diff --git a/docs/kb/changetracker/audit-and-logging/planned-changes-report.md b/docs/kb/changetracker/audit-and-logging/planned-changes-report.md new file mode 100644 index 0000000000..48301aa8b1 --- /dev/null +++ b/docs/kb/changetracker/audit-and-logging/planned-changes-report.md @@ -0,0 +1,47 @@ +--- +title: How to Run a Report That Shows Created Planned Changes and Who Made Them +description: >- + Shows how to run an events report that includes Created Planned Changes, + Approved Changes, and the user who performed these actions in Netwrix Change + Tracker. +sidebar_label: Planned Changes Report +keywords: + - planned change + - events + - report + - export + - audit + - Netwrix Change Tracker + - CSV + - event filter + - approved changes +products: + - change-tracker +tags: + - kb + - audit-and-logging +knowledge_article_id: ka04u000000Hd9zAAC +--- + +# How to Run a Report That Shows Created Planned Changes and Who Made Them + +## Overview + +This article shows how to run a report that displays Created Planned Changes, Changes That Were Approved, and the User that performed these actions in Netwrix Change Tracker. + +## Instructions + +1. Go to **Events**. +2. Select specific or all devices and click **Filter**. +3. In the **Date & Time** Window, select the time period for which you'd like to view created planned changes. +4. In the **Event Filter** window, enter `Planned Change` in the Text Search field. Select **Audit** in Event Type and click **Apply**. + + + +5. To export the report, click **Query/Report** > **Export Now** and select your preferred file type. + + > **NOTE:** For details on available export formats, see [Exporting Events to CSV, PDF, or XLSX](/docs/kb/changetracker/configuration-and-setup/exporting-events-to-csv-pdf-or-xlsx). The exported report includes Created Planned Changes, Approved Changes, and the user who performed each action. + + + + diff --git a/docs/kb/changetracker/configuration-and-setup/express-agent-database-log-location.md b/docs/kb/changetracker/configuration-and-setup/express-agent-database-log-location.md new file mode 100644 index 0000000000..f99d48efee --- /dev/null +++ b/docs/kb/changetracker/configuration-and-setup/express-agent-database-log-location.md @@ -0,0 +1,42 @@ +--- +title: "How to Change the Location of the Express Agent's Database and Log Files" +description: >- + Use the ConfigPath switch in expressAgent.ini to change the Express Agent + database and log files location on Netwrix Change Tracker. +sidebar_label: Express Agent Database and Log Location +keywords: + - express agent + - ConfigPath + - expressAgent.ini + - database location + - log files + - /var/nnt + - configuration + - Netwrix Change Tracker + - agent settings + - file path +products: + - change-tracker +tags: + - kb + - configuration-and-setup +knowledge_article_id: ka04u000000HdBHAA0 +--- + +# How to Change the Location of the Express Agent's Database and Log Files + + + +## Instructions + +1. Change the Express Agent's database and log files location by editing the `ConfigPath` switch in `expressAgent.ini`: + +```ini +[ExpressAgent] +ConfigPath=/var/nnt/expressagent/ +``` + +2. Set the `ConfigPath` value to the desired directory where the Express Agent should store its database and log files. diff --git a/docs/kb/changetracker/configuration-and-setup/fast-cloud-proxy-settings.md b/docs/kb/changetracker/configuration-and-setup/fast-cloud-proxy-settings.md new file mode 100644 index 0000000000..19adde9c6d --- /dev/null +++ b/docs/kb/changetracker/configuration-and-setup/fast-cloud-proxy-settings.md @@ -0,0 +1,47 @@ +--- +title: How to Configure the FAST Cloud Integration with Proxy Internet Settings +description: >- + If you use a proxy on your Netwrix Change Tracker Server and FAST Cloud does + not work, configure the proxy for IIS processes by adding a system environment + variable. This article shows the exact steps to set the ALL_PROXY variable. +sidebar_label: FAST Cloud Proxy Settings +keywords: + - Netwrix Change Tracker + - FAST Cloud + - proxy + - ALL_PROXY + - environment variable + - IIS + - proxy settings + - server restart + - internet connection + - system variables +products: + - change-tracker +tags: + - kb + - configuration-and-setup +knowledge_article_id: ka0Qk000000D34vIAC +--- + +# How to Configure the FAST Cloud Integration with Proxy Internet Settings + +## Overview + +If you have set up a proxy internet connection on your Netwrix Change Tracker Server and you find that FAST Cloud is not working as expected, follow the instructions below to configure proxy settings for the IIS processes. + +## Instructions + +1. Open **Windows Control Panel**. +2. Choose **System**. +3. Choose **Advanced system settings**. +4. On the Advanced tab, click **Environment Variables**. +5. Click **New** to create a new environment variable under the **System Variables** heading. +6. Enter Variable Name: **ALL_PROXY**. +7. Enter Variable Value: `http://IPADDRESS:PORT`. + + > **NOTE:** This should be the IP and port of the proxy server. + +8. Select **OK**. +9. After creating the environment variable, click **OK** to apply the changes. +10. Once the environment variable is configured, restart the Netwrix Change Tracker Server. The FAST Cloud should now function as expected. diff --git a/docs/kb/changetracker/configuration-and-setup/fileaccessed-events.md b/docs/kb/changetracker/configuration-and-setup/fileaccessed-events.md new file mode 100644 index 0000000000..bdf565de5c --- /dev/null +++ b/docs/kb/changetracker/configuration-and-setup/fileaccessed-events.md @@ -0,0 +1,65 @@ +--- +title: Why Am I Receiving FileAccessed Events in Change Tracker? +description: >- + Explains why you are receiving File Access ("fileaccessed") events in Netwrix + Change Tracker, what they indicate, and how to enable or disable them via + policy templates. +sidebar_label: FileAccessed Events +keywords: + - fileaccessed + - file access + - Netwrix Change Tracker + - policy template + - tracked attributes + - baseline + - device groups + - file monitoring + - read operation + - file attributes +products: + - change-tracker +tags: + - kb + - configuration-and-setup +knowledge_article_id: ka0Qk000000DlkHIAS +--- + +# Why Am I Receiving FileAccessed Events in Change Tracker? + +## Overview + +This article describes why you are receiving File Access events in Netwrix Change Tracker, what they are, and how to disable or enable them. + +The `fileaccessed` event is a read operation for the file shown in the details. This does not mean someone changed the file — it simply means the file was accessed (or read), whether by a person or software. Think of it as someone opening a Word document. If you were tracking that, you would see the same notification for the Word document simply being opened. + + + +## How to Enable or Disable FileAccessed Events + +These events are controlled from a **Policy Template** applied to a device group — devices in the group inherit the template's settings. + +> **NOTE:** When you update a policy template, the agent does a re-baseline of the files within the defined parameters. Changes to the files are not visible until after the baseline is completed. A baseline typically takes about 15-20 minutes to complete on a Windows device. If you are testing a change to this folder, wait about 30 minutes after saving the template so the agent has time to complete its baseline process. + +### Disabling File Access Events + +To disable file access events: + +1. Go to the **Settings Tile** > Click on the **Policy Templates** Navigation button to the left. +2. Find the Policy Template that you want to use for these event types, or create a new one by pressing the **Create a Template** button. +3. Click the **Edit** button on the template you want to modify. +4. For the desired path, locate the **Tracked Attributes** column. Click the **Edit** button and change this to `File Attributes – Excluding contents only`. +5. Click **Save Changes** at the top of the page. +6. If this is a new template, apply it to the group of devices by going to **Settings** > **Device Groups** > Select the group > **Policy Templates** > **Add a template**. + +### Enabling File Access Events + +To enable file access events: + +1. Go to the **Settings Tile** > Click on the **Policy Templates** Navigation button to the left. +2. Find the Policy Template that you want to use for these event types, or create a new one by pressing the **Create a Template** button. +3. Click the **Edit** button on the template you want to modify. +4. For the desired path, locate the **Tracked Attributes** column. Click the **Edit** button and change this to `All file and folder attributes excluding contents`. +5. Click **Save Changes** at the top of the page. +6. If this is a new template, apply it to the group of devices by going to **Settings** > **Device Groups** > Select the group > **Policy Templates** > **Add a template**. + + diff --git a/docs/kb/changetracker/configuration-and-setup/upload-compliance-template.md b/docs/kb/changetracker/configuration-and-setup/upload-compliance-template.md new file mode 100644 index 0000000000..aa12a766ad --- /dev/null +++ b/docs/kb/changetracker/configuration-and-setup/upload-compliance-template.md @@ -0,0 +1,41 @@ +--- +title: How to Upload a Compliance/Tracking Template to Change Tracker +description: >- + This article shows how to upload a compliance/tracking template to Netwrix Change + Tracker using the Settings > Policy Templates page, with + step-by-step instructions. +sidebar_label: Upload Compliance/Tracking Template +keywords: + - Netwrix Change Tracker + - compliance template + - tracking template + - upload template + - compliance reports + - templates + - Compliance Reports Templates + - settings + - overwrite template + - configuration + - compliance reporting +products: + - change-tracker +tags: + - kb + - configuration-and-setup +knowledge_article_id: ka04u000000Hd9XAAS +--- + +# How to Upload a Compliance/Tracking Template to Change Tracker + +## Overview + +This guide provides step-by-step instructions on how to upload a compliance/tracking template into Netwrix Change Tracker. + +## Instructions + +1. Click on the **Settings** dropdown, then click **Policy Templates**. +2. Click the **Actions** dropdown, then click **Upload Templates** button and browse to your template. +4. If you wish to automatically overwrite existing templates with the same name, check the corresponding box. +5. Click the **Upload Template** button. + +The progress bar should show 100% once the upload completes. diff --git a/docs/kb/changetracker/database-and-diagnostics/mongodb-out-of-memory.md b/docs/kb/changetracker/database-and-diagnostics/mongodb-out-of-memory.md new file mode 100644 index 0000000000..3aaf5a2a3f --- /dev/null +++ b/docs/kb/changetracker/database-and-diagnostics/mongodb-out-of-memory.md @@ -0,0 +1,59 @@ +--- +title: "MongoDB Log Fix: Out of Memory" +description: >- + Explains how to resolve MongoDB "out of memory" errors by configuring Windows + virtual memory (page file) to System managed so the Netwrix Change Tracker + database and Hub Server can function properly. +sidebar_label: "MongoDB Out of Memory" +keywords: + - MongoDB + - out of memory + - virtual memory + - page file + - Netwrix Change Tracker + - SYSDM.CPL + - Windows performance + - database crash + - Hub Server + - system managed +products: + - change-tracker +tags: + - kb + - database-and-diagnostics +knowledge_article_id: ka04u000000QmjwAAC +--- + +# MongoDB Log Fix: Out of Memory + +## Symptom + +The MongoDB service crashes with an out of memory error. An example log entry: + +```text +2017-10-27T10:23:48.348-0400 F - [conn3080] out of memory. +``` + +## Cause + +The MongoDB service crashed because the system ran out of physical and virtual memory. Typically, this is due to misconfigured Page File settings. + +## Resolution + +If you are receiving this error, the Netwrix Change Tracker database and Hub Server are NOT functioning. This is a critical error and monitoring cannot continue until it is resolved. To resolve this error: + +1. Open **Run** by pressing the `Windows+R` keys on your keyboard. +2. Type `SYSDM.CPL` and press **Enter**. +3. This opens **Advanced System Settings**. Click on the **Advanced** tab. +4. Under Performance, click **Settings...**. +5. In the Performance Options menu, click the **Advanced** tab. +6. Under Virtual Memory, click **Change**. +7. Verify that Virtual Memory is set to **System managed**. + + + +8. If it is not set to **System managed**, configure it by selecting the **System managed size** radio button. +9. Click **OK**. +10. In some scenarios, it may be best to reboot the server. + +> **NOTE:** MongoDB reserves as much memory as it can and stores queries in the page file for quick access. When the page file is not set to system managed, it can hit its size limit and crash MongoDB. System managed sizing lets Windows expand the page file as needed. diff --git a/docs/kb/changetracker/database-and-diagnostics/mongodump-binary-not-found.md b/docs/kb/changetracker/database-and-diagnostics/mongodump-binary-not-found.md new file mode 100644 index 0000000000..6f6dc311a4 --- /dev/null +++ b/docs/kb/changetracker/database-and-diagnostics/mongodump-binary-not-found.md @@ -0,0 +1,59 @@ +--- +title: "How to Fix: Mongodump Binary Does Not Exist in Specified Location Error" +description: >- + This article explains how to resolve the "Mongodump binary does not exist in + specified location" error when exporting a database in Netwrix Change Tracker + by adding the MongoDumpPath configuration setting. +sidebar_label: Mongodump Binary Not Found +keywords: + - mongodump + - MongoDB + - MongoDumpPath + - Change Tracker + - export + - configuration + - mongodump binary + - system settings + - database export + - advanced options +products: + - change-tracker +tags: + - kb + - database-and-diagnostics +knowledge_article_id: ka04u000000Hd9lAAC +--- + +# How to Fix: Mongodump Binary Does Not Exist in Specified Location Error + +## Symptom + +When exporting a database in Netwrix Change Tracker, you receive the following error: + +```text +Mongodump binary does not exist in specified location +``` + + + +## Cause + +The `MongoDumpPath` configuration setting is missing or points to the wrong location. Netwrix Change Tracker uses this setting to locate the mongodump binary when exporting a database. + +## Resolution + +1. Open **Settings**. +2. In the sidebar, click **System Settings**. +3. Scroll down and click **Show Advanced Options**. +4. Scroll down until you see **Configuration Settings**. +5. In **Configuration Settings**, click **Add Config Item**. +6. In the **Description** box, type `MongoDumpPath`. +7. In the **Value** box, enter the MongoDump path. Example: `C:\Program Files\NNT Change Tracker Suite\Gen7\MongoDB\bin\mongodump.exe` + + > **NOTE:** Be sure to change the drive path depending on where you have MongoDB installed. + +8. Click the **Update** button to save this information. + + + + diff --git a/docs/kb/changetracker/database-and-diagnostics/mongodump-socket-buffer-error.md b/docs/kb/changetracker/database-and-diagnostics/mongodump-socket-buffer-error.md new file mode 100644 index 0000000000..419c607326 --- /dev/null +++ b/docs/kb/changetracker/database-and-diagnostics/mongodump-socket-buffer-error.md @@ -0,0 +1,47 @@ +--- +title: >- + MongoDB Log Fix: Error Reading Collection — An Operation on a Socket Could Not + Be Performed Because the System Lacked Sufficient Buffer Space +description: >- + Shows how to troubleshoot a MongoDump failure caused by a Windows socket + buffer issue and links to Microsoft guidance for resolution. +sidebar_label: MongoDump Socket Buffer Error +keywords: + - MongoDump + - MongoDB + - WSARecv + - WSAENOBUFS + - socket buffer + - TCP port + - Windows networking + - mongodump error + - buffer space + - error reading collection +products: + - change-tracker +tags: + - kb + - database-and-diagnostics +knowledge_article_id: ka04u000000QmlUAAS +--- + +# MongoDB Log Fix: Error Reading Collection — An Operation on a Socket Could Not Be Performed + +## Symptom + +When you attempt to perform a MongoDump on your MongoDB database, the dump fails with the following error: + +```text +Failed: error reading collection: WSARecv tcp 127.0.0.1:50290: An operation on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full. +``` + +## Cause + +This error is linked to a Windows issue rather than a MongoDB issue. The error occurs when a system tries to connect to a TCP port that is greater than 5000. The TCP port number is referenced in the error message. + +## Resolution + +1. Review the Microsoft guidance on this issue: +[https://learn.microsoft.com/en-GB/troubleshoot/windows-client/networking/connect-tcp-greater-than-5000-error-wsaenobufs-10055](https://learn.microsoft.com/en-GB/troubleshoot/windows-client/networking/connect-tcp-greater-than-5000-error-wsaenobufs-10055) + +2. If possible, implement the steps the Microsoft article recommends and then re-run the MongoDump task. diff --git a/docs/kb/changetracker/troubleshooting-and-errors/object-reference-error-groups-page.md b/docs/kb/changetracker/troubleshooting-and-errors/object-reference-error-groups-page.md new file mode 100644 index 0000000000..a44274f727 --- /dev/null +++ b/docs/kb/changetracker/troubleshooting-and-errors/object-reference-error-groups-page.md @@ -0,0 +1,62 @@ +--- +title: >- + System Error — Object Reference Not Set to an Instance of an Object — Cannot + View Groups Page in Netwrix Change Tracker +description: >- + You can log in to Netwrix Change Tracker but receive "System Error - Object + Reference not set to an instance of an object" when opening the Groups page. + This article explains how to resolve the issue by verifying user rights and + Active Directory integration settings. +sidebar_label: Object Reference Error on Groups Page +keywords: + - Change Tracker + - Netwrix Change Tracker + - Object Reference + - groups page + - permissions + - AD integration + - users + - login error + - system error + - user rights + - FQDN + - Active Directory +products: + - change-tracker +tags: + - kb + - troubleshooting-and-errors +knowledge_article_id: ka04u000000HdAGAA0 +--- + +# System Error — Object Reference Not Set to an Instance of an Object — Cannot View Groups Page in Netwrix Change Tracker + +## Symptom + +You can log in to Netwrix Change Tracker, but when you go to **Settings > Groups**, you receive the following error: + +```text +System Error - Object Reference not set to an instance of an object +``` + + + +## Cause + +This error occurs when your account does not have the correct user rights to view the Groups page. + +## Resolution + +1. Log out of the Netwrix Change Tracker user account that you are currently using. +2. Log in as the default **admin** account in Netwrix Change Tracker. +3. Navigate to the **Groups** tab in the **Settings** tile. +4. Verify that the groups are visible. If they are, the previous account lacks the user rights required to view device groups. +5. Go to **Settings > Users**. +6. Check whether Active Directory integration is enabled and whether it requires a fully qualified domain name (FQDN) for login. + + + +7. If AD integration requires an FQDN, review the username in **Settings > Users**. +8. Verify that the username matches exactly what the user provides at login, including the domain prefix (for example, `DOMAIN\username`). + +