Changing the Output Destinations for a Monitored Asset

For an introduction to Output Destinations, see How does Log-Message Normalization work?.

To change the list of Output Destinations assigned to a Monitored Asset:

In the side bar, select Resources >

Configuration Manager.

In the side bar of the Configuration Manager, select

Resources > Assets

Monitored Assets.

TLC presents your Monitored Assets in the workspace table.

Tip	You can sort, group, and filter the contents of tables. For more information, see Working with Tables).

In the workspace, double-click the Monitored Asset.

In the Monitored Asset properties dialog , select the Output Destinations tab. This tab lists the Output Destinations for the Asset (i.e. the Audit Logger, an Event-Management Database, or the Correlation Engine).

Tips	Since saving log messages in an Event-Management Database can overload the database with Events, Tripwire recommends that you exercise discretion when assigning databases as Output Destinations. To maintain a comprehensive record of 'raw' log messages from an Asset's Log Source, assign the Audit Logger as an Output Destination. If you do assign an Event-Management Database as an Output Destination, and the database is consequently overloaded with Events, click here for troubleshooting tips.

Tips

Since saving log messages in an Event-Management Database can overload the database with Events, Tripwire recommends that you exercise discretion when assigning databases as Output Destinations. To maintain a comprehensive record of 'raw' log messages from an Asset's Log Source, assign the Audit Logger as an Output Destination.

If you do assign an Event-Management Database as an Output Destination, and the database is consequently overloaded with Events, click here for troubleshooting tips.

To add an Output Destination to the Monitored Asset:

Click

Add.

Select the Output Destination and click Add.

To remove an Output Destination, select the destination and click Delete/Remove Remove.