Jump to content


Photo

Exclude system user


  • Please log in to reply
1 reply to this topic

#1 uncleben

uncleben

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 26 October 2017 - 12:17 PM

In reports being sent overnight, a system account named 'system' keeps showing up, even if that user has been excluded from lists (omituserlist_fs, omitstoreuserlist_fs and omitreportlist). What would be the proper way to exclude that system account? I've attempted *,,system,*,*,  in omitreportlist and simply system in others with no luck.

 

Thanks

 



#2 Jadentek

Jadentek

    Newbie

  • Members
  • Pip
  • 9 posts
  • Gender:Male
  • Location:US

Posted 26 October 2017 - 04:02 PM

@uncleben

Please confirm the current build version of Netwrix Auditor (NA) running in the Environment.
Example: http://i.imgur.com/BTT1d8z.png  or    https://i.imgur.com/TEhyY3m.png

 

"System"  is not an account this a notification that changes are not correctly being recorded into the Security logon of the File Server being audited.

 
KB1990 This article provides instructions how to avoid the "system" value in your audit data.

https://www.netwrix.com/kb/1990

 

Will need to confirm that the correct settings have been configured via the following based on the OS of the File Server.

 

Configure Windows File Servers for Monitoring

https://helpcenter.n...ows_Shares.html

 

Configure EMC VNX/VNXe for Monitoring
https://helpcenter.n..._VNX_VNXe .html

Configure EMC Isilon for Monitoring
https://helpcenter.n...astructure.html

Configure NetApp Filer for Monitoring
https://helpcenter.n...ure_NetApp.html

 

 

If you look at the Netwrix System Health Event Log http://i.imgur.com/yjv8hkA.png this will help with Identifying the missing permission(s)

 

 

 

.






0 user(s) are reading this topic

0 members, guests, anonymous users