Banks, credit unions, insurance companies,
False File Reads detected when auditing EMC Celerra
|Symptoms||You have a Managed Object configured to audit EMC Celerra. Change Summary emails, Reports and Searches for this Managed Object contain multiple false File Read changes.|
|Cause||Netwrix Auditor periodically checks audit settings (SACL) on the audited file shares. Relating to EMC Celerra, this causes generation of some specific internal events. Further, Netwrix Auditor interprets and reports these events as File Read attempts.|
|Resolution||You can resolve this issue in two ways.
To disable auditing File Read attempts.
*,Read,<DPA>,File or Folder,*,
where <DPA> is your Data Processing Account name in the Domain\User format.