Veritas Enterprise Vault™ Administrator's Guide
- About this guide
- Managing administrator security
- Roles-based administration
- Working with predefined RBA roles
- Customizing RBA roles
- Day-to-day administration
- About Exchange mailbox archiving reports
- About starting or stopping tasks or services
- Monitoring journal mailboxes
- About monitoring disks
- About maintaining the SQL databases
- Using SQL AlwaysOn availability groups
- About managing vault store groups and sharing
- About managing safety copies
- About managing partition rollover
- About expiry and deletion
- Working with retention categories and retention plans
- Enabling archiving for new mailboxes
- About applying or removing legal holds on selected archives
- About moving archives
- How Move Archive works
- About moving mailbox archives within a site
- About moving mailbox archives between sites
- About configuring Move Archive
- Running Move Archive
- Monitoring Move Archive
- Using Enterprise Vault for records management
- Setting the default record type for users
- Common configuration scenarios
- Searching archives for items marked as records
- Automatically filtering events
- Managing indexes
- About the indexing wizards
- Managing indexing exclusions
- About the indexing PowerShell cmdlets
- Advanced Domino mailbox and desktop policy settings
- Editing the advanced settings for Domino mailbox and desktop policy
- Domino mailbox policy advanced settings
- Archiving General: Domino mailbox policy
- Archiving General: Domino mailbox policy
- Domino desktop policy advanced settings
- Advanced Exchange mailbox and desktop policy settings
- Editing the advanced Exchange mailbox and desktop settings
- Exchange mailbox policy advanced settings
- Archiving General (Exchange mailbox policy advanced settings)
- Archiving General (Exchange mailbox policy advanced settings)
- Exchange desktop policy advanced settings
- Office Mail App (Exchange desktop policy advanced settings)
- Outlook (Exchange desktop policy advanced settings)
- OWA versions before 2013 (Exchange desktop policy advanced settings)
- Vault Cache (Exchange desktop policy advanced settings)
- Virtual Vault (Exchange desktop policy advanced settings)
- Advanced Exchange journal policy settings
- Archiving General (Exchange journal policy advanced settings)
- Advanced Exchange public folder policy settings
- Archiving General (Exchange public folder policy advanced settings)
- Advanced SMTP policy settings
- Site properties advanced settings
- Editing site properties advanced settings
- Site properties advanced settings
- Content Conversion (site properties advanced settings)
- File System Archiving (site properties advanced settings)
- IMAP (site properties advanced settings)
- Indexing (site properties advanced settings)
- Skype for Business (site properties advanced settings)
- SQL Server (site properties advanced settings)
- SMTP (site properties advanced settings)
- Storage (site properties advanced settings)
- Content Conversion (site properties advanced settings)
- Computer properties advanced settings
- Editing computer properties advanced settings
- Computer properties advanced settings
- Agents (computer properties advanced settings)
- IMAP (computer properties advanced settings)
- Indexing (computer properties advanced settings)
- Storage (computer properties advanced settings)
- Task properties advanced settings
- Advanced Personal Store Management properties
- Classification policy advanced settings
- Managing the Storage queue
- Automatic monitoring
- About monitoring using Enterprise Vault Operations Manager
- About monitoring using MOM
- About monitoring using SCOM
- Managing extension content providers
- Exporting archives
- Enterprise Vault message queues
- Customizations and best practice
- Mailbox archiving strategies
- Notes on archiving based on quota or age and quota
- Notes on archiving items from Exchange Server 2010 managed folders
- About performance tuning
- Mailbox archiving strategies
- Auditing
- Failover in a building blocks configuration
- Appendix A. Ports used by Enterprise Vault
- Appendix B. Useful SQL queries
- Appendix C. Troubleshooting
- Installation problems
- Microsoft SQL Server problems
- Server problems
- Client problems
- Problems enabling or processing mailboxes
- Problems with Vault Cache synchronization
- Identifying and resolving Vault Cache issues on the Enterprise Vault server
- Identifying and resolving Vault Cache issues on an end-user computer
- Problems with Enterprise Vault components
- Troubleshooting: All tasks and services
- Troubleshooting: Directory service
- Troubleshooting: Exchange archiving or Journaling tasks
- Troubleshooting: Storage service
- Troubleshooting: Shopping service
- Troubleshooting: Web Access application
- Troubleshooting: All tasks and services
- Techniques to aid troubleshooting
- How to modify registry settings
- About moving an Indexing service
- Appendix D. Enterprise Vault accounts and permissions
Configuring audit categories
Audit categories identify the different types of information that auditing can collect. After you have created the auditing database, you can use the Enterprise Vault Administration Console to select audit categories. All categories can record summary audit data, and some can also record detailed data.
You can modify the audit categories when auditing is running or stopped. When an Enterprise Vault administrator changes the auditing configuration, an event ID 4288 reports whether auditing is running (enabled) or stopped (disabled), the status of each audit category, and the identity of the administrator who made the changes. An audit log entry is also created with the same information.
Audit log entries and the following event messages are also created when the Enterprise Vault Admin service starts:
Event ID 4286 is reported when the Enterprise Vault Admin service starts and auditing is enabled. The message includes the status of each audit category.
Event ID 4287 is reported when the Enterprise Vault Admin service starts and auditing is disabled. The message includes the status of each audit category.
Audit categories apply to the Enterprise Vault server that you select in the
container in the Administration Console. If there are multiple Enterprise Vault servers, you need to select each server in turn, and configure the audit categories for each server. It is good practice to set the audit categories consistently on all of the Enterprise Vault servers in the sites that are associated with the Enterprise Vault directory.If you select
on one server, it is important that you select it on all of the Enterprise Vault servers.To configure audit categories
- In the Administration Console, expand the tree in the left pane until the Enterprise Vault Servers container is visible.
- Click the Enterprise Vault Servers container.
- Right-click the computer for which you want to configure auditing, and click Properties on the context menu.
- Click the Auditing tab.
- Select or clear the audit categories.
Admin Activity
Configuration changes made in the Enterprise Vault Administration Console, such as adding a new service, creating archives, or enabling mailboxes.
Advanced Search
Searches performed, including the terms used and the number of items found.
Archive
Items being archived, either manually or on a scheduled run.
Archive Folder Updates
Archived items being moved to a different mailbox folder.
Archive Permissions
Manual changes to user or group access permissions on an archive. Manual permissions are set on an archive using the archive properties dialog box, or the Enterprise Vault Policy Manager (EVPM) utility.
Classification
Classification of archived items.
Delete
Archived items being deleted, either manually or through automatic expiry.
Domino Archive
Any Domino archiving activity.
Domino Restore
Any Domino restore activity.
Exchange Synchronization
Records details of creation, modification, and deletion of Exchange managed content settings. Enterprise Vault records relevant details when it is configured to archive from Exchange managed folders and to synchronize with their managed content settings.
FS Archive
File System Archiving activity.
GetOnlineXML
Document retrieval into SharePoint Portal Server.
Indexing operations
When indexing subtasks for managing index volumes start and stop. Also records any critical errors that the subtasks encounter when processing indexes. The Manage Indexes wizard enables you to manage index volumes.
Move Archive
Details of individual Move Archive operations.
NSF Migration
Items being migrated from NSF files.
PST Migration
Items being migrated from PST files.
Restore
Archived items being restored.
Retention Category Updates
Changes to the retention category of archived items.
SPS Archive
SharePoint archiving activity.
Saveset Status
(For Support use.) Rarely used. Records whether a saveset file is available.
Subtask Control
The creation and modification of subtasks, such as the subtasks that control Move Archive operations.
Undelete
Deleted items that are recovered using the option Recover items on the Deleted Items tab of Archive Properties. Shortcuts recovered using the FSAUndelete utility are also recorded.
User
Your own auditing entries.
View
Viewing archived items, either as HTML or in their original formats.
View Attachments
Viewing of archived items from within SharePoint Portal Server.
- Click OK to save the changes you have made.