Advanced

Note: If a Database CollectorA type of Collector that gathers log messages from an application that logs to an External Database., File CollectorA type of Collector that gathers log messages from Log Sources that store messages in an ASCII log file., WinLog CollectorA type of Collector that collects log messages from Windows Event Logs via the Windows Management Instrumentation (WMI) protocol., or Advanced Windows CollectorA type of Collector that collects log messages from Windows Event Logs on AgentA service that may be installed on a Windows or Linux system to collect log messages from any log-generating application running on the system. When installed on a Windows system, the Agent can also collect the system's Windows Event Logs via the Secure Socket Layer (SSL) protocol. systems via the Secure Sockets Layer (SSL) protocol. is selected from the Collector drop-down, the Time zone field does not appear in this tab.

Generate a log messageA data record generated by a Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. and collected by TLC. if no messages received in <n> Minutes/Hours/Days. If you enter a non-zero value in this field, TLC will generate a log message if the specified time period passes without a log message being received from the Asset's Log Source. This log message simply provides a notification that no messages were received within the specified interval.

Time zone. Select the time zone in which the Asset's Log Source is located. 0

Limit collection to log messages from the following Event Logs. This region is only available if 1) the WinLog Collector is selected from the Collector drop-down, or 2) the File Collector is selected and EVT is assigned as an Input Type in the Output Destinations tab.

To limit the WinLog Collector to log messages generated by specific Windows Event Logs, select each applicable check box.

To limit the File Collector to log messages generated by specific Windows Event Logs, you must select at least one check box.

If you select the Custom check box, you can specify multiple Windows Event Logs in the associated field. To do so, insert a pipe character (|) between the names of the Event Logs (for example, Log_1|Log_2).

For more information about EVT files, see Processing EVT and EVTX Files.

Asset Groups

In this tab, add the Asset Group(s) to which the Assets will be assigned.

To add an Asset Group:

1. ClickAdd.

2. Select the Asset Group from the drop-down and click Add.

To remove an Asset Group, select the group and clickDelete.

Locations

To assign a single LocationA custom category used to classify Assets by geography. to the Assets, select the Location from the drop-down.

To assign multiple locations: 

1. Select Multiple from the drop-down.

2. ClickAdd.

3. In the newly created line, select a Location and enter a .NET regular expression in the Search Criteria field to specify the log messages to which this Location will apply.

4. Repeat the steps above to add other Locations.

To remove a Location, select the Location and clickDelete.

For more information, see Working with Locations and About Locations and the Audit Logger.

Output Destinations

Note: This tab does not appear if the Database Collector is selected from the Collector drop-down.

In this tab, add the Output Destinations to be assigned to each of the Assets. For an introduction to Output Destinations, see How does Log-Message Normalization work?.

To add an Output DestinationAssigned to an Asset, an Output Destination is either the Audit Logger, an Event-Management Database, or a Correlation Engine that correlates Normalized Messages.:

1. ClickAdd.

2. From the Input Type drop-down, select the appropriate option for the Asset's Log Sources (see Table 49).

3. Select the Output Destination and click Add.

To remove an Output Destination, select the destination and clickRemove.

Tips: Since saving log messages in an Event-Management DatabaseAn optional component of your TLC environmentConsists of all TLC software, Managers, Log Sources, Assets, Collectors, and data in your TLC installation., an Event-Management Database stores Events. Types of Event-Management Databases include Event Databases, IDS Databases, and Firewall Databases. can overload the database with Events, Tripwire recommends that you exercise discretion when assigning databases as Output Destinations. To maintain a comprehensive record of 'raw' log messages from an Asset's Log Source, assign the Audit Logger as an Output Destination.

If you do assign an Event-Management Database as an Output Destination, and the database is consequently overloaded with Events, click here for troubleshooting tips.

If the Assets are scanners (see What are Scanner Events?), Event Databases may be assigned as Output Destinations, but not Firewall Databases or IDS Databases.

You cannot add an EVT Output Destination and an EVTX Output Destination to the same Asset. For more information about EVT files, see Processing EVT and EVTX Files.

Settings

Note: If the WinLog Collector is selected from the Collector drop-down, the Settings tab includes the Username, Password, and Connection method fields. Otherwise, these fields do not appear in this tab.

Asset type. The type of Log Sources for the Assets.

Username. The username of the Windows user account to be employed by TLC for authentication with the Assets' Log Sources.

Password. The password of the user account.

Connection method. The type of WMI Connection to be employed for communication with the Assets' Log Sources (i.e., Windows systems).

The Asynchronous method uses a constant connection with the Windows Event Log.

The Synchronous method polls the Windows Event Logs for new log messages.

Note: The Username and Password fields are not required if 1) the Windows systems and Manager host system are in the same domain, and 2) the service user running the Manager has permission to collect WMI log messages.