Tripwire Log Center Manager (or TLC Manager) is the core TLC software that collects log messages from a wide variety of systems and devices, known as Log Sources. Tripwire Log Center Console (or TLC Console) provides the graphic user interface (GUI) with which users review, analyze, and correlate this data.
Your Tripwire Log Center (TLC) environment consists of all systems on which TLC Manager and TLC Console have been installed, along with the Log Sources from which TLC collects log messages. In addition, your TLC environment includes the databases in which TLC stores log messages and related data, as well as any Agents.
Installed on a Windows or Linux system, the Agent is a service that collects log messages from any log-generating application running on the system. When installed on a Windows system, Agents can also collect the system's Windows Event Logs via the Secure Sockets Layer (SSL) protocol.
When you install TLC Manager software, the installer creates the Audit Logger File Store on the Manager's host system. The Audit Logger is TLC's long-term log store, and the Audit Logger File Store consists of:
A series of compressed flat files that contain the log messages collected by the Manager from Log Sources, and
An index of terms within the log messages.
Each Manager also connects with one or more Event-Management Databases. A component of your TLC environment, an Event-Management Database stores Events (i.e. log messages that have been normalized by TLC). If an Event-Management Database is hosted by a system other than a Manager, the system is known as a Remote Database Server. When you install TLC Manager, the installer includes an instance of PostgreSQL which may be used as the default Event-Management Database.
Figure 1 illustrates the default ports that may be involved in your Tripwire Log Center environment. For more information about default ports, see:
Requirements for Tripwire Log Center Manager
Figure 1. TLC environment example