Installing TLC Manager on a Failover Manager

Prior to installing TLC ManagerTripwire Log Center Manager is the core software in your TLC environment. TLC Manager collects and processes log messages from a wide variety of systems and devices., complete the installation requirements (see Requirements for Tripwire Log Center Manager).

Step 1. Adding a Failover Manager in the TLC Console

To add a Failover Manager in your TLC Console:

1.

Log in to the TLC Console1. Tripwire Log Center Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire Log Center GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. (see Logging in to the TLC Console).

2.

Add the Failover ManagerA TLC Manager that serves as a backup system for another Manager in the event of system downtime. (see Adding a Failover Manager).

3.

In the Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. Groups, Managers, Locations, Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases), normalization objects (NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules, Aliases, and Normalized-Message Filters), and correlation objects (CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engines, Rules, Lists, and Actions)., select Resources > Managers.

4.

In the workspace of the Managers page in the Configuration Manager, select all Managers with a status of Not Current.

5.

Right-click the selected Managers and select Push Updates to Manager.

Step 2. Installing TLC Manager

To install TLC Manager software on your Failover Manager host system, complete the following steps with a local administrator account:

1.

In the directory in which you unzipped the TLC installation package, double-click Tripwire Log Center Manager.exe.

The TLC Manager Installation Wizard opens.

2.

Read the Welcome page and click Next.

3.

In the License Agreement page:

a.

Read the License Agreement.

b.

Select I accept the terms in the license agreement and click Next.

4.

Complete the Customer Information page and click Next.

5.

In the Destination Folder page, select the directory in which you want to install TLC Manager. Then, click Next.

6.

Click Install.

7.

Following installation, a confirmation page opens. Click Finish.

The TLC Manager Configuration Wizard opens.

Tip	If the installer presents an "unable to find a Manager ID" error message, click here for troubleshooting tips.

Step 3. Configuring TLC Manager

To configure TLC Manager software on a Failover Manager:

1.

In the TLC Manager Configuration Wizard, select Click to Start.

2.

Click Add as a Failover Manager.

3.

In the Manager Service Credentials page (see Figure 25), specify the Windows user account that will run the TLC Manager Service.

Caution

Following installation, you may change this user account. For instructions, see the documentation for the TLC Manager’s Windows operating system. Tripwire recommends that you specify an Administrator account. However, if you want to assign a non-Administrator account, you must complete the steps described in Appendix II. Configuring a Windows User Account to Run the TLC Manager Service following installation.

To use a local Windows user account, select The local Windows System user account and click Next.

To use a domain user account:

a.

Select Domain user account.

b.

In the Domain user account field, enter the domain and the name of the account (<domain>\<account>).

If you installed Microsoft SQL Server in Windows Authentication mode as your Event-Management DatabaseAn optional component of your TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation., an Event-Management Database stores Events. Types of Event-Management Databases include Event Databases, IDS Databases, and Firewall Databases. software, enter the domain account created when you installed the software (see Step 3. Creating a Microsoft SQL Server Login).

c.

Enter and confirm the account's Password.

d.

Click Apply Settings and Next.

Figure 25.  Manager Service Credentials page

4.

Complete the Primary ManagerEach TLC environment has a single Primary Manager that controls: 1. The storing of log messages in the Audit LoggerThe TLC Console component in which you can work with the log messages collected by TLC. File Store and Events in Event-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC. Information page (see Table 7 and Figure 26) and click Next.

Table 7. Fields in the Primary Manager Information page

Field	Description
Hostname or IP address	The IP Address or host name of your Primary Manager.
Host port	The port on your Primary Manager to be used for communication with this Failover Manager.
Username and Password	The login credentials of a TLC User Account with the Add Manager user permission. Notes: The default administrator account has this permission. To view permissions in the TLC Console, open the Administration page, and then expand Permissions > Managers > Secondary ManagerYour TLC environment may also include one or more Secondary Managers that may be configured to either: 1. Store log messages (as with a Primary Manager), or 2. Forward log messages to another Manager..  You cannot enter the login credentials of a user account for which the 'Single sign-on' authentication method has been configured in the user account's properties dialog in the TLC Console. For more information about user accounts and authentication methods, see Creating and Deleting User Accounts.

Figure 26.  Primary Manager Information page

5.

In the Perform Configuration page (see Figure 27), click Add.

Figure 27.  Perform Configuration page

6.

From the drop-down in the Manager dialog (see Figure 28), select the Failover Manager (created in Step 1. Adding a Failover Manager in the TLC Console).

Figure 28.  Manager dialog

7.

Upon completion of the installation process, select Start Tripwire Log Center Manager on Finish and click Finish (see Figure 29).

Tripwire Log Center Manager opens.

Figure 29.  Configuration Wizard complete

8.

If you specified a non-Administrator account in the Manager Service Credentials page (see Figure 25), complete the steps in Appendix II. Configuring a Windows User Account to Run the TLC Manager Service.

9.

To start the TLC Manager Service, click Start.

TLC Manager populates the Log list with log messages.

Note

If you plan to install Tripwire Axon Agent for TLCA service that may be installed on a Windows, AIX, or Linux system to collect log messages from any log-generating application running on the system. When installed on a Windows system, this service can also collect the system's Windows Event Logs via the Secure Socket Layer (SSL) protocol. on a system(s) from which this Manager may collect log messages, you must also configure the Manager's Axon Access PointA component of TLC Manager through which Axon Agents deliver log messages to TLC.. For more information, see Getting Started with Tripwire Axon Agent for TLC.