How do you set up reporting to monitor for local user in the SAadministrator group?

[EricSchwartz1]

I would like to see how I can create a report to monitor user's activity while using netwitness. I specifically want to monitor users in the SAadministrator group. Users are authenticating using PAM and the user's role is mapped to the Console server. I am running version 11.3.1.0. Any assistance would be appreciated.

Thank you,

Eric Schwartz

[sravan.koneti]

Hi Eric Schwartz‌,

Please try Global audit logging NW Cfg: Configure Global Audit Logging 

With this, Netwitness users activity being logged. You can use these logs for monitoring.

[EricSchwartz1]

Thank you for providing log configuration information

[EricSchwartz1]

Thank you for providing me this information.

Eric J Schwartz

BGS - Information Security

Information Technology Services

ph. 303-328-6173