What is the Real-Time Event Viewer?

In the Real-Time Event ViewerA TLC Console1. Tripwire Log Center Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire Log Center GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component that displays log messages as they are collected by TLC., you can review the details of log messages as they are received by TLC. For TLC to display a message in the Real-Time Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source. Viewer:

The Real-Time Event Viewer must be running, and

The message must match the filter settings defined at the top of the Real-Time Event Viewer dialog.

For further instructions, see Viewing Log Messages in the Real-Time Event Viewer.

The steps below describe how the Real-Time Event Viewer processes a log messageA data record generated by a Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. and collected by TLC. received from a CollectorA TLC module that gathers or receives log messages from Log Sources. (outlined in red in Figure 31).

Figure 31.  Collecting a log message - Real-Time Event Viewer (click to enlarge)

Is the RTEV running?

Yes = If the Real-Time Event Viewer is running, TLC applies the filter settings to the log message.

No = Otherwise, the Real-Time Event Viewer ignores the message.

Does message match RTEV filter?

Yes = If the log message matches the filter settings, the Real-Time Event Viewer displays the message.

No = Otherwise, the Real-Time Event Viewer ignores the message.