Step 7. Confirm Log-Message Collection

At this point in the configuration process, TLC should be collecting log messages from your Assets' Log Sources.

If you are using a File Collector, complete the following steps to confirm log-message collection for each of the Collector's Assets:

1. In the side bar, select Events >Audit LoggerAudit Logger.
2. In the Audit Logger, click the Query tab.
3. To view the log messages received by an Asset's Log Source:
a. From the Assets drop-down lists, select Assets from the first drop-down and the Asset's Log Source from the second drop-down.
b. Click Start.

TLC opens the Query Results - Log Messages tab in the Audit Logger. If this tab contains any log messages, then the Asset has been properly configured. For more information, see Working with Audit Logger Queries.

Note 

If the Asset is a scanner (see What are Scanner Events?), collected events will not appear in the Audit Logger. To confirm the collection of Scanner Events, see Working with a Scanner Event.

For each of your other Collectors, complete the following steps to confirm log-message collection for each of the Collector's Log Sources:

1. In the side bar, select Events >Real-Time Event ViewerReal-Time Event Viewer.
2. In the IP-address filter field, enter the IP address of the Log Source and click Start.

If TLC displays log messages in the Real-Time Event Viewer, then the Asset has been properly configured. For more information, see Viewing Log Messages in the Real-Time Event Viewer.