Step 5. Configure your Collectors

By default, the TLC installer creates the following modules and assigns them to each of your Managers:

The Audit LoggerThe TLC Console1. Tripwire Log Center Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire Log Center GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. (see What is the Audit Logger?)

The Correlation EngineThe component of your Primary ManagerEach TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation. has a single Primary Manager that controls: 1. The storing of log messages in the Audit Logger File Store and Events in Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC. responsible for identifying events of interest. To correlate events, the CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engine applies Correlation Rules to the Normalized Messages received from the NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Engine. (see How does Event Correlation work?)

The License Service (see About User Access and Licensing)

The Schedule Engine (see What are the Task Manager and Task Scheduler?)

In addition, the TLC installer assigns the required Collectors for the product types you added during installation. Table 28 defines each type of CollectorA TLC module that gathers or receives log messages from Log Sources. in TLC. If you added Log Sources for the File CollectorA type of Collector that gathers log messages from Log Sources that store messages in an ASCII log file., Network CollectorA type of Collector that listens for Syslog and SNMP-based log messages from network devices., and/or Database CollectorA type of Collector that gathers log messages from an application that logs to an External Database., you will now review and configure their properties.

To configure the Collectors for each Manager:

1.

In the side bar, select Resources >Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. Groups, Managers, Locations, Event-Management Databases), normalization objects (Normalization Rules, Aliases, and Normalized-Message Filters), and correlation objects (Correlation Engines, Rules, Lists, and Actions)..

2.

In the side bar of the Configuration Manager, select Resources >Managers.

3.

In the workspace, double-click a Manager.

4.

As needed, review and edit the following tabs:

For a File Collector, select the File Collector tab.

For a Network Collector, select the Network Collector tab.

For a Database Collector, select the DB Collector tab.

For further details about each of these tabs, see Table 42.