4.5 GroupWise Forensics Auditing

If auditing has not been previously setup, such as when setting up GWF for the first time an error will be shown stating that auditing configuration has empty or invalid values and then it will be opening the auditing dialog.

If previously setup, this configuration may be accessed through the program menu Administrator | Auditing.

GroupWise Forensics Auditing keep logs and track of which users connect to the system, and which operations were performed, at which time. Auditing can be performed by simple text file, or GroupWise Forensics may integrate with GroupWise Reporting and Monitoring.

Select the desired method and enter the required information.

4.5.1 GroupWise Reporting and Monitoring Setup

GroupWise Forensics can send the auditing logs to GroupWise Reporting and Monitoring.

To configure GroupWise Reporting and Monitoring auditing:

Enter in the IP address of the GW Reporting and Monitoring server, and the server port (default listening port 6900).
The timeout can be increased (default 300 ms) if the connection between the Forensics server and the GW Reporting and Monitoring server is across a slow connection.
Enter in the case sensitive Registration name and code in the field. The registration name and code can be found in the GroupWise Reporting and Monitoring interface under Configure | Control Center | License.
Alternatively, the rlcenter.conf file can be copied from the GroupWise Reporting and Monitoring Server (Linux: /opt/beginfinite/redline/conf) - Windows: C:\Program Files\Beginfinite\redline\conf) and uploaded into the auditing section in GroupWise Forensics.
Select OK to continue.

4.5.2 Textfile Auditing Setup

GWF can keep an auditing text file locally.

Enter or browse to the directory to save the file in.
Set the maximum log file size (kilobytes). Default: 1024.
Set the minimum amount of free disk space (megabytes) required for the log file to be written to. Default: 10.
Select OK to continue.