Configuring a Collector

When you installed TLC ManagerTripwire Log Center Manager is the core software in your TLC environment. TLC Manager collects and processes log messages from a wide variety of systems and devices., the TLC installer added the required Collectors for the product types you selected. Table 27 defines each type of CollectorA TLC module that gathers or receives log messages from Log Sources. in TLC.

To edit the properties of a Collector:

1.

In the side bar, select Resources >Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Assets, AssetAn object in TLC that represents a Log Source from which TLC collects log messages directly. Groups, Managers, Locations, Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases), normalization objects (NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules, Aliases, and Normalized-Message Filters), and correlation objects (CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engines, Rules, Lists, and Actions)..

2.

In the side bar of the Configuration Manager, select Resources >Managers.

To change the File CollectorA type of Collector that gathers log messages from Log Sources that store messages in an ASCII log file., select the File Collector tab.

To change the Network CollectorA type of Collector that listens for Syslog and SNMP-based log messages from network devices., select the Network Collector tab.

To change the Database CollectorA type of Collector that gathers log messages from an application that logs to an External Database., select the DB Collector tab.

To change the Advanced Windows CollectorA type of Collector that collects log messages from Windows Event Logs on AgentA service that may be installed on a Windows or Linux system to collect log messages from any log-generating application running on the system. When installed on a Windows system, the Agent can also collect the system's Windows Event Logs via the Secure Socket Layer (SSL) protocol. systems via the Secure Sockets Layer (SSL) protocol., select the Advanced Windows Collector tab.

For further details about each of these tabs, see Table 41.