One of the challenges of using the built-in auditing capabilities of Windows computers is that each computer stores event logs locally. While it is possible to configure event log forwarding as a way of centralizing the storage of event logs, event log data is still kept in the standard event log format, making it challenging to analyze.
Audit Collection Services (ACS) is a segment of Operations Manager that allows you to collect event log records generated by an audit policy, and to place them in a SQL Server database. With ACS, you can then use SQL Server tools, including data analysis and reporting tools, to analyze security events generated by some or all of the computers in your organization.
ACS uses the following segments:
- ACS forwarders
- ACS collectors
- ACS database
ACS forwarders
ACS forwarders forward security event log information to ACS collectors. The ACS forwarder is part of the Operations Manger agent. While the service is installed, the ACS forwarder will not be active until you run the Enable Audit Collection task. Once this task has been run, all events that would normally be written to the computer’s Security log are also forwarded to the ACS collector.
To configure a computer as an ACS forwarder, perform the following steps:
1. In the Monitoring workspace of the Operations console, expand Operations Manager, expand Agent Details, and then select Agent Health State.
2. Two panes are displayed. In the right pane, select all of the computers that you want to configure as ACS forwarder, as shown in Figure 1, and then click Enable Audit Collection under Health Service Tasks.
FIGURE 1 Enable audit collection
3. On the Run Task - Enable Audit Collection, click Override under Task Parameters.
4. On the Override Task Parameters dialog box, enter the FQDN of the ACS collector, as shown in Figure 2, and click Override.
FIGURE 2 Set collector server
5. Verify that the Collector Server is listed properly under Task Parameters, as shown in Figure 3, and click Run.
FIGURE 3 Enable audit collection
ACS collectors
A computer that functions as an ACS collector processes security event information forwarded by ACS forwarders, and then forwards this data to the ACS database. Microsoft recommends that you don’t install the ACS collector on an Operations Manager management server. This is because the ACS collector role can place an undue performance burden on the management server.
It is possible to deploy multiple ACS collectors. Each ACS collector requires an individual ACS database. ACS collectors require the following:
- An Operations Manager management server must be present.
- The server that hosts the ACS collector role must be a member of an Active Directory domain that is in the same forest as the Operations Manager management server.
- The server that hosts the ACS collector role has a minimum of 1 GB of RAM, with 2GB or more recommended, and 10 GB of free space to store the ACS database.
ACS database
The ACS database hosts all of the security event log items forwarded to the ACS collectors by the ACS forwarders. System Center 2012 Operations Manager SP1 and System Center 2012 R2 Operations Manager support using SQL Server 2008 R2 SP1 and later, and SQL Server 2012 and later to host the ACS database. Microsoft recommends using the Enterprise rather than Standard edition of SQL Server because of the performance requirements involved in processing traffic from the ACS forwarder.
To install the ACS collector and ACS database role, perform the following steps:
1. On the Operations Manager installation screen, shown in Figure 4, click Audit Collection Services in the list of Optional Installations. This will start the Audit Collection Services Collector Setup Wizard.
FIGURE 4 Installation dialog box
2. After accepting the license terms, select Create A New Database, and enter the data source name and the database instance details.
3. On the Database Authentication page, select whether Windows or SQL authentication is being used, and the folders that will store the database and log files.
4. On the Event Retention Schedule page, shown in Figure 3-43, specify how long events will be retained in the database.
FIGURE 5 ACS collector setup
5. On the ACS Stored Timestamp Format page, choose between Local Time or Universal Coordinated Time, and then complete the Setup Wizard.
ACS and Dynamic Access Control
System Center 2012 SP1 Operations Manager and later supports integration with Dynamic Access Control. Dynamic Access Control allows audit policies based on user, resource, environmental claims, and properties. Operations Manager doesn’t require additional configuration to support integration with Dynamic Access Control. Interaction with this feature is through additional reports that become available when you install ACS Reporting
