You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/automation/change-tracking-file-contents.md
+9-9Lines changed: 9 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: Manage Change Tracking and Inventory in Azure Automation
3
-
description: This article tells how to use Change Tracking and Inventory to track software and Windows service changes that occur in your environment.
3
+
description: This article tells how to use Change Tracking and Inventory to track software and Microsoft service changes that occur in your environment.
4
4
services: automation
5
5
ms.subservice: change-inventory-management
6
6
ms.date: 07/03/2018
@@ -13,14 +13,14 @@ When you add a new file or registry key to track, Azure Automation enables it fo
13
13
14
14
## Enable the full Change Tracking and Inventory solution
15
15
16
-
If you have enabled [Azure Security Center File Integrity Monitoring (FIM)](https://docs.microsoft.com/azure/security-center/security-center-file-integrity-monitoring), you can use the full Change Tracking and Inventory solution as described below. You settings are not removed by this process.
16
+
If you have enabled [Azure Security Center File Integrity Monitoring (FIM)](https://docs.microsoft.com/azure/security-center/security-center-file-integrity-monitoring), you can use the full Change Tracking and Inventory solution as described below. Your settings are not removed by this process.
17
17
18
18
> [!NOTE]
19
19
> Enabling the full Change Tracking and Inventory solution might cause additional charges. See [Automation Pricing](https://azure.microsoft.com/pricing/details/automation/).
20
20
21
21
1. Remove the monitoring solution by navigating to the workspace and locating it in the [list of installed monitoring solutions](../azure-monitor/insights/solutions.md#list-installed-monitoring-solutions).
22
22
2. Click on the name of the solution to open its summary page and then click on **Delete**, as detailed in [Remove a monitoring solution](../azure-monitor/insights/solutions.md#remove-a-monitoring-solution).
23
-
3.Re-enable the solution by navigating to the Automation account and selecting**Change tracking** under **Configuration Management**.
23
+
3.To re-enable the solution, navigate to the Automation account and select**Change tracking** under **Configuration Management**.
24
24
4. Choose the Log Analytics workspace and Automation account, confirm your workspace settings, and click **Enable**.
25
25
26
26
## <aname="onboard"></a>Onboard machines to Change Tracking and Inventory
@@ -82,11 +82,11 @@ Use the following steps to configure file tracking on Linux computers:
82
82
83
83
## Track file contents
84
84
85
-
File content tracking allows you to view the contents of a file before and after a change that is being tracked with Change Tracking and Inventory. The feature saves the file contents to a storage account after each change occurs. Here are some rules to follow for tracking file contents:
85
+
File content tracking allows you to view the contents of a file before and after a tracked change. The feature saves the file contents to a storage account after each change occurs. Here are some rules to follow for tracking file contents:
86
86
87
87
* A standard storage account using the Resource Manager deployment model is required for storing file content.
88
88
89
-
* Don't use premium and classic deployment model storage accounts. See [About Azure storage accounts](../storage/common/storage-create-storage-account.md).
89
+
* Don't use premium and classic deployment model storage accounts. See [About Azure Storage accounts](../storage/common/storage-create-storage-account.md).
90
90
91
91
* The storage account that you use can be connected to only one Automation account.
92
92
@@ -106,7 +106,7 @@ File content tracking allows you to view the contents of a file before and after
6.When file content change tracking is enabled, the storage account and the Shared Access Signature (SAS) URIs are shown. The signatures expire after 365 days, and you can recreate them by clicking **Regenerate**.
109
+
6.Change Tracking and Inventory shows storage account and Shared Access Signature (SAS) URIs when it enables file content change tracking. The signatures expire after 365 days, and you can recreate them by clicking **Regenerate**.
@@ -147,19 +147,19 @@ You can do various searches against the Azure Monitor logs for change records. W
147
147
148
148
|Query |Description |
149
149
|---------|---------|
150
-
|ConfigurationData<br>| where ConfigDataType == "WindowsServices" and SvcStartupType == "Auto"<br>| where SvcState == "Stopped"<br>| summarize arg_max(TimeGenerated, *) by SoftwareName, Computer | Shows the most recent inventory records for Windows services that were set to Auto but were reported as being Stopped. Results are limited to the most recent record for the specified software name and computer. |
150
+
|ConfigurationData<br>| where ConfigDataType == "Microsoft services" and SvcStartupType == "Auto"<br>| where SvcState == "Stopped"<br>| summarize arg_max(TimeGenerated, *) by SoftwareName, Computer | Shows the most recent inventory records for Microsoft services that were set to Auto but were reported as being Stopped. Results are limited to the most recent record for the specified software name and computer. |
151
151
|ConfigurationChange<br>| where ConfigChangeType == "Software" and ChangeCategory == "Removed"<br>| order by TimeGenerated desc|Shows change records for removed software.|
152
152
153
153
## Create alerts on changes
154
154
155
-
The following example shows that the file **C:\windows\system32\drivers\etc\hosts** has been modified on a machine. This file is important because Windows uses it to resolve host names to IP addresses. This operation takes precedence over DNS, and might result in connectivity issues or the redirection of traffic to malicious or otherwise dangerous websites.
155
+
The following example shows that the file **C:\windows\system32\drivers\etc\hosts** has been modified on a machine. This file is important because Windows uses it to resolve host names to IP addresses. This operation takes precedence over DNS, and might result in connectivity issues. It can also lead to redirection of traffic to malicious or otherwise dangerous websites.
156
156
157
157

158
158
159
159
Let's use this example to discuss the steps for creating alerts on a change.
160
160
161
161
1. In your Automation account, select **Change tracking** under **Configuration Management**, then select **Log Analytics**.
162
-
2. In the Logs search, look for content changes to the **hosts** file with the query `ConfigurationChange | where FieldsChanged contains "FileContentChecksum" and FileSystemPath contains "hosts"`. This query looks for changes that include a change of content for files with a fully qualified path containing the word “hosts”. You can also ask for a specific file by changing the path portion to its fully qualified form, for example, using `FileSystemPath == "c:\windows\system32\drivers\etc\hosts"`.
162
+
2. In the Logs search, look for content changes to the **hosts** file with the query `ConfigurationChange | where FieldsChanged contains "FileContentChecksum" and FileSystemPath contains "hosts"`. This query looks for a content change for files with a fully qualified path containing the word “hosts”. You can also ask for a specific file by changing the path portion to its fully qualified form, for example, using `FileSystemPath == "c:\windows\system32\drivers\etc\hosts"`.
163
163
164
164
3. After the query returns the desired results, click **New alert rule** in the log search to open the alert creation page. You can also navigate to this page through **Azure Monitor** in the Azure portal.
Copy file name to clipboardExpand all lines: articles/automation/change-tracking.md
+20-20Lines changed: 20 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: Overview of Change Tracking and Inventory in Azure Automation
3
-
description: Change tracking and inventory helps you identify software and Windows service changes that occur in your environment.
3
+
description: Change Tracking and Inventory helps you identify software and Microsoft service changes that occur in your environment.
4
4
services: automation
5
5
ms.subservice: change-inventory-management
6
6
ms.date: 01/28/2019
@@ -9,21 +9,21 @@ ms.topic: conceptual
9
9
10
10
# Overview of Change Tracking and Inventory
11
11
12
-
This article introduces you to Change Tracking and Inventory in Azure Automation. This feature tracks changes in virtual machines and server infrastructure to help you pinpoint operational and environmental issues with software managed by the Distribution Package Manager. Items that are specifically tracked by Change Tracking and Inventory include:
12
+
This article introduces you to Change Tracking and Inventory in Azure Automation. This feature tracks changes in virtual machines and server infrastructure to help you pinpoint operational and environmental issues with software managed by the Distribution Package Manager. Items that are tracked by Change Tracking and Inventory include:
13
13
14
14
- Windows software
15
15
- Linux software (packages)
16
16
- Windows and Linux files
17
17
- Windows registry keys
18
-
-Windows services
18
+
-Microsoft services
19
19
- Linux daemons
20
20
21
-
Change Tracking and Inventory obtains its data from the Azure Monitor service in the cloud. Azure sends changes to installed software, Windows services, Windows registry and files, and Linux daemons on monitored servers to Azure Monitor for processing. The cloud service applies logic to the received data, records it, and makes it available.
21
+
Change Tracking and Inventory obtains its data from the Azure Monitor service in the cloud. Azure sends changes to installed software, Microsoft services, Windows registry and files, and Linux daemons on monitored servers to Azure Monitor for processing. The cloud service applies logic to the received data, records it, and makes it available.
22
22
23
23
> [!NOTE]
24
24
> To track Azure Resource Manager property changes, see the Azure Resource Graph [change history](../governance/resource-graph/how-to/get-resource-changes.md).
25
25
26
-
Change Tracking and Inventory currentlyy doesn't support the following items:
26
+
Change Tracking and Inventory currently doesn't support the following items:
27
27
28
28
* Recursion for Windows registry tracking
29
29
* Network filesystems
@@ -98,7 +98,7 @@ You can click on a change or event to bring up its details. The available change
98
98
* Files
99
99
* Registry
100
100
* Software
101
-
*Windows services
101
+
*Microsoft services
102
102
103
103
You are able to add, modify, or remove each change. In the example below, you can see a change in the startup type of a service from Manual to Auto.
104
104
@@ -110,13 +110,13 @@ For tracking changes in files on both Windows and Linux, Change Tracking and Inv
110
110
111
111
## Tracking of file content changes
112
112
113
-
Change Tracking and Inventory allows you to view the contents of a Windows or Linux file before and after a file change. For each change to a file, Change Tracking and Inventory stores the contents of the file in an [Azure storage account](../storage/common/storage-create-storage-account.md). When you're tracking the file, you can view its contents before or after a change, inline or side by side.
113
+
Change Tracking and Inventory allows you to view the contents of a Windows or Linux file before and after a file change. For each change to a file, Change Tracking and Inventory stores the contents of the file in an [Azure Storage account](../storage/common/storage-create-storage-account.md). When you're tracking the file, you can view its contents before or after a change. You can view the contents either inline or side by side.
114
114
115
115

116
116
117
117
## Tracking of registry keys
118
118
119
-
Change Tracking and Inventory allows monitoring of changes to registry keys so that you can pinpoint extensibility points where third-party code and malware can activate. The following table lists preconfigured (but not enabled) registry keys. To track these keys, you must enable each one.
119
+
Change Tracking and Inventory allows monitoring of changes to registry keys. Monitoring allows you to pinpoint extensibility points where third-party code and malware can activate. The following table lists preconfigured (but not enabled) registry keys. To track these keys, you must enable each one.
120
120
121
121
> [!div class="mx-tdBreakAll"]
122
122
> |Registry Key | Purpose |
@@ -144,16 +144,16 @@ Change Tracking and Inventory allows monitoring of changes to registry keys so t
144
144
Change Tracking and Inventory makes use of [Azure Security Center File Integrity Monitoring (FIM)](https://docs.microsoft.com/azure/security-center/security-center-file-integrity-monitoring). While FIM monitors files and registries only, the full Change Tracking and Inventory feature also includes tracking for:
145
145
146
146
- Software changes
147
-
-Windows services
147
+
-Microsoft services
148
148
- Linux daemons
149
149
150
150
## Recursion support
151
151
152
-
Change Tracking and Inventory supports recursion, which allows you to specify wildcards to simplify tracking across directories. Recursion also provides environment variables to allow you to track files across environments with multiple or dynamic drive names. The following list includes ommon information you should know when configuring recursion:
152
+
Change Tracking and Inventory supports recursion, which allows you to specify wildcards to simplify tracking across directories. Recursion also provides environment variables to allow you to track files across environments with multiple or dynamic drive names. The following list includes Common information you should know when configuring recursion:
153
153
154
154
* Wildcards are required for tracking multiple files.
155
155
* Wildcards can be used only in the last segment of a path, for example, **c:\folder\\file*** or **/etc/*.conf**.
156
-
* If an environment variable has an invalid path, validation succeeds but the path fails when Change Tracking and Inventory runs.
156
+
* If an environment variable has an invalid path, validation succeeds but the path fails during execution.
157
157
* Avoid general path names when setting the path, as this type of setting can cause too many folders to be traversed.
158
158
159
159
## Change Tracking and Inventory data collection
@@ -165,7 +165,7 @@ The next table shows the data collection frequency for the types of changes supp
@@ -183,29 +183,29 @@ The following table shows the tracked item limits per machine for Change Trackin
183
183
184
184
The average Log Analytics data usage for a machine using Change Tracking and Inventory is approximately 40 MB per month. This value is only an approximation and is subject to change based on your environment. It's recommended that you monitor your environment to see the exact usage that you have.
185
185
186
-
### Windows service data
186
+
### Microsoft service data
187
187
188
-
The default collection frequency for Windows services is 30 minutes. You can configure the frequency using a slider on the **Windows Services** tab under **Edit Settings**.
188
+
The default collection frequency for Microsoft services is 30 minutes. You can configure the frequency using a slider on the **Microsoft services** tab under **Edit Settings**.
The Log Analytics agent only tracks changes, which optimizes the agent's performance. Setting a high threshold might miss changes if the service reverts to its original state. Setting the frequency to a smaller value allows you to catch changes that might be missed otherwise.
192
+
To optimize performance, the Log Analytics agent only tracks changes. Setting a high threshold might miss changes if the service reverts to its original state. Setting the frequency to a smaller value allows you to catch changes that might be missed otherwise.
193
193
194
194
> [!NOTE]
195
195
> While the agent can track changes down to a 10-second interval, the data still takes a few minutes to display in the Azure portal. Changes that occur during the time to display in the portal are still tracked and logged.
196
196
197
197
## Support for alerts on configuration state
198
198
199
-
A key capability of Change Tracking and Inventory is alerting on changes to the configuration state of your hybrid environment. Many useful actions are available to trigger in response to alerts, for example, actions on Azure functions, Automation runbooks, webhooks, and the like. Alerting on changes to the **C:\windows\system32\drivers\etc\hosts** file for a machine is one good application of alerts for Change Tracking and Inventory data. There are many more scenarios for alerting as well, including those defined in the next table.
199
+
A key capability of Change Tracking and Inventory is alerting on changes to the configuration state of your hybrid environment. Many useful actions are available to trigger in response to alerts, for example, actions on Azure functions, Automation runbooks, webhooks, and the like. Alerting on changes to the **C:\windows\system32\drivers\etc\hosts** file for a machine is one good application of alerts for Change Tracking and Inventory data. There are many more scenarios for alerting as well, including the query scenarios defined in the next table.
200
200
201
201
|Query |Description |
202
202
|---------|---------|
203
203
|ConfigurationChange <br>| where ConfigChangeType == "Files" and FileSystemPath contains " c:\\windows\\system32\\drivers\\"|Useful for tracking changes to system-critical files.|
204
204
|ConfigurationChange <br>| where FieldsChanged contains "FileContentChecksum" and FileSystemPath == "c:\\windows\\system32\\drivers\\etc\\hosts"|Useful for tracking modifications to key configuration files.|
205
-
|ConfigurationChange <br>| where ConfigChangeType == "WindowsServices" and SvcName contains "w3svc" and SvcState == "Stopped"|Useful for tracking changes to system-critical services.|
206
-
|ConfigurationChange <br>| where ConfigChangeType == "Daemons" and SvcName contains "ssh" and SvcState!= "Running"|Useful for tracking changes to system-critical services.|
205
+
|ConfigurationChange <br>| where ConfigChangeType == "Microsoft services" and SvcName contains "w3svc" and SvcState == "Stopped"|Useful for tracking changes to system-critical services.|
206
+
|ConfigurationChange <br>| where ConfigChangeType == "Daemons" and SvcName contains "ssh" and SvcState!= "Running"|Useful for tracking changes to system-critical services.|
207
207
|ConfigurationChange <br>| where ConfigChangeType == "Software" and ChangeCategory == "Added"|Useful for environments that need locked-down software configurations.|
208
-
|ConfigurationData <br>| where SoftwareName contains "Monitoring Agent" and CurrentVersion!= "8.0.11081.0"|Useful for seeing which machines have outdated or noncompliant software version installed. This query reports the last reported configuration state, but does not report changes.|
208
+
|ConfigurationData <br>| where SoftwareName contains "Monitoring Agent" and CurrentVersion!= "8.0.11081.0"|Useful for seeing which machines have outdated or noncompliant software version installed. This query reports the last reported configuration state, but doesn't report changes.|
209
209
|ConfigurationChange <br>| where RegistryKey == @"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\QualityCompat"| Useful for tracking changes to crucial antivirus keys.|
210
210
|ConfigurationChange <br>| where RegistryKey contains @"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy"| Useful for tracking changes to firewall settings.|
0 commit comments