I'm interested in monitoring our Simpana admin activity with a SIEM tool (LogRhythm). Has anybody done the legwork to find the log files and/or SQL tables necessary to track admin use?
May I ask what type of admin usage tracking are you intending for?
Also here's a list of open views into SQL you could plug into:
I'd like to start with basic logon activity and change tracking. I didn't see that in the SQL views.
Is there another place I should look, a log file?
There is a GUI Audit Report which tracks this, not sure if this is what you're looking for.