Question:Is it possible to monitor the Direct Audit Collector(s) outside of Audit Manager to determine if it is connected or disconnected?
Answer:Yes, one way that could be used to monitor the Collector status is to use the '
Get-CdaCollector' cmdlet from the
Audit Modules for Powershell.
The
Audit Modules for PowerShell will need to be installed first.
Please see the below documentation on how the Audit Modules for PowerShell can be installed, if it isn't already.
https://docs.centrify.com/Content/aud-ps/PowerShellAuditModuleInstall.htmAfter the Audit Modules are installed, open up a PowerShell prompt with Administrative rights by right clicking on the PowerShell Application icon and choosing
Run As Administrator.
The
Get-CdaCollector cmdlet can then be used to find information about your collector(s). The
Status field in the output will show connection status.
Get-CdaCollector -Installation <AuditInstallationName>
See the example below:
PS C:\Windows\system32> Get-CdaCollector -Installation Audit2Installation
MachineName : DEPLOY2.centrifyimage.vms
MachineAddress : 192.168.81.134
Sid : S-1-5-21-3571224596-3006733700-3057749774-2118
Status : Connected
UpTime : 04:14:22
StartupTime : 9/23/2020 12:22:43 PM
LastUpdateTime : 9/23/2020 4:37:05 PM
PortNumber : 5063
Version : 3.6.1.331
AuditStoreDatabase : Demo-Site@centrifyimage.vms-AuditStore-2019-10-15
To filter only on the
Status field the command could be run as follows.
PS C:\Windows\system32> Get-CdaCollector -Installation Audit2Installation | select Status
Status
------
Connected
or
PS C:\Windows\system32> Get-CdaCollector -Installation Audit2Installation | select Status | FL
Status : Connected