eTrust Audit Reference Guide - CA Technologies

Recorder Service (SeLogRec)
Recorder Service (SeLogRec)
The eTrust Audit Recorder service, SeLogRec.exe, harvests the Windows audit
information on the client system into the local audit file for further handling by
other eTrust Audit Client components.
You can edit the recorder configuration file to specify which events are to be
recorded. For details, see Recorder Configuration File in the “Configuration
Files” chapter.
Registry Keys
Several registry keys contain values that affect the functioning of the eTrust
Audit Recorder. They are as follows:
HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\eTrust Audit\Client\Recorders\NT
Recorder
HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\eTrust Audit\Client\SeOS\logmgr
Additionally, if eTrust Access Control is installed, the Recorder service uses
the same local audit file as eTrust Access Control. To permit the recorder service
to run when eTrust Access Control is stopped, set the emulate registry key to a
value of 1. The emulate key is in the following location:
HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\eTrustAccessControl\eTrustAccessCo
ntrol\Emulate
Otherwise, the recorder service uses the value in the following eTrust Access
Control key:
HKEY_LOCAL_MACHINE\ SOFTWARE\MEMCO\SeOS\SeOS\Emulate
For information on the values in these keys, see the “Registry Keys” chapter.
Windows Services 2–9