Skip to content

Commit cfc0645

Browse files
BethWilkeBethWilke
committed
Fixing task 1707689
1 parent 214ce9a commit cfc0645

File tree

6 files changed

+254
-247
lines changed

6 files changed

+254
-247
lines changed

‎articles/automation/change-tracking-file-contents.md

Lines changed: 145 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,69 +1,180 @@
11
---
2-
title: View file content changes with Azure Automation
3-
description: Use the file content change feature of Change Tracking to view the contents of a file that has changed.
2+
title: Manage Change Tracking and Inventory in Azure Automation
3+
description: This article tells how to use Change Tracking and Inventory to track software and Windows service changes that occur in your environment.
44
services: automation
55
ms.subservice: change-inventory-management
66
ms.date: 07/03/2018
77
ms.topic: conceptual
88
---
9-
# View contents of a file that is being tracked with Change Tracking
109

11-
File content tracking allows you to view the contents of a file before and after a change that is being tracked with Change Tracking. To do this, it saves the file contents to a storage account after each change occurs.
10+
# Manage Change Tracking and Inventory
1211

13-
## Requirements
12+
When you add a new file or registry key to track, Azure Automation enables it for the [Change Tracking and Inventory](change-tracking.md) feature. This article includes procedures for working with this feature.
1413

15-
* A standard storage account using the Resource Manager deployment model is required for storing file content. Premium and classic deployment model storage accounts should not be used. For more information on storage accounts, see [About Azure storage accounts](../storage/common/storage-create-storage-account.md)
14+
## Enable the full Change Tracking and Inventory solution
1615

17-
* The storage account used can only have 1 Automation account connected.
16+
If you have enabled [Azure Security Center File Integrity Monitoring (FIM)](https://docs.microsoft.com/azure/security-center/security-center-file-integrity-monitoring), you can use the full Change Tracking and Inventory solution as described below. You settings are not removed by this process.
1817

19-
* [Change Tracking](automation-change-tracking.md) is enabled in your Automation account.
18+
> [!NOTE]
19+
> Enabling the full Change Tracking and Inventory solution might cause additional charges. See [Automation Pricing](https://azure.microsoft.com/pricing/details/automation/).
2020
21-
## Enable file content tracking
21+
1. Remove the monitoring solution by navigating to the workspace and locating it in the [list of installed monitoring solutions](../azure-monitor/insights/solutions.md#list-installed-monitoring-solutions).
22+
2. Click on the name of the solution to open its summary page and then click on **Delete**, as detailed in [Remove a monitoring solution](../azure-monitor/insights/solutions.md#remove-a-monitoring-solution).
23+
3. Re-enable the solution by navigating to the Automation account and selecting **Change tracking** under **Configuration Management**.
24+
4. Choose the Log Analytics workspace and Automation account, confirm your workspace settings, and click **Enable**.
2225

23-
1. In the Azure portal, open your Automation account, and then select **Change tracking**.
24-
2. On the top menu, select **Edit Settings**.
25-
3. Select **File Content** and click **Link**. This opens the **Add Content Location for Change Tracking** pane.
26+
## <a name="onboard"></a>Onboard machines to Change Tracking and Inventory
2627

27-
![enable](./media/change-tracking-file-contents/enable.png)
28+
To begin tracking changes, you must enable Change Tracking and Inventory in Azure Automation. Here are the recommended and supported ways to onboard your machines to this feature:
2829

29-
4. Select the subscription and storage account to use to store the file contents to. If you want to enable file content tracking for all existing tracked files, select **On** for **Upload file content for all settings**. You can change this for each file path afterwards.
30+
* [Onboard from a virtual machine](automation-onboard-solutions-from-vm.md)
31+
* [Onboard from browsing multiple machines](automation-onboard-solutions-from-browse.md)
32+
* [Onboard from your Automation account](automation-onboard-solutions-from-automation-account.md)
33+
* [Onboard in an Azure Automation runbook](automation-onboard-solutions.md)
3034

31-
![set storage account](./media/change-tracking-file-contents/storage-account.png)
35+
## Track files
3236

33-
5. Once enabled, the storage account and the SAS Uris are shown. The SAS Uris expire after 365 days, and can be recreated by clicking the **Regenerate** button.
37+
### Configure file tracking on Windows
3438

35-
![list account keys](./media/change-tracking-file-contents/account-keys.png)
39+
Use the following steps to configure file tracking on Windows computers:
3640

37-
## Add a file
41+
1. In your Automation account, select **Change tracking** under **Configuration Management**.
42+
2. Click **Edit Settings** (the gear symbol).
43+
3. On the Workspace Configuration page, select **Windows Files**, then click **+ Add** to add a new file to track.
44+
4. On the Add Windows File for Change Tracking pane, enter the information for the file to track and click **Save**. The following table defines the properties that you can use for the information.
3845

39-
The following steps walk you through turning on change tracking for a file:
46+
|Property |Description |
47+
|---------|---------|
48+
|Enabled | True if the setting is applied, and False otherwise. |
49+
|Item Name | Friendly name of the file to be tracked. |
50+
|Group | A group name for logically grouping files. |
51+
|Enter Path | The path to check for the file, for example, **c:\temp\\\*.txt**. You can also use environment variables, such as `%winDir%\System32\\\*.*`. |
52+
|Path Type | The type of path. Possible values are File and Directory. |
53+
|Recursion | True if recursion is used when looking for the item to be tracked, and False otherwise. |
54+
|Upload file content | True to upload file content on tracked changes, and False otherwise.|
4055

41-
1. On the Edit Settings page of **Change Tracking**, select either the **Windows Files** or the **Linux Files** tab, and click **Add**
56+
5. Ensure that you specify True for **Upload file content**. This setting enables file content tracking for the indicated file path.
4257

43-
1. Fill out the information for the file path and select True under **Upload file content for all settings**. This setting enables file content tracking for that file path only.
58+
### Configure file tracking on Linux
4459

45-
![add a linux file](./media/change-tracking-file-contents/add-linux-file.png)
60+
Use the following steps to configure file tracking on Linux computers:
4661

47-
## Viewing the contents of a tracked file
62+
1. In your Automation account, select **Change tracking** under **Configuration Management**.
63+
2. Click **Edit Settings** (the gear symbol).
64+
3. On the Workspace Configuration page, select **Linux Files**, then click **+ Add** to add a new file to track.
65+
4. On the Add Linux File for Change Tracking pane, enter the information for the file or directory to track and click **Save**. The following table defines the properties that you can use for the information.
4866

49-
1. Once a change has been detected for the file or a file in the path, it shows in the portal. Select the file change from the list of changes. The Change details pane is displayed.
67+
|Property |Description |
68+
|---------|---------|
69+
|Enabled | True if the setting is applied, and False otherwise. |
70+
|Item Name | Friendly name of the file to be tracked. |
71+
|Group | A group name for logically grouping files. |
72+
|Enter Path | The path to check for the file, for example, **/etc/*.conf**. |
73+
|Path Type | The type of path. Possible values are File and Directory. |
74+
|Recursion | True if recursion is used when looking for the item to be tracked, and False otherwise. |
75+
|Use Sudo | True to use sudo when checking for the item, and False otherwise. |
76+
|Links | Setting that determines how to deal with symbolic links when traversing directories. Possible values are:<br> Ignore - Ignores symbolic links and doesn't include the files/directories referenced.<br>Follow - Follows the symbolic links during recursion and also includes the files/directories referenced.<br>Manage - Follows the symbolic links and allows altering of returned content. **Note** - This option isn't recommended, as it doesn't support file content retrieval. |
77+
|Upload file content | True to upload file content on tracked changes, and False otherwise. |
5078

51-
![list changes](./media/change-tracking-file-contents/change-list.png)
79+
5. Ensure that you specify True for **Upload file content**. This setting enables file content tracking for the indicated file path.
5280

53-
1. On the Change details pane, you see the standard before and after file information. Select **View File Content Changes** to see the contents of the file.
81+
![Add Linux file](./media/change-tracking-file-contents/add-linux-file.png)
5482

55-
![change details](./media/change-tracking-file-contents/change-details.png)
83+
## Track file contents
5684

57-
1. The new page shows you the file contents in a side-by-side view. You can also select **Inline** to see an inline view of the changes.
85+
File content tracking allows you to view the contents of a file before and after a change that is being tracked with Change Tracking and Inventory. The feature saves the file contents to a storage account after each change occurs. Here are some rules to follow for tracking file contents:
5886

59-
![view file changes](./media/change-tracking-file-contents/view-file-changes.png)
87+
* A standard storage account using the Resource Manager deployment model is required for storing file content.
6088

61-
## Next steps
89+
* Don't use premium and classic deployment model storage accounts. See [About Azure storage accounts](../storage/common/storage-create-storage-account.md).
90+
91+
* The storage account that you use can be connected to only one Automation account.
92+
93+
* [Change Tracking and Inventory](change-tracking.md) is enabled in your Automation account.
94+
95+
### Enable tracking for file content changes
96+
97+
1. In the Azure portal, open your Automation account, and then select **Change tracking** under **Configuration Management**.
98+
2. Click **Edit Settings** (the gear symbol).
99+
3. Select **File Content** and click **Link**. This selection opens the Add Content Location for Change Tracking pane.
100+
101+
![Enable content location](./media/change-tracking-file-contents/enable.png)
102+
103+
4. Select the subscription and storage account to use for storing the file contents.
104+
105+
5. If you want to enable file content tracking for all existing tracked files, select **On** for **Upload file content for all settings**. You can change this setting for each file path later.
106+
107+
![Set storage account](./media/change-tracking-file-contents/storage-account.png)
108+
109+
6. When file content change tracking is enabled, the storage account and the Shared Access Signature (SAS) URIs are shown. The signatures expire after 365 days, and you can recreate them by clicking **Regenerate**.
110+
111+
![List account keys](./media/change-tracking-file-contents/account-keys.png)
112+
113+
### View the contents of a tracked file
114+
115+
Once Change Tracking and Inventory detects a change for a tracked file, you can view the file contents on the Change Details pane.
116+
117+
![List changes](./media/change-tracking-file-contents/change-list.png)
118+
119+
1. In the Azure portal, open your Automation account, and then select **Change tracking** under **Configuration Management**.
120+
121+
2. Choose a file in the list of changes and select **View File Content Changes** to see the contents of the file. The Change Details pane shows you the standard before and after file information.
122+
123+
![Change details](./media/change-tracking-file-contents/change-details.png)
124+
125+
3. You're viewing the file contents in a side-by-side view. You can select **Inline** to see an inline view of the changes.
62126

63-
Visit the tutorial on Change Tracking to learn more about using the solution:
127+
![View file changes](./media/change-tracking-file-contents/view-file-changes.png)
64128

65-
> [!div class="nextstepaction"]
66-
> [Troubleshoot changes in your environment](automation-tutorial-troubleshoot-changes.md)
129+
## Track registry keys
67130

68-
* Use [Log searches in Azure Monitor logs](../log-analytics/log-analytics-log-searches.md) to view detailed change tracking data.
131+
Use the following steps to configure registry key tracking on Windows computers:
132+
133+
1. In your Automation account, select **Change tracking** under **Configuration Management**.
134+
2. Click **Edit Settings** (the gear symbol).
135+
3. On the Workspace Configuration page, select **Windows Registry**.
136+
4. Click **+ Add** to add a new registry key to track.
137+
5. On the Add Windows Registry for Change Tracking pane, enter the information for the key to track and then click **Save**. The following table defines the properties that you can use for the information.
138+
139+
|Property |Description |
140+
|---------|---------|
141+
|Enabled | True if a setting is applied, and False otherwise. |
142+
|Item Name | Friendly name of the registry key to track. |
143+
|Group | Group name for logically grouping registry keys. |
144+
|Windows Registry Key | Key name with path, for example, **HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Startup**. |
145+
146+
## Search logs for change records
147+
148+
You can do various searches against the Azure Monitor logs for change records. With the Change tracking page open, click **Log Analytics** to open the Logs page. The following table provides sample log searches for change records.
149+
150+
|Query |Description |
151+
|---------|---------|
152+
|ConfigurationData<br>&#124; where ConfigDataType == "WindowsServices" and SvcStartupType == "Auto"<br>&#124; where SvcState == "Stopped"<br>&#124; summarize arg_max(TimeGenerated, *) by SoftwareName, Computer | Shows the most recent inventory records for Windows services that were set to Auto but were reported as being Stopped. Results are limited to the most recent record for the specified software name and computer. |
153+
|ConfigurationChange<br>&#124; where ConfigChangeType == "Software" and ChangeCategory == "Removed"<br>&#124; order by TimeGenerated desc|Shows change records for removed software.|
154+
155+
## Create alerts on changes
156+
157+
The following example shows that the file **C:\windows\system32\drivers\etc\hosts** has been modified on a machine. This file is important because Windows uses it to resolve host names to IP addresses. This operation takes precedence over DNS, and might result in connectivity issues or the redirection of traffic to malicious or otherwise dangerous websites.
158+
159+
![A chart showing the hosts file change](./media/change-tracking-file-contents/changes.png)
160+
161+
Let's use this example to discuss the steps for creating alerts on a change.
162+
163+
1. In your Automation account, select **Change tracking** under **Configuration Management**, then select **Log Analytics**.
164+
2. In the Logs search, look for content changes to the **hosts** file with the query `ConfigurationChange | where FieldsChanged contains "FileContentChecksum" and FileSystemPath contains "hosts"`. This query looks for changes that include a change of content for files with a fully qualified path containing the word “hosts”. You can also ask for a specific file by changing the path portion to its fully qualified form, for example, using `FileSystemPath == "c:\windows\system32\drivers\etc\hosts"`.
165+
166+
3. After the query returns the desired results, click **New alert rule** in the log search to open the alert creation page. You can also navigate to this page through **Azure Monitor** in the Azure portal.
167+
168+
4. Check your query again and modify the alert logic. In this case, you want the alert to be triggered if there's even one change detected across all the machines in the environment.
169+
170+
![Change to query for tracking changes to hosts file](./media/change-tracking-file-contents/change-query.png)
171+
172+
5. After the alert logic is set, assign action groups to perform actions in response to the alert being triggered. In this case, we're setting up emails to be sent and an IT Service Management (ITSM) ticket to be created.
173+
174+
![Configuring action group to alert on change](./media/change-tracking/action-groups.png)
175+
176+
## Next steps
69177

178+
* For basics of Change Tracking and Inventory, see [Overview of Change Tracking and Inventory](change-tracking.md).
179+
* To troubleshoot changes for an Azure VM, see [Troubleshoot Change Tracking and Inventory issues](../troubleshoot/change-tracking.md).
180+
* Use [Log searches in Azure Monitor logs](../log-analytics/log-analytics-log-searches.md) to view detailed change tracking data.

0 commit comments

Comments
 (0)