Log settings using **Computer Management** console -**Step 1 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate -to **Start → Run** and type _"compmgmt.msc /computer="_ or right-click _Start_ +**Step 1 -** On the computer where Auditor Server is installed, open **Computer Managment**: navigate +to **Start -> Run** and type _"compmgmt.msc /computer=file_server_name"_ or right-click _Start_ and select _"Computer Management"_ in the menu. **Step 2 -** Navigate to **System tools -> Event Viewer -> Classic Event Viewer**, expand the "Global Log" list and -right-click _Security_ and select _Properties_ +right-click _Security_ and select _Properties_. -**NOTE:** -- Set the **"Log name"** (_File_ in the registry) using **Registry Editor**. The **"Security Properties"** -dialog doesn't let you change it. -- **Maximum log size** corresponds to _MaxSize_ in the registry and shows in KBytes in the **"Security Properties"**, -whereas in **"Registry Editor"** it shows in Bytes: _4 294 901 760 Bytes = 4 194 240 KB_ -- **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry +**NOTE:** Set the **"Log name"** (_File_ in the registry) using **Registry Editor**. The **"Security Properties"** dialog doesn't let you change it. + +**NOTE:** **Maximum log size** corresponds to _MaxSize_ in the registry. Security Properties displays it in KB, whereas **Registry Editor** displays it in bytes: _4,294,901,760 Bytes = 4,194,240 KB_ + +**NOTE:** **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry From 9e5cdc97e0435f9d02c63f4ce6860c39de1cea40 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 18:22:48 +0000 Subject: [PATCH 04/11] fix(vale): auto-fix style issues (Vale + Dale) --- .../delldatastorage/objectaccess.md | 13 ++--- .../fileservers/delldatastorage/overview.md | 56 +++++++++---------- .../delldatastorage/securityeventlog.md | 8 +-- .../delldatastorage/objectaccess.md | 13 ++--- .../fileservers/delldatastorage/overview.md | 56 +++++++++---------- .../delldatastorage/securityeventlog.md | 8 +-- .../delldatastorage/objectaccess.md | 13 ++--- .../fileservers/delldatastorage/overview.md | 56 +++++++++---------- .../delldatastorage/securityeventlog.md | 8 +-- 9 files changed, 111 insertions(+), 120 deletions(-) diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md index be94b25b0e..8db4497e74 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md @@ -6,14 +6,11 @@ sidebar_position: 30 # Configure Audit Object Access Policy -Netwrixrecommends you to avoid linking a GPO to the top level of the domain due to the potential +Netwrix recommends that you avoid linking a GPO to the top level of the domain due to the potential impact. Instead, create a new organization unit for your file servers within your domain and assign -GPO there. For detailed instructions on how to create a new OU, refer to the following Microsoft -article: +GPO there. For instructions on creating a new OU, see the Microsoft article [Create a New Organizational Unit](https://technet.microsoft.com/en-us/library/cc771564.aspx). -Follow the steps to configure Audit Object Access Policy: - **Step 1 –** Open the **Group Policy Management** console on any domain controller in the target domain: navigate to Start > Windows Administrative Tools**→ Group Policy Management.** @@ -49,8 +46,8 @@ node on the left and navigate to **Policies → Windows Settings → Security Se where `` is the name of the target Unity\VNX server. - To update group policies for Dell VNX you must be logged in as the 'nasadmin' user. + To update group policies for Dell VNX, you must log in as the 'nasadmin' user. -You can configure advanced audit policy to narrow the range of events tracked and recorded by the -product, thus preventing your AuditArchive and the Security event log from overfilling. See the +You can configure advanced audit policy to narrow the range of events the product tracks and +records, preventing your AuditArchive and the Security event log from overfilling. See the [Configure Security Event Log](/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md) topic for additional information. diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md index a7c0c9a7ae..258d0aec42 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md @@ -6,37 +6,37 @@ sidebar_position: 10 # Dell Data Storage -**NOTE:** Dell VNX, VNXe, Celerra, and Unity NAS devices are collectively referred to as Dell Data -Storage. +**NOTE:** Dell Data Storage collectively refers to Dell VNX, VNXe, Celerra, and Unity NAS +devices. Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** You must exclude the folder associated with Netwrix Auditor from antivirus scanning. +See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. You can configure your IT Infrastructure for monitoring in one of the following ways: - Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or + automatically configure audit in the target environment, Auditor checks your current audit + settings on each data collection and adjusts them if necessary. +- Manually – You must adjust native audit settings manually to collect comprehensive and reliable + audit data. You can enable Auditor to continually enforce the relevant audit policies or configure them manually: - On the Dell Data Storage device: - CIFS Network Protocol support is required - - Security Event Log Maximum Size must be set to 4GB. - - The Audit object access policy must be set to _"Success"_ and "Failure" in the Group - Policy of the OU where the audited Dell VNX/VNXe/Unity/Celerra appliance belongs to. - - Audit settings must be configured for CIFS File Shares. For a security principal (e.g., - Everyone), the following options must be set to "Success" and "Fail" in the **Advanced + - Set Security Event Log Maximum Size to 4GB. + - Set the Audit object access policy to _"Success"_ and "Failure" in the Group Policy of + the OU that contains the audited Dell VNX/VNXe/Unity/Celerra appliance. + - Configure audit settings for CIFS File Shares. For a security principal (e.g., + Everyone), set the following options to "Success" and "Fail" in the **Advanced Security** > **Auditing** settings for the audited shared folders: - List Folder / Read Data (Files only) @@ -52,15 +52,15 @@ You can configure your IT Infrastructure for monitoring in one of the following - On the Auditor console computer: - If your file shares contain symbolic links and you want to collect state-in-time data for - these shares, the local-to-local, local-to-remote, remote-to-local, and remote-to-remote - symbolic link evaluations must be enabled on the computer that hosts Auditor Server. + these shares, you must enable the local-to-local, local-to-remote, remote-to-local, and + remote-to-remote symbolic link evaluations on the computer that hosts Auditor Server. First, you should decide on the objects and actions you want to track. Consider the following: -- Actions reported by Auditor vary depending on the file server type and the audited object (file, +- The actions Auditor reports vary depending on the file server type and the audited object (file, folder, or share). -- Besides, monitoring and reporting of the Dell Data Storage systems may not provide the results you - expect — due to native Dell audit peculiarities. See the [File Servers](/docs/auditor/10.7/configuration/fileservers/overview.md) topic for +- Monitoring and reporting of the Dell Data Storage systems may not provide the results you expect + due to native Dell audit peculiarities. See the [File Servers](/docs/auditor/10.7/configuration/fileservers/overview.md) topic for additional information. For example, the _change_ operation (in Auditor terminology) includes creation, modification, and @@ -72,20 +72,20 @@ To collect comprehensive audit data, you must configure your file shares for mon the following: **Step 1 –** [Configure Security Event Log](/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md) to avoid overwriting -of the security logs; it is recommended to set security log size to a maximum (4GB). Auditor does -not clean Dell Unity logs automatically, the log will start overwriting when it goes beyond the +of the security logs; Netwrix recommends setting the security log size to the maximum (4GB). Auditor +does not clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the limit. See the [Unity Family Security Configuration Guide](https://support.emc.com/docu69321_Unity-Family-Security-Configuration-Guide.pdf?language=en_US) for additional information on how to set logs roll over manually. -**Step 2 –** By default, the security log is set to overwrite events that are older than 10 days, -and its size is set to 512 KB. The default location for the security.evt log is **C:\security.evt**, -which corresponds to the root partition of the Data Mover. To be able to increase the security log -size, you must move it from the Data Mover root folder. +**Step 2 –** By default, the security log overwrites events older than 10 days, and its size is +512 KB. The default location for the security.evt log is **C:\security.evt**, which corresponds to +the root partition of the Data Mover. To increase the security log size, you must move it from the +Data Mover root folder. **Step 3 –** [Configure Audit Object Access Policy](/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md). Set the Audit object access -policy to "Success" and "Failure" in the Group Policy of the OU where your Dell -VNX/VNXe/Unity/Celerra appliance belongs to. For more information on VNX/VNXe/Unity/Celerra GPO -support, refer to documentation provided by Dell. +policy to "Success" and "Failure" in the Group Policy of the OU that contains your Dell +VNX/VNXe/Unity/Celerra appliance. For more information on VNX/VNXe/Unity/Celerra GPO support, refer +to the documentation Dell provides. **Step 4 –** [Configure Audit Settings for CIFS File Shares on Dell Data Storage](/docs/auditor/10.7/configuration/fileservers/delldatastorage/cifss.md) diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md index 73253ca7be..45de6c99da 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md @@ -8,13 +8,13 @@ sidebar_position: 20 ## Configure Event Log path, maximum size, and retention using "Registry Editor" -**Step 1 -** On your file server, create a new file system (e.g., with name _events_) where the security log will be stored -with a minimum size of `4GiB`: **Web UI -> Storage -> File -> File System Tab** and press "+". +**Step 1 -** On your file server, create a new file system (e.g., with name _events_) with a minimum size of `4GiB` to store +the security log: **Web UI -> Storage -> File -> File System Tab** and press "+". **Step 2 -** Ensure it's accessible with the account for collecting data via the **"\file_server_name\C$\events"** UNC path. -**Step 3 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate +**Step 3 -** On the computer that hosts Auditor Server, open **Registry Editor**: navigate to **Start -> Run** and type _"regedit"_. **Step 4 -** Navigate to **File → Connect Network Registry** and specify the _"file server name"_. @@ -30,7 +30,7 @@ to **Start -> Run** and type _"regedit"_. ## Verify Event Log settings using **Computer Management** console -**Step 1 -** On the computer where Auditor Server is installed, open **Computer Managment**: navigate +**Step 1 -** On the computer that hosts Auditor Server, open **Computer Managment**: navigate to **Start -> Run** and type _"compmgmt.msc /computer=file_server_name"_ or right-click _Start_ and select _"Computer Management"_ in the menu. diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md index b75b15b1ed..79eda90ade 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md @@ -6,14 +6,11 @@ sidebar_position: 30 # Configure Audit Object Access Policy -Netwrix recommends you to avoid linking a GPO to the top level of the domain due to the potential +Netwrix recommends that you avoid linking a GPO to the top level of the domain due to the potential impact. Instead, create a new organization unit for your file servers within your domain and assign -GPO there. For detailed instructions on how to create a new OU, refer to the following Microsoft -article: +GPO there. For instructions on creating a new OU, see the Microsoft article [Create a New Organizational Unit](https://technet.microsoft.com/en-us/library/cc771564.aspx). -Follow the steps to configure Audit Object Access Policy: - **Step 1 –** Open the **Group Policy Management** console on any domain controller in the target domain: navigate to Start > Windows Administrative Tools**→ Group Policy Management.** @@ -49,8 +46,8 @@ node on the left and navigate to **Policies → Windows Settings → Security Se where `` is the name of the target Unity\VNX server. - To update group policies for Dell VNX you must be logged in as the 'nasadmin' user. + To update group policies for Dell VNX, you must log in as the 'nasadmin' user. -You can configure advanced audit policy to narrow the range of events tracked and recorded by the -product, thus preventing your AuditArchive and the Security event log from overfilling. See the +You can configure advanced audit policy to narrow the range of events the product tracks and +records, preventing your AuditArchive and the Security event log from overfilling. See the [Configure Security Event Log](/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md) topic for additional information. diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md index d106de0478..161dd87ede 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md @@ -6,37 +6,37 @@ sidebar_position: 10 # Dell Data Storage -**NOTE:** Dell VNX, VNXe, Celerra, and Unity NAS devices are collectively referred to as Dell Data -Storage. +**NOTE:** Dell Data Storage collectively refers to Dell VNX, VNXe, Celerra, and Unity NAS +devices. Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** You must exclude the folder associated with Netwrix Auditor from antivirus scanning. +See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. You can configure your IT Infrastructure for monitoring in one of the following ways: - Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or + automatically configure audit in the target environment, Auditor checks your current audit + settings on each data collection and adjusts them if necessary. +- Manually – You must adjust native audit settings manually to collect comprehensive and reliable + audit data. You can enable Auditor to continually enforce the relevant audit policies or configure them manually: - On the Dell Data Storage device: - CIFS Network Protocol support is required - - Security Event Log Maximum Size must be set to 4GB. - - The Audit object access policy must be set to _"Success"_ and "Failure" in the Group - Policy of the OU where the audited Dell VNX/VNXe/Unity/Celerra appliance belongs to. - - Audit settings must be configured for CIFS File Shares. For a security principal (e.g., - Everyone), the following options must be set to "Success" and "Fail" in the **Advanced + - Set Security Event Log Maximum Size to 4GB. + - Set the Audit object access policy to _"Success"_ and "Failure" in the Group Policy of + the OU that contains the audited Dell VNX/VNXe/Unity/Celerra appliance. + - Configure audit settings for CIFS File Shares. For a security principal (e.g., + Everyone), set the following options to "Success" and "Fail" in the **Advanced Security** > **Auditing** settings for the audited shared folders: - List Folder / Read Data (Files only) @@ -52,15 +52,15 @@ You can configure your IT Infrastructure for monitoring in one of the following - On the Auditor console computer: - If your file shares contain symbolic links and you want to collect state-in-time data for - these shares, the local-to-local, local-to-remote, remote-to-local, and remote-to-remote - symbolic link evaluations must be enabled on the computer that hosts Auditor Server. + these shares, you must enable the local-to-local, local-to-remote, remote-to-local, and + remote-to-remote symbolic link evaluations on the computer that hosts Auditor Server. First, you should decide on the objects and actions you want to track. Consider the following: -- Actions reported by Auditor vary depending on the file server type and the audited object (file, +- The actions Auditor reports vary depending on the file server type and the audited object (file, folder, or share). -- Besides, monitoring and reporting of the Dell Data Storage systems may not provide the results you - expect — due to native Dell audit peculiarities. See the [File Servers](/docs/auditor/10.8/configuration/fileservers/overview.md) topic for +- Monitoring and reporting of the Dell Data Storage systems may not provide the results you expect + due to native Dell audit peculiarities. See the [File Servers](/docs/auditor/10.8/configuration/fileservers/overview.md) topic for additional information. For example, the _change_ operation (in Auditor terminology) includes creation, modification, and @@ -72,20 +72,20 @@ To collect comprehensive audit data, you must configure your file shares for mon the following: **Step 1 –** [Configure Security Event Log](/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md) to avoid overwriting -of the security logs; it is recommended to set security log size to a maximum (4GB). Auditor does -not clean Dell Unity logs automatically, the log will start overwriting when it goes beyond the +of the security logs; Netwrix recommends setting the security log size to the maximum (4GB). Auditor +does not clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the limit. See the [Unity Family Security Configuration Guide](https://support.emc.com/docu69321_Unity-Family-Security-Configuration-Guide.pdf?language=en_US) for additional information on how to set logs roll over manually. -**Step 2 –** By default, the security log is set to overwrite events that are older than 10 days, -and its size is set to 512 KB. The default location for the security.evt log is **C:\security.evt**, -which corresponds to the root partition of the Data Mover. To be able to increase the security log -size, you must move it from the Data Mover root folder. +**Step 2 –** By default, the security log overwrites events older than 10 days, and its size is +512 KB. The default location for the security.evt log is **C:\security.evt**, which corresponds to +the root partition of the Data Mover. To increase the security log size, you must move it from the +Data Mover root folder. **Step 3 –** [Configure Audit Object Access Policy](/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md). Set the Audit object access -policy to "Success" and "Failure" in the Group Policy of the OU where your Dell -VNX/VNXe/Unity/Celerra appliance belongs to. For more information on VNX/VNXe/Unity/Celerra GPO -support, refer to documentation provided by Dell. +policy to "Success" and "Failure" in the Group Policy of the OU that contains your Dell +VNX/VNXe/Unity/Celerra appliance. For more information on VNX/VNXe/Unity/Celerra GPO support, refer +to the documentation Dell provides. **Step 4 –** [Configure Audit Settings for CIFS File Shares on Dell Data Storage](/docs/auditor/10.8/configuration/fileservers/delldatastorage/cifss.md) diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md index 73253ca7be..45de6c99da 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md @@ -8,13 +8,13 @@ sidebar_position: 20 ## Configure Event Log path, maximum size, and retention using "Registry Editor" -**Step 1 -** On your file server, create a new file system (e.g., with name _events_) where the security log will be stored -with a minimum size of `4GiB`: **Web UI -> Storage -> File -> File System Tab** and press "+". +**Step 1 -** On your file server, create a new file system (e.g., with name _events_) with a minimum size of `4GiB` to store +the security log: **Web UI -> Storage -> File -> File System Tab** and press "+". **Step 2 -** Ensure it's accessible with the account for collecting data via the **"\file_server_name\C$\events"** UNC path. -**Step 3 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate +**Step 3 -** On the computer that hosts Auditor Server, open **Registry Editor**: navigate to **Start -> Run** and type _"regedit"_. **Step 4 -** Navigate to **File → Connect Network Registry** and specify the _"file server name"_. @@ -30,7 +30,7 @@ to **Start -> Run** and type _"regedit"_. ## Verify Event Log settings using **Computer Management** console -**Step 1 -** On the computer where Auditor Server is installed, open **Computer Managment**: navigate +**Step 1 -** On the computer that hosts Auditor Server, open **Computer Managment**: navigate to **Start -> Run** and type _"compmgmt.msc /computer=file_server_name"_ or right-click _Start_ and select _"Computer Management"_ in the menu. diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md index 6d793d1069..fef43d2376 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md @@ -6,14 +6,11 @@ sidebar_position: 30 # Configure Audit Object Access Policy -Netwrix recommends you to avoid linking a GPO to the top level of the domain due to the potential +Netwrix recommends that you avoid linking a GPO to the top level of the domain due to the potential impact. Instead, create a new organization unit for your file servers within your domain and assign -GPO there. For detailed instructions on how to create a new OU, refer to the following Microsoft -article: +GPO there. For instructions on creating a new OU, see the Microsoft article [Create a New Organizational Unit](https://technet.microsoft.com/en-us/library/cc771564.aspx). -Follow the steps to configure Audit Object Access Policy: - **Step 1 –** Open the **Group Policy Management** console on any domain controller in the target domain: navigate to Start > Windows Administrative Tools**→ Group Policy Management.** @@ -49,8 +46,8 @@ node on the left and navigate to **Policies → Windows Settings → Security Se where `` is the name of the target Unity\VNX server. - To update group policies for Dell VNX you must be logged in as the 'nasadmin' user. + To update group policies for Dell VNX, you must log in as the 'nasadmin' user. -You can configure advanced audit policy to narrow the range of events tracked and recorded by the -product, thus preventing your AuditArchive and the Security event log from overfilling. See the +You can configure advanced audit policy to narrow the range of events the product tracks and +records, preventing your AuditArchive and the Security event log from overfilling. See the [Configure Security Event Log](/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md) topic for additional information. diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md index 6d4014a59e..b2caa0d691 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md @@ -6,37 +6,37 @@ sidebar_position: 10 # Dell Data Storage -**NOTE:** Dell VNX, VNXe, Celerra, and Unity NAS devices are collectively referred to as Dell Data -Storage. +**NOTE:** Dell Data Storage collectively refers to Dell VNX, VNXe, Celerra, and Unity NAS +devices. Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** You must exclude the folder associated with Netwrix Auditor from antivirus scanning. +See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. You can configure your IT Infrastructure for monitoring in one of the following ways: - Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or + automatically configure audit in the target environment, Auditor checks your current audit + settings on each data collection and adjusts them if necessary. +- Manually – You must adjust native audit settings manually to collect comprehensive and reliable + audit data. You can enable Auditor to continually enforce the relevant audit policies or configure them manually: - On the Dell Data Storage device: - CIFS Network Protocol support is required - - Security Event Log Maximum Size must be set to 4GB. - - The Audit object access policy must be set to _"Success"_ and "Failure" in the Group - Policy of the OU where the audited Dell VNX/VNXe/Unity/Celerra appliance belongs to. - - Audit settings must be configured for CIFS File Shares. For a security principal (e.g., - Everyone), the following options must be set to "Success" and "Fail" in the **Advanced + - Set Security Event Log Maximum Size to 4GB. + - Set the Audit object access policy to _"Success"_ and "Failure" in the Group Policy of + the OU that contains the audited Dell VNX/VNXe/Unity/Celerra appliance. + - Configure audit settings for CIFS File Shares. For a security principal (e.g., + Everyone), set the following options to "Success" and "Fail" in the **Advanced Security** > **Auditing** settings for the audited shared folders: - List Folder / Read Data (Files only) @@ -52,15 +52,15 @@ You can configure your IT Infrastructure for monitoring in one of the following - On the Auditor console computer: - If your file shares contain symbolic links and you want to collect state-in-time data for - these shares, the local-to-local, local-to-remote, remote-to-local, and remote-to-remote - symbolic link evaluations must be enabled on the computer that hosts Auditor Server. + these shares, you must enable the local-to-local, local-to-remote, remote-to-local, and + remote-to-remote symbolic link evaluations on the computer that hosts Auditor Server. First, you should decide on the objects and actions you want to track. Consider the following: -- Actions reported by Auditor vary depending on the file server type and the audited object (file, +- The actions Auditor reports vary depending on the file server type and the audited object (file, folder, or share). -- Besides, monitoring and reporting of the Dell Data Storage systems may not provide the results you - expect — due to native Dell audit peculiarities. See the [File Servers](/docs/auditor/10.9/configuration/fileservers/overview.md) topic for +- Monitoring and reporting of the Dell Data Storage systems may not provide the results you expect + due to native Dell audit peculiarities. See the [File Servers](/docs/auditor/10.9/configuration/fileservers/overview.md) topic for additional information. For example, the _change_ operation (in Auditor terminology) includes creation, modification, and @@ -72,20 +72,20 @@ To collect comprehensive audit data, you must configure your file shares for mon the following: **Step 1 –** [Configure Security Event Log](/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md) to avoid overwriting -of the security logs; it is recommended to set security log size to a maximum (4GB). Auditor does -not clean Dell Unity logs automatically, the log will start overwriting when it goes beyond the +of the security logs; Netwrix recommends setting the security log size to the maximum (4GB). Auditor +does not clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the limit. See the [Unity Family Security Configuration Guide](https://support.emc.com/docu69321_Unity-Family-Security-Configuration-Guide.pdf?language=en_US) for additional information on how to set logs roll over manually. -**Step 2 –** By default, the security log is set to overwrite events that are older than 10 days, -and its size is set to 512 KB. The default location for the security.evt log is **C:\security.evt**, -which corresponds to the root partition of the Data Mover. To be able to increase the security log -size, you must move it from the Data Mover root folder. +**Step 2 –** By default, the security log overwrites events older than 10 days, and its size is +512 KB. The default location for the security.evt log is **C:\security.evt**, which corresponds to +the root partition of the Data Mover. To increase the security log size, you must move it from the +Data Mover root folder. **Step 3 –** [Configure Audit Object Access Policy](/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md). Set the Audit object access -policy to "Success" and "Failure" in the Group Policy of the OU where your Dell -VNX/VNXe/Unity/Celerra appliance belongs to. For more information on VNX/VNXe/Unity/Celerra GPO -support, refer to documentation provided by Dell. +policy to "Success" and "Failure" in the Group Policy of the OU that contains your Dell +VNX/VNXe/Unity/Celerra appliance. For more information on VNX/VNXe/Unity/Celerra GPO support, refer +to the documentation Dell provides. **Step 4 –** [Configure Audit Settings for CIFS File Shares on Dell Data Storage](/docs/auditor/10.9/configuration/fileservers/delldatastorage/cifss.md) diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md index 73253ca7be..45de6c99da 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md @@ -8,13 +8,13 @@ sidebar_position: 20 ## Configure Event Log path, maximum size, and retention using "Registry Editor" -**Step 1 -** On your file server, create a new file system (e.g., with name _events_) where the security log will be stored -with a minimum size of `4GiB`: **Web UI -> Storage -> File -> File System Tab** and press "+". +**Step 1 -** On your file server, create a new file system (e.g., with name _events_) with a minimum size of `4GiB` to store +the security log: **Web UI -> Storage -> File -> File System Tab** and press "+". **Step 2 -** Ensure it's accessible with the account for collecting data via the **"\file_server_name\C$\events"** UNC path. -**Step 3 -** On the computer where Auditor Server is installed, open **Registry Editor**: navigate +**Step 3 -** On the computer that hosts Auditor Server, open **Registry Editor**: navigate to **Start -> Run** and type _"regedit"_. **Step 4 -** Navigate to **File → Connect Network Registry** and specify the _"file server name"_. @@ -30,7 +30,7 @@ to **Start -> Run** and type _"regedit"_. ## Verify Event Log settings using **Computer Management** console -**Step 1 -** On the computer where Auditor Server is installed, open **Computer Managment**: navigate +**Step 1 -** On the computer that hosts Auditor Server, open **Computer Managment**: navigate to **Start -> Run** and type _"compmgmt.msc /computer=file_server_name"_ or right-click _Start_ and select _"Computer Management"_ in the menu. From 3ef6d8b062eb9509751c5873ff420fd05399cc22 Mon Sep 17 00:00:00 2001 From: Nikolay Budeev Date: Mon, 24 Aug 2026 20:53:34 +0200 Subject: [PATCH 05/11] Address editorial review feedback on Dell Data Storage security event log docs Fixes structure, arrow/dash consistency, code formatting, and completeness gaps flagged in PR #1418 review (intro, headings, verification steps, NOTE-to-admonition conversion). Leaves the mount-point step and 4GiB/4GB unit conflict untouched per author request. --- .../fileservers/delldatastorage/overview.md | 3 +- .../delldatastorage/securityeventlog.md | 46 ++++++++++--------- .../fileservers/delldatastorage/overview.md | 3 +- .../delldatastorage/securityeventlog.md | 46 ++++++++++--------- .../fileservers/delldatastorage/overview.md | 3 +- .../delldatastorage/securityeventlog.md | 46 ++++++++++--------- 6 files changed, 78 insertions(+), 69 deletions(-) diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md index 258d0aec42..6dc4e1bf48 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md @@ -71,8 +71,7 @@ deletion. To collect comprehensive audit data, you must configure your file shares for monitoring. Consider the following: -**Step 1 –** [Configure Security Event Log](/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md) to avoid overwriting -of the security logs; Netwrix recommends setting the security log size to the maximum (4GB). Auditor +**Step 1 –** [Configure Security Event Log](/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that security events aren't overwritten. Auditor does not clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the limit. See the [Unity Family Security Configuration Guide](https://support.emc.com/docu69321_Unity-Family-Security-Configuration-Guide.pdf?language=en_US) for diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md index 45de6c99da..4a36a7039c 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md @@ -6,40 +6,44 @@ sidebar_position: 20 # Configure Security Event Log -## Configure Event Log path, maximum size, and retention using "Registry Editor" +Configure the security event log path, maximum size, and retention on your Dell Data Storage device so that audit data isn't lost when the log fills. Configure the settings in Registry Editor, then verify them in the Computer Management console. -**Step 1 -** On your file server, create a new file system (e.g., with name _events_) with a minimum size of `4GiB` to store -the security log: **Web UI -> Storage -> File -> File System Tab** and press "+". +## Configure Event Log path, maximum size, and retention in Registry Editor -**Step 2 -** Ensure it's accessible with the account for collecting data via -the **"\file_server_name\C$\events"** UNC path. +**Step 1 –** In the Dell **Web UI**, navigate to **Storage → File → File System** and click **+** to create a file system. Name it `events` and set its size to at least 4 GiB. This file system stores the security log. -**Step 3 -** On the computer that hosts Auditor Server, open **Registry Editor**: navigate -to **Start -> Run** and type _"regedit"_. +**Step 2 –** Confirm that the account used for data collection can read the share at `\\\C$\events`. -**Step 4 -** Navigate to **File → Connect Network Registry** and specify the _"file server name"_. +**Step 3 –** On the computer where Auditor Server is installed, open **Registry Editor**: navigate +to **Start → Run** and type `regedit`. -**Step 5 -** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security**. +**Step 4 –** Navigate to **File → Connect Network Registry** and specify ``. -**Step 6 -** Set the **File** value to _"C:\events\security.evt"_. +**Step 5 –** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security**. -**Step 7 -** Set the **MaxSize** _ffff0000 (hexadecimal)_ or _4,294,901,760 (decimal)_. Select the matching Base option in the _"Edit DWORD Value"_ dialog before entering the value. +**Step 6 –** Set the **File** value to `C:\events\security.evt`. -**Step 8 -** Set the **Retention** value to _0 (hex or decimal)_. This configures the log to overwrite events as needed instead of retaining them. +**Step 7 –** Set the **MaxSize** value to `ffff0000` (hexadecimal) or `4294901760` (decimal). Select the matching **Base** option in the **Edit DWORD Value** dialog before you enter the value. +**Step 8 –** Set the **Retention** value to `0` (hex or decimal). This configures the log to overwrite events as needed instead of retaining them. -## Verify Event Log settings using **Computer Management** console +## Verify Event Log settings in the Computer Management console -**Step 1 -** On the computer that hosts Auditor Server, open **Computer Managment**: navigate -to **Start -> Run** and type _"compmgmt.msc /computer=file_server_name"_ or right-click _Start_ -and select _"Computer Management"_ in the menu. +**Step 1 –** On the computer where Auditor Server is installed, open **Computer Management**: navigate +to **Start → Run** and type `compmgmt.msc /computer=`, or right-click **Start** and select **Computer Management**. -**Step 2 -** Navigate to **System tools -> Event Viewer -> Classic Event Viewer**, expand the "Global Log" list and -right-click _Security_ and select _Properties_. +**Step 2 –** Navigate to **System Tools → Event Viewer → Windows Logs**, then right-click **Security** and select **Properties**. +**Step 3 –** Confirm the following values: **Log name** shows `C:\events\security.evt`, **Maximum log size** shows `4,194,240 KB`, and **Overwrite events as needed** is selected. If any value doesn't match, correct it in **Registry Editor** and reopen this dialog. -**NOTE:** Set the **"Log name"** (_File_ in the registry) using **Registry Editor**. The **"Security Properties"** dialog doesn't let you change it. +:::note +The **Security Properties** dialog fields map to the following registry values: -**NOTE:** **Maximum log size** corresponds to _MaxSize_ in the registry. Security Properties displays it in KB, whereas **Registry Editor** displays it in bytes: _4,294,901,760 Bytes = 4,194,240 KB_ +| Security Properties field | Registry value | +|---|---| +| Log name | `File` | +| Maximum log size | `MaxSize` (`4,294,901,760 bytes = 4,194,240 KB`) | +| Overwrite events as needed | `Retention = 0` | -**NOTE:** **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry +Registry Editor displays **Maximum log size** in bytes, while Security Properties displays it in KB. You can't change **Log name** from the **Security Properties** dialog — use **Registry Editor** instead. +::: diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md index 161dd87ede..d708b4057d 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md @@ -71,8 +71,7 @@ deletion. To collect comprehensive audit data, you must configure your file shares for monitoring. Consider the following: -**Step 1 –** [Configure Security Event Log](/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md) to avoid overwriting -of the security logs; Netwrix recommends setting the security log size to the maximum (4GB). Auditor +**Step 1 –** [Configure Security Event Log](/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that security events aren't overwritten. Auditor does not clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the limit. See the [Unity Family Security Configuration Guide](https://support.emc.com/docu69321_Unity-Family-Security-Configuration-Guide.pdf?language=en_US) for diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md index 45de6c99da..4a36a7039c 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md @@ -6,40 +6,44 @@ sidebar_position: 20 # Configure Security Event Log -## Configure Event Log path, maximum size, and retention using "Registry Editor" +Configure the security event log path, maximum size, and retention on your Dell Data Storage device so that audit data isn't lost when the log fills. Configure the settings in Registry Editor, then verify them in the Computer Management console. -**Step 1 -** On your file server, create a new file system (e.g., with name _events_) with a minimum size of `4GiB` to store -the security log: **Web UI -> Storage -> File -> File System Tab** and press "+". +## Configure Event Log path, maximum size, and retention in Registry Editor -**Step 2 -** Ensure it's accessible with the account for collecting data via -the **"\file_server_name\C$\events"** UNC path. +**Step 1 –** In the Dell **Web UI**, navigate to **Storage → File → File System** and click **+** to create a file system. Name it `events` and set its size to at least 4 GiB. This file system stores the security log. -**Step 3 -** On the computer that hosts Auditor Server, open **Registry Editor**: navigate -to **Start -> Run** and type _"regedit"_. +**Step 2 –** Confirm that the account used for data collection can read the share at `\\\C$\events`. -**Step 4 -** Navigate to **File → Connect Network Registry** and specify the _"file server name"_. +**Step 3 –** On the computer where Auditor Server is installed, open **Registry Editor**: navigate +to **Start → Run** and type `regedit`. -**Step 5 -** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security**. +**Step 4 –** Navigate to **File → Connect Network Registry** and specify ``. -**Step 6 -** Set the **File** value to _"C:\events\security.evt"_. +**Step 5 –** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security**. -**Step 7 -** Set the **MaxSize** _ffff0000 (hexadecimal)_ or _4,294,901,760 (decimal)_. Select the matching Base option in the _"Edit DWORD Value"_ dialog before entering the value. +**Step 6 –** Set the **File** value to `C:\events\security.evt`. -**Step 8 -** Set the **Retention** value to _0 (hex or decimal)_. This configures the log to overwrite events as needed instead of retaining them. +**Step 7 –** Set the **MaxSize** value to `ffff0000` (hexadecimal) or `4294901760` (decimal). Select the matching **Base** option in the **Edit DWORD Value** dialog before you enter the value. +**Step 8 –** Set the **Retention** value to `0` (hex or decimal). This configures the log to overwrite events as needed instead of retaining them. -## Verify Event Log settings using **Computer Management** console +## Verify Event Log settings in the Computer Management console -**Step 1 -** On the computer that hosts Auditor Server, open **Computer Managment**: navigate -to **Start -> Run** and type _"compmgmt.msc /computer=file_server_name"_ or right-click _Start_ -and select _"Computer Management"_ in the menu. +**Step 1 –** On the computer where Auditor Server is installed, open **Computer Management**: navigate +to **Start → Run** and type `compmgmt.msc /computer=`, or right-click **Start** and select **Computer Management**. -**Step 2 -** Navigate to **System tools -> Event Viewer -> Classic Event Viewer**, expand the "Global Log" list and -right-click _Security_ and select _Properties_. +**Step 2 –** Navigate to **System Tools → Event Viewer → Windows Logs**, then right-click **Security** and select **Properties**. +**Step 3 –** Confirm the following values: **Log name** shows `C:\events\security.evt`, **Maximum log size** shows `4,194,240 KB`, and **Overwrite events as needed** is selected. If any value doesn't match, correct it in **Registry Editor** and reopen this dialog. -**NOTE:** Set the **"Log name"** (_File_ in the registry) using **Registry Editor**. The **"Security Properties"** dialog doesn't let you change it. +:::note +The **Security Properties** dialog fields map to the following registry values: -**NOTE:** **Maximum log size** corresponds to _MaxSize_ in the registry. Security Properties displays it in KB, whereas **Registry Editor** displays it in bytes: _4,294,901,760 Bytes = 4,194,240 KB_ +| Security Properties field | Registry value | +|---|---| +| Log name | `File` | +| Maximum log size | `MaxSize` (`4,294,901,760 bytes = 4,194,240 KB`) | +| Overwrite events as needed | `Retention = 0` | -**NOTE:** **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry +Registry Editor displays **Maximum log size** in bytes, while Security Properties displays it in KB. You can't change **Log name** from the **Security Properties** dialog — use **Registry Editor** instead. +::: diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md index b2caa0d691..5af14a78cd 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md @@ -71,8 +71,7 @@ deletion. To collect comprehensive audit data, you must configure your file shares for monitoring. Consider the following: -**Step 1 –** [Configure Security Event Log](/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md) to avoid overwriting -of the security logs; Netwrix recommends setting the security log size to the maximum (4GB). Auditor +**Step 1 –** [Configure Security Event Log](/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that security events aren't overwritten. Auditor does not clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the limit. See the [Unity Family Security Configuration Guide](https://support.emc.com/docu69321_Unity-Family-Security-Configuration-Guide.pdf?language=en_US) for diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md index 45de6c99da..40643f1756 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md @@ -6,40 +6,44 @@ sidebar_position: 20 # Configure Security Event Log -## Configure Event Log path, maximum size, and retention using "Registry Editor" +Configure the security event log path, maximum size, and retention on your Dell Data Storage device so that audit data isn't lost when the log fills. Configure the settings in Registry Editor, then verify them in the Computer Management console. -**Step 1 -** On your file server, create a new file system (e.g., with name _events_) with a minimum size of `4GiB` to store -the security log: **Web UI -> Storage -> File -> File System Tab** and press "+". +## Configure Event Log path, maximum size, and retention in Registry Editor -**Step 2 -** Ensure it's accessible with the account for collecting data via -the **"\file_server_name\C$\events"** UNC path. +**Step 1 –** In the Dell **Web UI**, navigate to **Storage → File → File System** and click **+** to create a file system. Name it `events` and set its size to at least 4 GB. This file system stores the security log. -**Step 3 -** On the computer that hosts Auditor Server, open **Registry Editor**: navigate -to **Start -> Run** and type _"regedit"_. +**Step 2 –** Confirm that the account used for data collection can read the share at `\\\C$\events`. -**Step 4 -** Navigate to **File → Connect Network Registry** and specify the _"file server name"_. +**Step 3 –** On the computer where Auditor Server is installed, open **Registry Editor**: navigate +to **Start → Run** and type `regedit`. -**Step 5 -** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security**. +**Step 4 –** Navigate to **File → Connect Network Registry** and specify ``. -**Step 6 -** Set the **File** value to _"C:\events\security.evt"_. +**Step 5 –** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security**. -**Step 7 -** Set the **MaxSize** _ffff0000 (hexadecimal)_ or _4,294,901,760 (decimal)_. Select the matching Base option in the _"Edit DWORD Value"_ dialog before entering the value. +**Step 6 –** Set the **File** value to `C:\events\security.evt`. -**Step 8 -** Set the **Retention** value to _0 (hex or decimal)_. This configures the log to overwrite events as needed instead of retaining them. +**Step 7 –** Set the **MaxSize** value to `ffff0000` (hexadecimal) or `4294901760` (decimal). Select the matching **Base** option in the **Edit DWORD Value** dialog before you enter the value. +**Step 8 –** Set the **Retention** value to `0` (hex or decimal). This configures the log to overwrite events as needed instead of retaining them. -## Verify Event Log settings using **Computer Management** console +## Verify Event Log settings in the Computer Management console -**Step 1 -** On the computer that hosts Auditor Server, open **Computer Managment**: navigate -to **Start -> Run** and type _"compmgmt.msc /computer=file_server_name"_ or right-click _Start_ -and select _"Computer Management"_ in the menu. +**Step 1 –** On the computer where Auditor Server is installed, open **Computer Management**: navigate +to **Start → Run** and type `compmgmt.msc /computer=`, or right-click **Start** and select **Computer Management**. -**Step 2 -** Navigate to **System tools -> Event Viewer -> Classic Event Viewer**, expand the "Global Log" list and -right-click _Security_ and select _Properties_. +**Step 2 –** Navigate to **System Tools → Event Viewer → Windows Logs**, then right-click **Security** and select **Properties**. +**Step 3 –** Confirm the following values: **Log name** shows `C:\events\security.evt`, **Maximum log size** shows `4,194,240 KB`, and **Overwrite events as needed** is selected. If any value doesn't match, correct it in **Registry Editor** and reopen this dialog. -**NOTE:** Set the **"Log name"** (_File_ in the registry) using **Registry Editor**. The **"Security Properties"** dialog doesn't let you change it. +:::note +The **Security Properties** dialog fields map to the following registry values: -**NOTE:** **Maximum log size** corresponds to _MaxSize_ in the registry. Security Properties displays it in KB, whereas **Registry Editor** displays it in bytes: _4,294,901,760 Bytes = 4,194,240 KB_ +| Security Properties field | Registry value | +|---|---| +| Log name | `File` | +| Maximum log size | `MaxSize` (`4,294,901,760 bytes = 4,194,240 KB`) | +| Overwrite events as needed | `Retention = 0` | -**NOTE:** **"Override events as needed"** switch corresponds to _Retention = 0_ in the registry +Registry Editor displays **Maximum log size** in bytes, while Security Properties displays it in KB. You can't change **Log name** from the **Security Properties** dialog — use **Registry Editor** instead. +::: From 94045e53fba165d48579d3aaf2dadf9d92bca2cf Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 18:58:17 +0000 Subject: [PATCH 06/11] fix(vale): auto-fix style issues (Vale + Dale) --- .../configuration/fileservers/delldatastorage/overview.md | 8 ++++---- .../fileservers/delldatastorage/securityeventlog.md | 8 ++++---- .../configuration/fileservers/delldatastorage/overview.md | 8 ++++---- .../fileservers/delldatastorage/securityeventlog.md | 8 ++++---- .../configuration/fileservers/delldatastorage/overview.md | 8 ++++---- .../fileservers/delldatastorage/securityeventlog.md | 8 ++++---- 6 files changed, 24 insertions(+), 24 deletions(-) diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md index 6dc4e1bf48..2939984329 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md @@ -31,7 +31,7 @@ You can configure your IT Infrastructure for monitoring in one of the following - On the Dell Data Storage device: - - CIFS Network Protocol support is required + - Enable CIFS Network Protocol support. - Set Security Event Log Maximum Size to 4GB. - Set the Audit object access policy to _"Success"_ and "Failure" in the Group Policy of the OU that contains the audited Dell VNX/VNXe/Unity/Celerra appliance. @@ -71,11 +71,11 @@ deletion. To collect comprehensive audit data, you must configure your file shares for monitoring. Consider the following: -**Step 1 –** [Configure Security Event Log](/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that security events aren't overwritten. Auditor -does not clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the +**Step 1 –** [Configure Security Event Log](/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that the log doesn't overwrite security events. Auditor +doesn't clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the limit. See the [Unity Family Security Configuration Guide](https://support.emc.com/docu69321_Unity-Family-Security-Configuration-Guide.pdf?language=en_US) for -additional information on how to set logs roll over manually. +additional information about configuring log rollover manually. **Step 2 –** By default, the security log overwrites events older than 10 days, and its size is 512 KB. The default location for the security.evt log is **C:\security.evt**, which corresponds to diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md index 4a36a7039c..a89a5ba892 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md @@ -6,15 +6,15 @@ sidebar_position: 20 # Configure Security Event Log -Configure the security event log path, maximum size, and retention on your Dell Data Storage device so that audit data isn't lost when the log fills. Configure the settings in Registry Editor, then verify them in the Computer Management console. +Configure the security event log path, maximum size, and retention on your Dell Data Storage device so that you don't lose audit data when the log fills. Configure the settings in Registry Editor, then verify them in the Computer Management console. ## Configure Event Log path, maximum size, and retention in Registry Editor **Step 1 –** In the Dell **Web UI**, navigate to **Storage → File → File System** and click **+** to create a file system. Name it `events` and set its size to at least 4 GiB. This file system stores the security log. -**Step 2 –** Confirm that the account used for data collection can read the share at `\\\C$\events`. +**Step 2 –** Confirm that the data collection account can read the share at `\\\C$\events`. -**Step 3 –** On the computer where Auditor Server is installed, open **Registry Editor**: navigate +**Step 3 –** On the computer that hosts Auditor Server, open **Registry Editor**: navigate to **Start → Run** and type `regedit`. **Step 4 –** Navigate to **File → Connect Network Registry** and specify ``. @@ -29,7 +29,7 @@ to **Start → Run** and type `regedit`. ## Verify Event Log settings in the Computer Management console -**Step 1 –** On the computer where Auditor Server is installed, open **Computer Management**: navigate +**Step 1 –** On the computer that hosts Auditor Server, open **Computer Management**: navigate to **Start → Run** and type `compmgmt.msc /computer=`, or right-click **Start** and select **Computer Management**. **Step 2 –** Navigate to **System Tools → Event Viewer → Windows Logs**, then right-click **Security** and select **Properties**. diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md index d708b4057d..979a6900d0 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md @@ -31,7 +31,7 @@ You can configure your IT Infrastructure for monitoring in one of the following - On the Dell Data Storage device: - - CIFS Network Protocol support is required + - Enable CIFS Network Protocol support. - Set Security Event Log Maximum Size to 4GB. - Set the Audit object access policy to _"Success"_ and "Failure" in the Group Policy of the OU that contains the audited Dell VNX/VNXe/Unity/Celerra appliance. @@ -71,11 +71,11 @@ deletion. To collect comprehensive audit data, you must configure your file shares for monitoring. Consider the following: -**Step 1 –** [Configure Security Event Log](/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that security events aren't overwritten. Auditor -does not clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the +**Step 1 –** [Configure Security Event Log](/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that the log doesn't overwrite security events. Auditor +doesn't clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the limit. See the [Unity Family Security Configuration Guide](https://support.emc.com/docu69321_Unity-Family-Security-Configuration-Guide.pdf?language=en_US) for -additional information on how to set logs roll over manually. +additional information about configuring log rollover manually. **Step 2 –** By default, the security log overwrites events older than 10 days, and its size is 512 KB. The default location for the security.evt log is **C:\security.evt**, which corresponds to diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md index 4a36a7039c..a89a5ba892 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md @@ -6,15 +6,15 @@ sidebar_position: 20 # Configure Security Event Log -Configure the security event log path, maximum size, and retention on your Dell Data Storage device so that audit data isn't lost when the log fills. Configure the settings in Registry Editor, then verify them in the Computer Management console. +Configure the security event log path, maximum size, and retention on your Dell Data Storage device so that you don't lose audit data when the log fills. Configure the settings in Registry Editor, then verify them in the Computer Management console. ## Configure Event Log path, maximum size, and retention in Registry Editor **Step 1 –** In the Dell **Web UI**, navigate to **Storage → File → File System** and click **+** to create a file system. Name it `events` and set its size to at least 4 GiB. This file system stores the security log. -**Step 2 –** Confirm that the account used for data collection can read the share at `\\\C$\events`. +**Step 2 –** Confirm that the data collection account can read the share at `\\\C$\events`. -**Step 3 –** On the computer where Auditor Server is installed, open **Registry Editor**: navigate +**Step 3 –** On the computer that hosts Auditor Server, open **Registry Editor**: navigate to **Start → Run** and type `regedit`. **Step 4 –** Navigate to **File → Connect Network Registry** and specify ``. @@ -29,7 +29,7 @@ to **Start → Run** and type `regedit`. ## Verify Event Log settings in the Computer Management console -**Step 1 –** On the computer where Auditor Server is installed, open **Computer Management**: navigate +**Step 1 –** On the computer that hosts Auditor Server, open **Computer Management**: navigate to **Start → Run** and type `compmgmt.msc /computer=`, or right-click **Start** and select **Computer Management**. **Step 2 –** Navigate to **System Tools → Event Viewer → Windows Logs**, then right-click **Security** and select **Properties**. diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md index 5af14a78cd..b3a75fff3d 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md @@ -31,7 +31,7 @@ You can configure your IT Infrastructure for monitoring in one of the following - On the Dell Data Storage device: - - CIFS Network Protocol support is required + - Enable CIFS Network Protocol support. - Set Security Event Log Maximum Size to 4GB. - Set the Audit object access policy to _"Success"_ and "Failure" in the Group Policy of the OU that contains the audited Dell VNX/VNXe/Unity/Celerra appliance. @@ -71,11 +71,11 @@ deletion. To collect comprehensive audit data, you must configure your file shares for monitoring. Consider the following: -**Step 1 –** [Configure Security Event Log](/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that security events aren't overwritten. Auditor -does not clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the +**Step 1 –** [Configure Security Event Log](/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that the log doesn't overwrite security events. Auditor +doesn't clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the limit. See the [Unity Family Security Configuration Guide](https://support.emc.com/docu69321_Unity-Family-Security-Configuration-Guide.pdf?language=en_US) for -additional information on how to set logs roll over manually. +additional information about configuring log rollover manually. **Step 2 –** By default, the security log overwrites events older than 10 days, and its size is 512 KB. The default location for the security.evt log is **C:\security.evt**, which corresponds to diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md index 40643f1756..0aeb7dcdba 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md @@ -6,15 +6,15 @@ sidebar_position: 20 # Configure Security Event Log -Configure the security event log path, maximum size, and retention on your Dell Data Storage device so that audit data isn't lost when the log fills. Configure the settings in Registry Editor, then verify them in the Computer Management console. +Configure the security event log path, maximum size, and retention on your Dell Data Storage device so that you don't lose audit data when the log fills. Configure the settings in Registry Editor, then verify them in the Computer Management console. ## Configure Event Log path, maximum size, and retention in Registry Editor **Step 1 –** In the Dell **Web UI**, navigate to **Storage → File → File System** and click **+** to create a file system. Name it `events` and set its size to at least 4 GB. This file system stores the security log. -**Step 2 –** Confirm that the account used for data collection can read the share at `\\\C$\events`. +**Step 2 –** Confirm that the data collection account can read the share at `\\\C$\events`. -**Step 3 –** On the computer where Auditor Server is installed, open **Registry Editor**: navigate +**Step 3 –** On the computer that hosts Auditor Server, open **Registry Editor**: navigate to **Start → Run** and type `regedit`. **Step 4 –** Navigate to **File → Connect Network Registry** and specify ``. @@ -29,7 +29,7 @@ to **Start → Run** and type `regedit`. ## Verify Event Log settings in the Computer Management console -**Step 1 –** On the computer where Auditor Server is installed, open **Computer Management**: navigate +**Step 1 –** On the computer that hosts Auditor Server, open **Computer Management**: navigate to **Start → Run** and type `compmgmt.msc /computer=`, or right-click **Start** and select **Computer Management**. **Step 2 –** Navigate to **System Tools → Event Viewer → Windows Logs**, then right-click **Security** and select **Properties**. From b753e4b5af46235b30ddab516f00dcc4420ed3f9 Mon Sep 17 00:00:00 2001 From: Nikolay Budeev Date: Tue, 25 Aug 2026 17:16:05 +0200 Subject: [PATCH 07/11] Address remaining PR editorial review feedback on Dell Data Storage docs Applies the structure/clarity/completeness fixes from the PR #1418 review across 10.7-10.9 (heading split, remote Computer Management step, verification checklist, MaxSize/Security Properties wording, 4 GiB consistency, overview.md step reordering, and objectaccess.md lead-in). The dropped mount-step gap is intentionally left unaddressed per reviewer decision. --- .../delldatastorage/objectaccess.md | 6 +- .../fileservers/delldatastorage/overview.md | 35 ++++++----- .../delldatastorage/securityeventlog.md | 58 ++++++++++++++----- .../delldatastorage/objectaccess.md | 6 +- .../fileservers/delldatastorage/overview.md | 35 ++++++----- .../delldatastorage/securityeventlog.md | 58 ++++++++++++++----- .../delldatastorage/objectaccess.md | 6 +- .../fileservers/delldatastorage/overview.md | 35 ++++++----- .../delldatastorage/securityeventlog.md | 58 ++++++++++++++----- 9 files changed, 195 insertions(+), 102 deletions(-) diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md index 8db4497e74..7f27472681 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md @@ -6,6 +6,8 @@ sidebar_position: 30 # Configure Audit Object Access Policy +Configure the Audit object access policy on the OU that contains your Dell Data Storage appliance. + Netwrix recommends that you avoid linking a GPO to the top level of the domain due to the potential impact. Instead, create a new organization unit for your file servers within your domain and assign GPO there. For instructions on creating a new OU, see the Microsoft article @@ -46,8 +48,8 @@ node on the left and navigate to **Policies → Windows Settings → Security Se where `` is the name of the target Unity\VNX server. - To update group policies for Dell VNX, you must log in as the 'nasadmin' user. + To update group policies for Dell VNX, you must log in as the `nasadmin` user. -You can configure advanced audit policy to narrow the range of events the product tracks and +You can configure advanced audit policy to narrow the range of events Auditor tracks and records, preventing your AuditArchive and the Security event log from overfilling. See the [Configure Security Event Log](/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md) topic for additional information. diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md index 2939984329..8efecbd992 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md @@ -6,8 +6,9 @@ sidebar_position: 10 # Dell Data Storage -**NOTE:** Dell Data Storage collectively refers to Dell VNX, VNXe, Celerra, and Unity NAS -devices. +:::note +Dell Data Storage collectively refers to Dell VNX, VNXe, Celerra, and Unity NAS devices. +::: Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment @@ -15,10 +16,11 @@ and on the Auditor console computer. Configuring your IT infrastructure may also certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** You must exclude the folder associated with Netwrix Auditor from antivirus scanning. -See the +:::warning +You must exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. +::: You can configure your IT Infrastructure for monitoring in one of the following ways: @@ -32,7 +34,7 @@ You can configure your IT Infrastructure for monitoring in one of the following - On the Dell Data Storage device: - Enable CIFS Network Protocol support. - - Set Security Event Log Maximum Size to 4GB. + - Set the security event log maximum size to 4 GiB (4294901760 bytes). - Set the Audit object access policy to _"Success"_ and "Failure" in the Group Policy of the OU that contains the audited Dell VNX/VNXe/Unity/Celerra appliance. - Configure audit settings for CIFS File Shares. For a security principal (e.g., @@ -59,9 +61,10 @@ First, you should decide on the objects and actions you want to track. Consider - The actions Auditor reports vary depending on the file server type and the audited object (file, folder, or share). -- Monitoring and reporting of the Dell Data Storage systems may not provide the results you expect - due to native Dell audit peculiarities. See the [File Servers](/docs/auditor/10.7/configuration/fileservers/overview.md) topic for - additional information. +- Monitoring and reporting of the Dell Data Storage systems may not provide the results you expect, + because Dell's native auditing does not record every action Auditor can report on. See the + [File Servers](/docs/auditor/10.7/configuration/fileservers/overview.md) topic for additional + information. For example, the _change_ operation (in Auditor terminology) includes creation, modification, and deletion. @@ -71,20 +74,20 @@ deletion. To collect comprehensive audit data, you must configure your file shares for monitoring. Consider the following: -**Step 1 –** [Configure Security Event Log](/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that the log doesn't overwrite security events. Auditor +By default, the security log overwrites events older than 10 days, and its size is 512 KB. The +default location for the security.evt log is **C:\security.evt**, which corresponds to the root +partition of the Data Mover. To increase the security log size, you must move it from the Data +Mover root folder. + +**Step 1 –** [Configure Security Event Log](/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that the log holds enough events between data collections. Auditor doesn't clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the limit. See the [Unity Family Security Configuration Guide](https://support.emc.com/docu69321_Unity-Family-Security-Configuration-Guide.pdf?language=en_US) for additional information about configuring log rollover manually. -**Step 2 –** By default, the security log overwrites events older than 10 days, and its size is -512 KB. The default location for the security.evt log is **C:\security.evt**, which corresponds to -the root partition of the Data Mover. To increase the security log size, you must move it from the -Data Mover root folder. - -**Step 3 –** [Configure Audit Object Access Policy](/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md). Set the Audit object access +**Step 2 –** [Configure Audit Object Access Policy](/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md). Set the Audit object access policy to "Success" and "Failure" in the Group Policy of the OU that contains your Dell VNX/VNXe/Unity/Celerra appliance. For more information on VNX/VNXe/Unity/Celerra GPO support, refer to the documentation Dell provides. -**Step 4 –** [Configure Audit Settings for CIFS File Shares on Dell Data Storage](/docs/auditor/10.7/configuration/fileservers/delldatastorage/cifss.md) +**Step 3 –** [Configure Audit Settings for CIFS File Shares on Dell Data Storage](/docs/auditor/10.7/configuration/fileservers/delldatastorage/cifss.md) diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md index a89a5ba892..1f509ec543 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md @@ -6,35 +6,59 @@ sidebar_position: 20 # Configure Security Event Log -Configure the security event log path, maximum size, and retention on your Dell Data Storage device so that you don't lose audit data when the log fills. Configure the settings in Registry Editor, then verify them in the Computer Management console. +Configure the security event log path, maximum size, and retention on your Dell Data +Storage device so that you don't lose audit data when the log fills. Create the file +system in the Dell Web UI, configure the registry values in Registry Editor, then +verify them in the Computer Management console. -## Configure Event Log path, maximum size, and retention in Registry Editor +## Create the file system for the security log -**Step 1 –** In the Dell **Web UI**, navigate to **Storage → File → File System** and click **+** to create a file system. Name it `events` and set its size to at least 4 GiB. This file system stores the security log. +**Step 1 –** In the Dell **Web UI**, navigate to **Storage → File → File System** and +click **+** to create a file system. Name it `events` and set its size to at least +4 GiB. This file system stores the security log. -**Step 2 –** Confirm that the data collection account can read the share at `\\\C$\events`. +**Step 2 –** Confirm that the account specified for data collection in the monitoring +plan can read the share at `\\\C$\events`. -**Step 3 –** On the computer that hosts Auditor Server, open **Registry Editor**: navigate -to **Start → Run** and type `regedit`. +## Configure Event Log values in Registry Editor -**Step 4 –** Navigate to **File → Connect Network Registry** and specify ``. +**Step 1 –** On the computer that hosts Auditor Server, open **Registry Editor**: +navigate to **Start → Run** and type `regedit`. -**Step 5 –** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security**. +**Step 2 –** Navigate to **File → Connect Network Registry** and specify +``. -**Step 6 –** Set the **File** value to `C:\events\security.evt`. +**Step 3 –** Navigate to +**HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security**. -**Step 7 –** Set the **MaxSize** value to `ffff0000` (hexadecimal) or `4294901760` (decimal). Select the matching **Base** option in the **Edit DWORD Value** dialog before you enter the value. +**Step 4 –** Set the **File** value to `C:\events\security.evt`. -**Step 8 –** Set the **Retention** value to `0` (hex or decimal). This configures the log to overwrite events as needed instead of retaining them. +**Step 5 –** Set the **MaxSize** value to `ffff0000` (hexadecimal) or `4294901760` +(decimal). Select the matching **Base** option in the **Edit DWORD Value** dialog +before you enter the value. + +**Step 6 –** Set the **Retention** value to `0`. The value is the same in +hexadecimal and decimal. This configures the log to overwrite events as needed +instead of retaining them. ## Verify Event Log settings in the Computer Management console -**Step 1 –** On the computer that hosts Auditor Server, open **Computer Management**: navigate -to **Start → Run** and type `compmgmt.msc /computer=`, or right-click **Start** and select **Computer Management**. +**Step 1 –** On the computer that hosts Auditor Server, open **Computer Management**: +navigate to **Start → Run** and type `compmgmt.msc /computer=`, or +right-click **Start**, select **Computer Management**, then right-click **Computer +Management (Local)** and select **Connect to another computer** to specify +``. + +**Step 2 –** Navigate to **System Tools → Event Viewer → Windows Logs**, then +right-click **Security** and select **Properties**. + +**Step 3 –** Confirm the following values: -**Step 2 –** Navigate to **System Tools → Event Viewer → Windows Logs**, then right-click **Security** and select **Properties**. +- **Log name**: `C:\events\security.evt` +- **Maximum log size**: `4,194,240 KB` +- **Overwrite events as needed**: selected -**Step 3 –** Confirm the following values: **Log name** shows `C:\events\security.evt`, **Maximum log size** shows `4,194,240 KB`, and **Overwrite events as needed** is selected. If any value doesn't match, correct it in **Registry Editor** and reopen this dialog. +If any value doesn't match, correct it in **Registry Editor** and reopen this dialog. :::note The **Security Properties** dialog fields map to the following registry values: @@ -45,5 +69,7 @@ The **Security Properties** dialog fields map to the following registry values: | Maximum log size | `MaxSize` (`4,294,901,760 bytes = 4,194,240 KB`) | | Overwrite events as needed | `Retention = 0` | -Registry Editor displays **Maximum log size** in bytes, while Security Properties displays it in KB. You can't change **Log name** from the **Security Properties** dialog — use **Registry Editor** instead. +The MaxSize registry value uses bytes, while Maximum log size in Security Properties +uses KB. You can't change **Log name** from the **Security +Properties** dialog — use **Registry Editor** instead. ::: diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md index 79eda90ade..e49c5ba7c2 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md @@ -6,6 +6,8 @@ sidebar_position: 30 # Configure Audit Object Access Policy +Configure the Audit object access policy on the OU that contains your Dell Data Storage appliance. + Netwrix recommends that you avoid linking a GPO to the top level of the domain due to the potential impact. Instead, create a new organization unit for your file servers within your domain and assign GPO there. For instructions on creating a new OU, see the Microsoft article @@ -46,8 +48,8 @@ node on the left and navigate to **Policies → Windows Settings → Security Se where `` is the name of the target Unity\VNX server. - To update group policies for Dell VNX, you must log in as the 'nasadmin' user. + To update group policies for Dell VNX, you must log in as the `nasadmin` user. -You can configure advanced audit policy to narrow the range of events the product tracks and +You can configure advanced audit policy to narrow the range of events Auditor tracks and records, preventing your AuditArchive and the Security event log from overfilling. See the [Configure Security Event Log](/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md) topic for additional information. diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md index 979a6900d0..e3997eeabb 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md @@ -6,8 +6,9 @@ sidebar_position: 10 # Dell Data Storage -**NOTE:** Dell Data Storage collectively refers to Dell VNX, VNXe, Celerra, and Unity NAS -devices. +:::note +Dell Data Storage collectively refers to Dell VNX, VNXe, Celerra, and Unity NAS devices. +::: Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment @@ -15,10 +16,11 @@ and on the Auditor console computer. Configuring your IT infrastructure may also certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** You must exclude the folder associated with Netwrix Auditor from antivirus scanning. -See the +:::warning +You must exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. +::: You can configure your IT Infrastructure for monitoring in one of the following ways: @@ -32,7 +34,7 @@ You can configure your IT Infrastructure for monitoring in one of the following - On the Dell Data Storage device: - Enable CIFS Network Protocol support. - - Set Security Event Log Maximum Size to 4GB. + - Set the security event log maximum size to 4 GiB (4294901760 bytes). - Set the Audit object access policy to _"Success"_ and "Failure" in the Group Policy of the OU that contains the audited Dell VNX/VNXe/Unity/Celerra appliance. - Configure audit settings for CIFS File Shares. For a security principal (e.g., @@ -59,9 +61,10 @@ First, you should decide on the objects and actions you want to track. Consider - The actions Auditor reports vary depending on the file server type and the audited object (file, folder, or share). -- Monitoring and reporting of the Dell Data Storage systems may not provide the results you expect - due to native Dell audit peculiarities. See the [File Servers](/docs/auditor/10.8/configuration/fileservers/overview.md) topic for - additional information. +- Monitoring and reporting of the Dell Data Storage systems may not provide the results you expect, + because Dell's native auditing does not record every action Auditor can report on. See the + [File Servers](/docs/auditor/10.8/configuration/fileservers/overview.md) topic for additional + information. For example, the _change_ operation (in Auditor terminology) includes creation, modification, and deletion. @@ -71,20 +74,20 @@ deletion. To collect comprehensive audit data, you must configure your file shares for monitoring. Consider the following: -**Step 1 –** [Configure Security Event Log](/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that the log doesn't overwrite security events. Auditor +By default, the security log overwrites events older than 10 days, and its size is 512 KB. The +default location for the security.evt log is **C:\security.evt**, which corresponds to the root +partition of the Data Mover. To increase the security log size, you must move it from the Data +Mover root folder. + +**Step 1 –** [Configure Security Event Log](/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that the log holds enough events between data collections. Auditor doesn't clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the limit. See the [Unity Family Security Configuration Guide](https://support.emc.com/docu69321_Unity-Family-Security-Configuration-Guide.pdf?language=en_US) for additional information about configuring log rollover manually. -**Step 2 –** By default, the security log overwrites events older than 10 days, and its size is -512 KB. The default location for the security.evt log is **C:\security.evt**, which corresponds to -the root partition of the Data Mover. To increase the security log size, you must move it from the -Data Mover root folder. - -**Step 3 –** [Configure Audit Object Access Policy](/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md). Set the Audit object access +**Step 2 –** [Configure Audit Object Access Policy](/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md). Set the Audit object access policy to "Success" and "Failure" in the Group Policy of the OU that contains your Dell VNX/VNXe/Unity/Celerra appliance. For more information on VNX/VNXe/Unity/Celerra GPO support, refer to the documentation Dell provides. -**Step 4 –** [Configure Audit Settings for CIFS File Shares on Dell Data Storage](/docs/auditor/10.8/configuration/fileservers/delldatastorage/cifss.md) +**Step 3 –** [Configure Audit Settings for CIFS File Shares on Dell Data Storage](/docs/auditor/10.8/configuration/fileservers/delldatastorage/cifss.md) diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md index a89a5ba892..1f509ec543 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md @@ -6,35 +6,59 @@ sidebar_position: 20 # Configure Security Event Log -Configure the security event log path, maximum size, and retention on your Dell Data Storage device so that you don't lose audit data when the log fills. Configure the settings in Registry Editor, then verify them in the Computer Management console. +Configure the security event log path, maximum size, and retention on your Dell Data +Storage device so that you don't lose audit data when the log fills. Create the file +system in the Dell Web UI, configure the registry values in Registry Editor, then +verify them in the Computer Management console. -## Configure Event Log path, maximum size, and retention in Registry Editor +## Create the file system for the security log -**Step 1 –** In the Dell **Web UI**, navigate to **Storage → File → File System** and click **+** to create a file system. Name it `events` and set its size to at least 4 GiB. This file system stores the security log. +**Step 1 –** In the Dell **Web UI**, navigate to **Storage → File → File System** and +click **+** to create a file system. Name it `events` and set its size to at least +4 GiB. This file system stores the security log. -**Step 2 –** Confirm that the data collection account can read the share at `\\\C$\events`. +**Step 2 –** Confirm that the account specified for data collection in the monitoring +plan can read the share at `\\\C$\events`. -**Step 3 –** On the computer that hosts Auditor Server, open **Registry Editor**: navigate -to **Start → Run** and type `regedit`. +## Configure Event Log values in Registry Editor -**Step 4 –** Navigate to **File → Connect Network Registry** and specify ``. +**Step 1 –** On the computer that hosts Auditor Server, open **Registry Editor**: +navigate to **Start → Run** and type `regedit`. -**Step 5 –** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security**. +**Step 2 –** Navigate to **File → Connect Network Registry** and specify +``. -**Step 6 –** Set the **File** value to `C:\events\security.evt`. +**Step 3 –** Navigate to +**HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security**. -**Step 7 –** Set the **MaxSize** value to `ffff0000` (hexadecimal) or `4294901760` (decimal). Select the matching **Base** option in the **Edit DWORD Value** dialog before you enter the value. +**Step 4 –** Set the **File** value to `C:\events\security.evt`. -**Step 8 –** Set the **Retention** value to `0` (hex or decimal). This configures the log to overwrite events as needed instead of retaining them. +**Step 5 –** Set the **MaxSize** value to `ffff0000` (hexadecimal) or `4294901760` +(decimal). Select the matching **Base** option in the **Edit DWORD Value** dialog +before you enter the value. + +**Step 6 –** Set the **Retention** value to `0`. The value is the same in +hexadecimal and decimal. This configures the log to overwrite events as needed +instead of retaining them. ## Verify Event Log settings in the Computer Management console -**Step 1 –** On the computer that hosts Auditor Server, open **Computer Management**: navigate -to **Start → Run** and type `compmgmt.msc /computer=`, or right-click **Start** and select **Computer Management**. +**Step 1 –** On the computer that hosts Auditor Server, open **Computer Management**: +navigate to **Start → Run** and type `compmgmt.msc /computer=`, or +right-click **Start**, select **Computer Management**, then right-click **Computer +Management (Local)** and select **Connect to another computer** to specify +``. + +**Step 2 –** Navigate to **System Tools → Event Viewer → Windows Logs**, then +right-click **Security** and select **Properties**. + +**Step 3 –** Confirm the following values: -**Step 2 –** Navigate to **System Tools → Event Viewer → Windows Logs**, then right-click **Security** and select **Properties**. +- **Log name**: `C:\events\security.evt` +- **Maximum log size**: `4,194,240 KB` +- **Overwrite events as needed**: selected -**Step 3 –** Confirm the following values: **Log name** shows `C:\events\security.evt`, **Maximum log size** shows `4,194,240 KB`, and **Overwrite events as needed** is selected. If any value doesn't match, correct it in **Registry Editor** and reopen this dialog. +If any value doesn't match, correct it in **Registry Editor** and reopen this dialog. :::note The **Security Properties** dialog fields map to the following registry values: @@ -45,5 +69,7 @@ The **Security Properties** dialog fields map to the following registry values: | Maximum log size | `MaxSize` (`4,294,901,760 bytes = 4,194,240 KB`) | | Overwrite events as needed | `Retention = 0` | -Registry Editor displays **Maximum log size** in bytes, while Security Properties displays it in KB. You can't change **Log name** from the **Security Properties** dialog — use **Registry Editor** instead. +The MaxSize registry value uses bytes, while Maximum log size in Security Properties +uses KB. You can't change **Log name** from the **Security +Properties** dialog — use **Registry Editor** instead. ::: diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md index fef43d2376..abce0927cc 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md @@ -6,6 +6,8 @@ sidebar_position: 30 # Configure Audit Object Access Policy +Configure the Audit object access policy on the OU that contains your Dell Data Storage appliance. + Netwrix recommends that you avoid linking a GPO to the top level of the domain due to the potential impact. Instead, create a new organization unit for your file servers within your domain and assign GPO there. For instructions on creating a new OU, see the Microsoft article @@ -46,8 +48,8 @@ node on the left and navigate to **Policies → Windows Settings → Security Se where `` is the name of the target Unity\VNX server. - To update group policies for Dell VNX, you must log in as the 'nasadmin' user. + To update group policies for Dell VNX, you must log in as the `nasadmin` user. -You can configure advanced audit policy to narrow the range of events the product tracks and +You can configure advanced audit policy to narrow the range of events Auditor tracks and records, preventing your AuditArchive and the Security event log from overfilling. See the [Configure Security Event Log](/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md) topic for additional information. diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md index b3a75fff3d..267827adc6 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md @@ -6,8 +6,9 @@ sidebar_position: 10 # Dell Data Storage -**NOTE:** Dell Data Storage collectively refers to Dell VNX, VNXe, Celerra, and Unity NAS -devices. +:::note +Dell Data Storage collectively refers to Dell VNX, VNXe, Celerra, and Unity NAS devices. +::: Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment @@ -15,10 +16,11 @@ and on the Auditor console computer. Configuring your IT infrastructure may also certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** You must exclude the folder associated with Netwrix Auditor from antivirus scanning. -See the +:::warning +You must exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. +::: You can configure your IT Infrastructure for monitoring in one of the following ways: @@ -32,7 +34,7 @@ You can configure your IT Infrastructure for monitoring in one of the following - On the Dell Data Storage device: - Enable CIFS Network Protocol support. - - Set Security Event Log Maximum Size to 4GB. + - Set the security event log maximum size to 4 GiB (4294901760 bytes). - Set the Audit object access policy to _"Success"_ and "Failure" in the Group Policy of the OU that contains the audited Dell VNX/VNXe/Unity/Celerra appliance. - Configure audit settings for CIFS File Shares. For a security principal (e.g., @@ -59,9 +61,10 @@ First, you should decide on the objects and actions you want to track. Consider - The actions Auditor reports vary depending on the file server type and the audited object (file, folder, or share). -- Monitoring and reporting of the Dell Data Storage systems may not provide the results you expect - due to native Dell audit peculiarities. See the [File Servers](/docs/auditor/10.9/configuration/fileservers/overview.md) topic for - additional information. +- Monitoring and reporting of the Dell Data Storage systems may not provide the results you expect, + because Dell's native auditing does not record every action Auditor can report on. See the + [File Servers](/docs/auditor/10.9/configuration/fileservers/overview.md) topic for additional + information. For example, the _change_ operation (in Auditor terminology) includes creation, modification, and deletion. @@ -71,20 +74,20 @@ deletion. To collect comprehensive audit data, you must configure your file shares for monitoring. Consider the following: -**Step 1 –** [Configure Security Event Log](/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that the log doesn't overwrite security events. Auditor +By default, the security log overwrites events older than 10 days, and its size is 512 KB. The +default location for the security.evt log is **C:\security.evt**, which corresponds to the root +partition of the Data Mover. To increase the security log size, you must move it from the Data +Mover root folder. + +**Step 1 –** [Configure Security Event Log](/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that the log holds enough events between data collections. Auditor doesn't clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the limit. See the [Unity Family Security Configuration Guide](https://support.emc.com/docu69321_Unity-Family-Security-Configuration-Guide.pdf?language=en_US) for additional information about configuring log rollover manually. -**Step 2 –** By default, the security log overwrites events older than 10 days, and its size is -512 KB. The default location for the security.evt log is **C:\security.evt**, which corresponds to -the root partition of the Data Mover. To increase the security log size, you must move it from the -Data Mover root folder. - -**Step 3 –** [Configure Audit Object Access Policy](/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md). Set the Audit object access +**Step 2 –** [Configure Audit Object Access Policy](/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md). Set the Audit object access policy to "Success" and "Failure" in the Group Policy of the OU that contains your Dell VNX/VNXe/Unity/Celerra appliance. For more information on VNX/VNXe/Unity/Celerra GPO support, refer to the documentation Dell provides. -**Step 4 –** [Configure Audit Settings for CIFS File Shares on Dell Data Storage](/docs/auditor/10.9/configuration/fileservers/delldatastorage/cifss.md) +**Step 3 –** [Configure Audit Settings for CIFS File Shares on Dell Data Storage](/docs/auditor/10.9/configuration/fileservers/delldatastorage/cifss.md) diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md index 0aeb7dcdba..1f509ec543 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md @@ -6,35 +6,59 @@ sidebar_position: 20 # Configure Security Event Log -Configure the security event log path, maximum size, and retention on your Dell Data Storage device so that you don't lose audit data when the log fills. Configure the settings in Registry Editor, then verify them in the Computer Management console. +Configure the security event log path, maximum size, and retention on your Dell Data +Storage device so that you don't lose audit data when the log fills. Create the file +system in the Dell Web UI, configure the registry values in Registry Editor, then +verify them in the Computer Management console. -## Configure Event Log path, maximum size, and retention in Registry Editor +## Create the file system for the security log -**Step 1 –** In the Dell **Web UI**, navigate to **Storage → File → File System** and click **+** to create a file system. Name it `events` and set its size to at least 4 GB. This file system stores the security log. +**Step 1 –** In the Dell **Web UI**, navigate to **Storage → File → File System** and +click **+** to create a file system. Name it `events` and set its size to at least +4 GiB. This file system stores the security log. -**Step 2 –** Confirm that the data collection account can read the share at `\\\C$\events`. +**Step 2 –** Confirm that the account specified for data collection in the monitoring +plan can read the share at `\\\C$\events`. -**Step 3 –** On the computer that hosts Auditor Server, open **Registry Editor**: navigate -to **Start → Run** and type `regedit`. +## Configure Event Log values in Registry Editor -**Step 4 –** Navigate to **File → Connect Network Registry** and specify ``. +**Step 1 –** On the computer that hosts Auditor Server, open **Registry Editor**: +navigate to **Start → Run** and type `regedit`. -**Step 5 –** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security**. +**Step 2 –** Navigate to **File → Connect Network Registry** and specify +``. -**Step 6 –** Set the **File** value to `C:\events\security.evt`. +**Step 3 –** Navigate to +**HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security**. -**Step 7 –** Set the **MaxSize** value to `ffff0000` (hexadecimal) or `4294901760` (decimal). Select the matching **Base** option in the **Edit DWORD Value** dialog before you enter the value. +**Step 4 –** Set the **File** value to `C:\events\security.evt`. -**Step 8 –** Set the **Retention** value to `0` (hex or decimal). This configures the log to overwrite events as needed instead of retaining them. +**Step 5 –** Set the **MaxSize** value to `ffff0000` (hexadecimal) or `4294901760` +(decimal). Select the matching **Base** option in the **Edit DWORD Value** dialog +before you enter the value. + +**Step 6 –** Set the **Retention** value to `0`. The value is the same in +hexadecimal and decimal. This configures the log to overwrite events as needed +instead of retaining them. ## Verify Event Log settings in the Computer Management console -**Step 1 –** On the computer that hosts Auditor Server, open **Computer Management**: navigate -to **Start → Run** and type `compmgmt.msc /computer=`, or right-click **Start** and select **Computer Management**. +**Step 1 –** On the computer that hosts Auditor Server, open **Computer Management**: +navigate to **Start → Run** and type `compmgmt.msc /computer=`, or +right-click **Start**, select **Computer Management**, then right-click **Computer +Management (Local)** and select **Connect to another computer** to specify +``. + +**Step 2 –** Navigate to **System Tools → Event Viewer → Windows Logs**, then +right-click **Security** and select **Properties**. + +**Step 3 –** Confirm the following values: -**Step 2 –** Navigate to **System Tools → Event Viewer → Windows Logs**, then right-click **Security** and select **Properties**. +- **Log name**: `C:\events\security.evt` +- **Maximum log size**: `4,194,240 KB` +- **Overwrite events as needed**: selected -**Step 3 –** Confirm the following values: **Log name** shows `C:\events\security.evt`, **Maximum log size** shows `4,194,240 KB`, and **Overwrite events as needed** is selected. If any value doesn't match, correct it in **Registry Editor** and reopen this dialog. +If any value doesn't match, correct it in **Registry Editor** and reopen this dialog. :::note The **Security Properties** dialog fields map to the following registry values: @@ -45,5 +69,7 @@ The **Security Properties** dialog fields map to the following registry values: | Maximum log size | `MaxSize` (`4,294,901,760 bytes = 4,194,240 KB`) | | Overwrite events as needed | `Retention = 0` | -Registry Editor displays **Maximum log size** in bytes, while Security Properties displays it in KB. You can't change **Log name** from the **Security Properties** dialog — use **Registry Editor** instead. +The MaxSize registry value uses bytes, while Maximum log size in Security Properties +uses KB. You can't change **Log name** from the **Security +Properties** dialog — use **Registry Editor** instead. ::: From c901e256b193aee8575978721a074654f9441bbb Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Tue, 25 Aug 2026 15:20:38 +0000 Subject: [PATCH 08/11] fix(vale): auto-fix style issues (Vale + Dale) --- .../fileservers/delldatastorage/objectaccess.md | 2 +- .../configuration/fileservers/delldatastorage/overview.md | 8 ++++---- .../fileservers/delldatastorage/objectaccess.md | 2 +- .../configuration/fileservers/delldatastorage/overview.md | 8 ++++---- .../fileservers/delldatastorage/objectaccess.md | 2 +- .../configuration/fileservers/delldatastorage/overview.md | 8 ++++---- 6 files changed, 15 insertions(+), 15 deletions(-) diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md index 7f27472681..7df3821798 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md @@ -51,5 +51,5 @@ node on the left and navigate to **Policies → Windows Settings → Security Se To update group policies for Dell VNX, you must log in as the `nasadmin` user. You can configure advanced audit policy to narrow the range of events Auditor tracks and -records, preventing your AuditArchive and the Security event log from overfilling. See the +records. This prevents your AuditArchive and the Security event log from overfilling. See the [Configure Security Event Log](/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md) topic for additional information. diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md index 8efecbd992..09ad03863c 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md @@ -13,8 +13,8 @@ Dell Data Storage collectively refers to Dell VNX, VNXe, Celerra, and Unity NAS Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data. +certain built-in Windows services, etc. You must configure auditing properly to ensure audit data +integrity; otherwise, your change reports may contain warnings, errors, or incomplete audit data. :::warning You must exclude the folder associated with Netwrix Auditor from antivirus scanning. See the @@ -57,12 +57,12 @@ You can configure your IT Infrastructure for monitoring in one of the following these shares, you must enable the local-to-local, local-to-remote, remote-to-local, and remote-to-remote symbolic link evaluations on the computer that hosts Auditor Server. -First, you should decide on the objects and actions you want to track. Consider the following: +First, decide on the objects and actions you want to track. Consider the following: - The actions Auditor reports vary depending on the file server type and the audited object (file, folder, or share). - Monitoring and reporting of the Dell Data Storage systems may not provide the results you expect, - because Dell's native auditing does not record every action Auditor can report on. See the + because Dell's native auditing doesn't record every action Auditor can report on. See the [File Servers](/docs/auditor/10.7/configuration/fileservers/overview.md) topic for additional information. diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md index e49c5ba7c2..0b3c7e9e52 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md @@ -51,5 +51,5 @@ node on the left and navigate to **Policies → Windows Settings → Security Se To update group policies for Dell VNX, you must log in as the `nasadmin` user. You can configure advanced audit policy to narrow the range of events Auditor tracks and -records, preventing your AuditArchive and the Security event log from overfilling. See the +records. This prevents your AuditArchive and the Security event log from overfilling. See the [Configure Security Event Log](/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md) topic for additional information. diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md index e3997eeabb..f6e4c49714 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md @@ -13,8 +13,8 @@ Dell Data Storage collectively refers to Dell VNX, VNXe, Celerra, and Unity NAS Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data. +certain built-in Windows services, etc. You must configure auditing properly to ensure audit data +integrity; otherwise, your change reports may contain warnings, errors, or incomplete audit data. :::warning You must exclude the folder associated with Netwrix Auditor from antivirus scanning. See the @@ -57,12 +57,12 @@ You can configure your IT Infrastructure for monitoring in one of the following these shares, you must enable the local-to-local, local-to-remote, remote-to-local, and remote-to-remote symbolic link evaluations on the computer that hosts Auditor Server. -First, you should decide on the objects and actions you want to track. Consider the following: +First, decide on the objects and actions you want to track. Consider the following: - The actions Auditor reports vary depending on the file server type and the audited object (file, folder, or share). - Monitoring and reporting of the Dell Data Storage systems may not provide the results you expect, - because Dell's native auditing does not record every action Auditor can report on. See the + because Dell's native auditing doesn't record every action Auditor can report on. See the [File Servers](/docs/auditor/10.8/configuration/fileservers/overview.md) topic for additional information. diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md index abce0927cc..2b8b27d3a7 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/objectaccess.md @@ -51,5 +51,5 @@ node on the left and navigate to **Policies → Windows Settings → Security Se To update group policies for Dell VNX, you must log in as the `nasadmin` user. You can configure advanced audit policy to narrow the range of events Auditor tracks and -records, preventing your AuditArchive and the Security event log from overfilling. See the +records. This prevents your AuditArchive and the Security event log from overfilling. See the [Configure Security Event Log](/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md) topic for additional information. diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md index 267827adc6..6e008ce71e 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md @@ -13,8 +13,8 @@ Dell Data Storage collectively refers to Dell VNX, VNXe, Celerra, and Unity NAS Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data. +certain built-in Windows services, etc. You must configure auditing properly to ensure audit data +integrity; otherwise, your change reports may contain warnings, errors, or incomplete audit data. :::warning You must exclude the folder associated with Netwrix Auditor from antivirus scanning. See the @@ -57,12 +57,12 @@ You can configure your IT Infrastructure for monitoring in one of the following these shares, you must enable the local-to-local, local-to-remote, remote-to-local, and remote-to-remote symbolic link evaluations on the computer that hosts Auditor Server. -First, you should decide on the objects and actions you want to track. Consider the following: +First, decide on the objects and actions you want to track. Consider the following: - The actions Auditor reports vary depending on the file server type and the audited object (file, folder, or share). - Monitoring and reporting of the Dell Data Storage systems may not provide the results you expect, - because Dell's native auditing does not record every action Auditor can report on. See the + because Dell's native auditing doesn't record every action Auditor can report on. See the [File Servers](/docs/auditor/10.9/configuration/fileservers/overview.md) topic for additional information. From 51ce6a8244d3493528ee22954f6853ee2b558ceb Mon Sep 17 00:00:00 2001 From: Nikolay Budeev Date: Tue, 25 Aug 2026 17:36:04 +0200 Subject: [PATCH 09/11] Sync 10.9 securityeventlog.md fixes to 10.7 and 10.8 Propagates the frontmatter description wording and the UNC-path Log name value from 10.9 to keep all three versions identical. --- .../fileservers/delldatastorage/securityeventlog.md | 4 ++-- .../fileservers/delldatastorage/securityeventlog.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md index 1f509ec543..141f01d75f 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md @@ -1,6 +1,6 @@ --- title: "Configure Security Event Log" -description: "Configure Event Log path, maximum size, and retention on Dell Data Storage devices" +description: "Configure Security Event Log path, maximum size, and retention on Dell Data Storage devices" sidebar_position: 20 --- @@ -54,7 +54,7 @@ right-click **Security** and select **Properties**. **Step 3 –** Confirm the following values: -- **Log name**: `C:\events\security.evt` +- **Log name**: `\\\C$\events\security.evt` - **Maximum log size**: `4,194,240 KB` - **Overwrite events as needed**: selected diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md index 1f509ec543..141f01d75f 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md @@ -1,6 +1,6 @@ --- title: "Configure Security Event Log" -description: "Configure Event Log path, maximum size, and retention on Dell Data Storage devices" +description: "Configure Security Event Log path, maximum size, and retention on Dell Data Storage devices" sidebar_position: 20 --- @@ -54,7 +54,7 @@ right-click **Security** and select **Properties**. **Step 3 –** Confirm the following values: -- **Log name**: `C:\events\security.evt` +- **Log name**: `\\\C$\events\security.evt` - **Maximum log size**: `4,194,240 KB` - **Overwrite events as needed**: selected From 5dfb042e88fa125ede59d1c3fce37c8750224101 Mon Sep 17 00:00:00 2001 From: Nikolay Budeev Date: Tue, 25 Aug 2026 17:42:35 +0200 Subject: [PATCH 10/11] Commit local edits to 10.9 securityeventlog.md Description wording and UNC-path Log name value were edited locally but never committed; these are the source of truth just synced to 10.7/10.8. --- .../fileservers/delldatastorage/securityeventlog.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md index 1f509ec543..141f01d75f 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md @@ -1,6 +1,6 @@ --- title: "Configure Security Event Log" -description: "Configure Event Log path, maximum size, and retention on Dell Data Storage devices" +description: "Configure Security Event Log path, maximum size, and retention on Dell Data Storage devices" sidebar_position: 20 --- @@ -54,7 +54,7 @@ right-click **Security** and select **Properties**. **Step 3 –** Confirm the following values: -- **Log name**: `C:\events\security.evt` +- **Log name**: `\\\C$\events\security.evt` - **Maximum log size**: `4,194,240 KB` - **Overwrite events as needed**: selected From fefc48bf1d330140531f8e836113de696354442a Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Tue, 25 Aug 2026 15:48:04 +0000 Subject: [PATCH 11/11] fix(vale): auto-fix style issues (Vale + Dale) --- .../fileservers/delldatastorage/overview.md | 2 +- .../fileservers/delldatastorage/securityeventlog.md | 10 +++++----- .../fileservers/delldatastorage/overview.md | 2 +- .../fileservers/delldatastorage/securityeventlog.md | 10 +++++----- .../fileservers/delldatastorage/overview.md | 2 +- .../fileservers/delldatastorage/securityeventlog.md | 10 +++++----- 6 files changed, 18 insertions(+), 18 deletions(-) diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md index 09ad03863c..e0ee813503 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md @@ -80,7 +80,7 @@ partition of the Data Mover. To increase the security log size, you must move it Mover root folder. **Step 1 –** [Configure Security Event Log](/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that the log holds enough events between data collections. Auditor -doesn't clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the +doesn't clean Dell Unity logs automatically, so the log starts overwriting when it exceeds the limit. See the [Unity Family Security Configuration Guide](https://support.emc.com/docu69321_Unity-Family-Security-Configuration-Guide.pdf?language=en_US) for additional information about configuring log rollover manually. diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md index 141f01d75f..e2ec500e4c 100644 --- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md @@ -17,8 +17,8 @@ verify them in the Computer Management console. click **+** to create a file system. Name it `events` and set its size to at least 4 GiB. This file system stores the security log. -**Step 2 –** Confirm that the account specified for data collection in the monitoring -plan can read the share at `\\\C$\events`. +**Step 2 –** Confirm that the account you specified for data collection in the +monitoring plan can read the share at `\\\C$\events`. ## Configure Event Log values in Registry Editor @@ -44,9 +44,9 @@ instead of retaining them. ## Verify Event Log settings in the Computer Management console **Step 1 –** On the computer that hosts Auditor Server, open **Computer Management**: -navigate to **Start → Run** and type `compmgmt.msc /computer=`, or -right-click **Start**, select **Computer Management**, then right-click **Computer -Management (Local)** and select **Connect to another computer** to specify +navigate to **Start → Run** and type `compmgmt.msc /computer=`. +Alternatively, right-click **Start**, select **Computer Management**, then right-click +**Computer Management (Local)**, select **Connect to another computer**, and specify ``. **Step 2 –** Navigate to **System Tools → Event Viewer → Windows Logs**, then diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md index f6e4c49714..3ff55baf12 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md @@ -80,7 +80,7 @@ partition of the Data Mover. To increase the security log size, you must move it Mover root folder. **Step 1 –** [Configure Security Event Log](/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that the log holds enough events between data collections. Auditor -doesn't clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the +doesn't clean Dell Unity logs automatically, so the log starts overwriting when it exceeds the limit. See the [Unity Family Security Configuration Guide](https://support.emc.com/docu69321_Unity-Family-Security-Configuration-Guide.pdf?language=en_US) for additional information about configuring log rollover manually. diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md index 141f01d75f..e2ec500e4c 100644 --- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md @@ -17,8 +17,8 @@ verify them in the Computer Management console. click **+** to create a file system. Name it `events` and set its size to at least 4 GiB. This file system stores the security log. -**Step 2 –** Confirm that the account specified for data collection in the monitoring -plan can read the share at `\\\C$\events`. +**Step 2 –** Confirm that the account you specified for data collection in the +monitoring plan can read the share at `\\\C$\events`. ## Configure Event Log values in Registry Editor @@ -44,9 +44,9 @@ instead of retaining them. ## Verify Event Log settings in the Computer Management console **Step 1 –** On the computer that hosts Auditor Server, open **Computer Management**: -navigate to **Start → Run** and type `compmgmt.msc /computer=`, or -right-click **Start**, select **Computer Management**, then right-click **Computer -Management (Local)** and select **Connect to another computer** to specify +navigate to **Start → Run** and type `compmgmt.msc /computer=`. +Alternatively, right-click **Start**, select **Computer Management**, then right-click +**Computer Management (Local)**, select **Connect to another computer**, and specify ``. **Step 2 –** Navigate to **System Tools → Event Viewer → Windows Logs**, then diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md index 6e008ce71e..9244d6f936 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/overview.md @@ -80,7 +80,7 @@ partition of the Data Mover. To increase the security log size, you must move it Mover root folder. **Step 1 –** [Configure Security Event Log](/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md) to set the log path, maximum size, and retention so that the log holds enough events between data collections. Auditor -doesn't clean Dell Unity logs automatically, so the log starts overwriting when it goes beyond the +doesn't clean Dell Unity logs automatically, so the log starts overwriting when it exceeds the limit. See the [Unity Family Security Configuration Guide](https://support.emc.com/docu69321_Unity-Family-Security-Configuration-Guide.pdf?language=en_US) for additional information about configuring log rollover manually. diff --git a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md index 141f01d75f..e2ec500e4c 100644 --- a/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md +++ b/docs/auditor/10.9/configuration/fileservers/delldatastorage/securityeventlog.md @@ -17,8 +17,8 @@ verify them in the Computer Management console. click **+** to create a file system. Name it `events` and set its size to at least 4 GiB. This file system stores the security log. -**Step 2 –** Confirm that the account specified for data collection in the monitoring -plan can read the share at `\\\C$\events`. +**Step 2 –** Confirm that the account you specified for data collection in the +monitoring plan can read the share at `\\\C$\events`. ## Configure Event Log values in Registry Editor @@ -44,9 +44,9 @@ instead of retaining them. ## Verify Event Log settings in the Computer Management console **Step 1 –** On the computer that hosts Auditor Server, open **Computer Management**: -navigate to **Start → Run** and type `compmgmt.msc /computer=`, or -right-click **Start**, select **Computer Management**, then right-click **Computer -Management (Local)** and select **Connect to another computer** to specify +navigate to **Start → Run** and type `compmgmt.msc /computer=`. +Alternatively, right-click **Start**, select **Computer Management**, then right-click +**Computer Management (Local)**, select **Connect to another computer**, and specify ``. **Step 2 –** Navigate to **System Tools → Event Viewer → Windows Logs**, then