About your TLC Environment

Tripwire Log Center Manager (or TLC ManagerTripwire Log Center Manager is the core software in your TLC environment. TLC Manager collects and processes log messages from a wide variety of systems and devices.) is the core TLC software that collects log messages from a wide variety of systems and devices, known as Log Sources. A Manager is a host system on which TLC Manager software has been installed. 

Each TLC environment has a single Primary ManagerEach TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation. has a single Primary Manager that controls: 1. The storing of log messages in the Audit LoggerThe TLC Console1. Tripwire Log Center Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire Log Center GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. File Store and Events in Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC. that controls data storage, configuration settings, and user access to TLC.

Your TLC environment may also include one or more Secondary Managers to assist the Primary Manager with the storage and processing of log messages.

Your TLC environment may also include one or more Failover Managers. Each Failover ManagerA TLC Manager that serves as a backup system for another Manager in the event of system downtime. serves as a backup system for another TLC Manager in the event of system downtime.

Note	For more information about Managers, see What are Managers, Log Sources, and Monitored Assets?.

Tripwire Log Center Console (or TLC Console) provides the graphic user interface (GUI) with which users review, analyze, and correlate this data.

Your Tripwire Log Center (TLC) environment consists of all systems on which TLC Manager and TLC Console have been installed, along with the Log Sources from which TLC collects log messages. In addition, your TLC environment includes the databases in which TLC stores log messages and related data, as well as any Axon Agents.

Installed on a Windows or Linux system, Tripwire Axon Agent for TLCA service that may be installed on a Windows, AIX, or Linux system to collect log messages from any log-generating application running on the system. When installed on a Windows system, this service can also collect the system's Windows Event Logs via the Secure Socket Layer (SSL) protocol. is a service that collects log messages from any log-generating application running on the system (a.k.a., an Axon AgentA system on which Tripwire Axon Agent for TLC software has been installed.). When this service is installed on a Windows system, TLC can also collect the system's Windows Event Logs via the Secure Sockets Layer (SSL) protocol.

When you install TLC Manager software, the installer creates the Audit Logger File StoreConsists of a series of compressed flat files containing the log messages collected by the Manager from Log Sources, and an index of terms contained in the log messages. on the Manager's host system. The Audit Logger is TLC's long-term log store, and the Audit Logger File Store consists of:

A series of compressed flat files that contain the log messages collected by the Manager from Log Sources, and

An index of terms within the log messages.

Each Manager also connects with one or more Event-Management Databases. A component of your TLC environment, an Event-Management DatabaseAn optional component of your TLC environment, an Event-Management Database stores Events. Types of Event-Management Databases include Event Databases, IDS Databases, and Firewall Databases. stores Events (i.e. log messages that have been normalized by TLC). If an Event-Management Database is hosted by a system other than a Manager, the system is known as a Remote Database Server. When you install TLC Manager, the installer includes an instance of PostgreSQL which may be used as the default Event-Management Database.

Figure 1 illustrates the default ports that may be involved in your Tripwire Log Center environment. For more information about default ports, see: 

Requirements for Tripwire Log Center Manager

What are Collectors?

Figure 2 shows a simplified Tripwire Log Center environment with a Failover Manager assigned to the Primary Manager.

Figure 1.  TLC environment example

Figure 2.  TLC environment example with a Failover Manager assigned to the Primary Manager