Troubleshooting the Contents of an Event-Management Database

If an Event-Management DatabaseAn optional component of your TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation., an Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Database stores Events. Types of Event-Management Databases include Event Databases, IDS Databases, and Firewall Databases. does not contain the Events you expect to see for a Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages., complete the following steps to determine the source of the problem.

Step 1. Review your TLC Configuration

Review the following topics to ensure that your TLC environment is properly configured:

Planning your TLC Environment

Configuring your TLC Environment

Specifically, the following configuration steps must be completed:

The latest Tripwire-defined NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules for the Log Source must be downloaded from the Tripwire Web site (see Step 3. Import the Latest Normalization Rules).

The Monitored AssetAn object in the TLC Configuration Manager that represents a Log Source from which TLC collects log messages directly. for the Log Source should be added to an AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. group (Step 4. Configure your Asset Groups).

In your Manager’s properties, the appropriate CollectorA TLC module that gathers or receives log messages from Log Sources. must be added to the Installed Modules tab (Step 5. Configure your Collectors).

In the Monitored Asset’s properties, the Collector must be assigned in the Settings tab (Step 6. Configure your Monitored Assets).

All appropriate Tripwire-defined Normalization Rules must be assigned to the Asset GroupA TLC object that may contain one or more Monitored Assets. (Step 8. Assign Normalization Rules to Asset Groups). If the group lacks a Normalization Rule with a .NET regular expression suitable for a log messageA data record generated by a Log Source and collected by TLC., TLC cannot normalize the message and, therefore, the message cannot be saved in an Event-Management Database.

In the properties of your Correlation EngineThe component of your Primary ManagerEach TLC environment has a single Primary Manager that controls: 1. The storing of log messages in the Audit LoggerThe TLC Console1. Tripwire Log Center Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire Log Center GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. File Store and Events in Event-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC. responsible for identifying events of interest. To correlate events, the Correlation Engine applies Correlation Rules to the Normalized Messages received from the Normalization Engine., you must assign all Correlation Rules with which TLC will correlate Normalized Messages (Step 9. Assign Correlation Rules to the Correlation Engine).

The Authentication tab in the Event-Management Database's properties dialog must specify login credentials for a valid database user account (see Creating an Event Database).

If these configuration steps fail to resolve the issue, proceed to Step 2. Assess your Correlation Rules .

Step 2. Assess your Correlation Rules

If an Event-Management Database is assigned as an Output DestinationAssigned to a Monitored Asset, an Output Destination is either the Audit Logger, an Event-Management Database, or a Correlation Engine that correlates Normalized Messages. in the properties of a Monitored Asset, TLC should create an Event in the database whenever a log message from the Asset's Log Source(s) is normalized. However, this approach can quickly overload the database with Events, so Tripwire recommends against it. If you want TLC to create Events in an Event-Management Database, Tripwire advises that the database be added as an Output in one or more Correlation Rules (How does Event Correlation work?).

For testing purposes in this Step, you will temporarily assign the database directly to your Monitored Asset. If this results in the creation of the expected Events in the database, then your Correlation Rules are the most likely source of the problem.

To assign the Event-Management Database to your Monitored Asset: 

1.

In the side bar, select Resources >Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, Asset Groups, Managers, Locations, Event-Management Databases), normalization objects (Normalization Rules, Aliases, and Normalized-Message Filters), and correlation objects (Correlation Engines, Rules, Lists, and Actions)..

2.

In the side bar of the Configuration Manager, select Resources >Monitored Assets.

TLC presents your Assets in the workspace table.

a.

ClickAdd.

If TLC begins creating the expected Events in the database, then you should inspect the Correlation Rules in which the database has been assigned as an Output. Most importantly, review the conditions defined in the DecisionA component of a Correlation Rule, a Decision defines a condition that determines if the rule continues correlating a log message. Settings tab and the Database Settings tab (see Defining a Correlation Rule and Table 95). In addition, your Correlation Rules must be assigned to the Correlation Engine (see Assigning Correlation Rules to a Correlation Engine).

Otherwise, proceed to Step 3. Query Log Messages in the Audit Logger.

Step 3. Query Log Messages in the Audit Logger

In this Step, you will query the log messages collected from the Log Source. In a text file, you will save the IDs of the Normalization Rules used to normalize messages in the query results, along with the contents of any log messages that the query was unable to normalize. In Step 4. Assess the Normalization Rules assigned to the Asset Group, you will use this information to determine if your Normalization Rules are preventing the creation of the expected Events in your Event-Management Database.

To query the Audit Logger: 

2.

In the side bar, select Events >Audit Logger.

The Query Results - Normalized Messages tab displays the queried log messages that were successfully normalized.

If the Asset Group (or Monitored Asset) does not have a Normalization Rule with a regular expression that can normalize one or more queried log messages, TLC also presents the Query Results - Log Messages tab. This tab presents the log messages in their 'raw,' un-normalized format.

If the query fails to produce a Query Results - Log Messages tab, try adjusting the Date and Time fields. If further queries fail to present this tab, there is no need to proceed further. Contact Tripwire Technical Support.

a.

Select all rows in the query results and clickCopy selected items to Clipboard.

Step 4. Assess the Normalization Rules assigned to the Asset Group

In this Step, you will examine the Tripwire-defined Normalization Rules assigned to the Asset Group containing the Monitored Asset to determine if either of the following issues might explain why your Event-Management Database lacks the expected Events. 

The Asset Group may not have a Normalization Rule capable of normalizing log messages from the Monitored Asset's Log Source. In this step, you will test the compatibility of each of the group's rules by searching the log messages in the text file (created in Step 3. Query Log Messages in the Audit Logger) for the rule's 'Quick Match' expression.

Each Tripwire-defined Normalization-Rule Group contains at least one 'generic' Normalization Rule. A generic rule is capable of normalizing any log message from the associated type of Log Source. Generic rules have a low priority (a value of 900 or greater), so they only normalize log messages if other rules assigned to the Asset Group fail to do so. Most importantly, log messages normalized by a generic rule cannot be saved as Events in an Event-Management Database. Here, you will determine if the Asset Group contains a generic rule that is normalizing log messages from the Log Source.

To complete this Step:

2.

In the side bar, select Resources >Configuration Manager.

3.

In the side bar of the Configuration Manager, select Resources >Asset Groups.

Make a note of all Rule IDs that are not listed in the text file. You will test these rules below.

If the text file contains a Rule ID that does not appear in this column, then the rule is assigned directly to the Monitored Asset, rather than the Asset Group.

If the name of one of these rules includes the term "generic," then it is a generic rule. Therefore, log messages normalized with this rule cannot be saved in Event-Management Databases.

If the log messages in the text file do not contain the Quick Match value, proceed to the next rule.

If a log message contains the Quick Match value, copy the content of the log message to your clipboard and complete the remaining steps.

If TLC presents column values in the Test Output field, the Normalization Rule is capable of normalizing the log message.

If the Test Output field is void, the rule's regular expression cannot parse the message's content. In this case, you should contact Tripwire Technical Support.

Step 5. Check your Normalized-Message Filters

To determine if your Normalized-Message Filters are the source of the problem:

1.

In the side bar, select Resources >Configuration Manager.

2.

In the side bar of the Configuration Manager, select Normalization >Normalized-Message Filters.

TLC presents your Normalized-Message Filters in the workspace table. The Filter Type column indicates the Event-Management Database (or Correlation Engine) to which the filter applies.

4.

Right-click one of the rows and selectDisable selected filters.