Planning your TLC Environment

To determine the optimal TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation. for your organization, consider the following factors prior to configuring TLC:

1.

The people in your organization. Their skills, knowledge, needs, and availability will determine which TLC features they use. For instance, if someone is responsible for monitoring log messages as they are collected by Tripwire LogCenter, he or she might use the Real-Time Event ViewerA TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component that displays log messages as they are collected by TLC. and Reports. On the other hand, your TLC Administrator will likely be responsible for configuring your TLC environment.

2.

The hardware and platforms of the systems in your TLC environment. At minimum, your Managers and Database Server should comply with the TLC installation requirements:

https://www.tripwire.com/products/tripwire-log-center/system-requirements/

Caution

If you converted a trial TLC installation to a fully licensed version, the systems in your TLC environment may not conform with all installation requirements. Since TLC is a high-performance product, be sure to review the requirements to ensure that your Event-Management DatabaseAn optional component of your TLC environment, an Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Database stores Events. Types of Event-Management Databases include Event Databases, IDS Databases, and Firewall Databases. software, TLC Managers, and TLC Consoles are in full compliance.

3.

The Log Sources from which TLC will collect log messages. In particular, consider:

The method by which TLC Collectors gather or receive log messages from each type of Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. (see Appendix I: Log-Source Configuration).

Any additional measures that should be taken to secure the data collected by TLC.

4.

Business drivers, such as the form of governance, regulations, compliance, or corporate policy. Often, such factors recommend or mandate a specific log- and event-management solution.

5.

Your network architecture, which typically reflects geographic and/or organizational boundaries. Such boundaries may influence your use of Secondary Managers. For example, you might place a Secondary ManagerYour TLC environment may also include one or more Secondary Managers that may be configured to either: 1. Store log messages (as with a Primary ManagerEach TLC environment has a single Primary Manager that controls: 1. The storing of log messages in the Audit LoggerThe TLC Console component in which you can work with the log messages collected by TLC. File Store and Events in Event-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC.), or 2. Forward log messages to another Manager.:

In each geographic region defined by your network. This approach is a simple way to segregate your data for each region. (When evaluating geographic boundaries, consider the impact of system clocks, international laws, and user permissions.)

At the juncture of two business units prevented from sharing certain types of traffic by a security policy. In this case, the Log Sources in each unit could send log messages to the Manager without traversing the boundary.

Note	A Secondary Manager can either collect log messages itself, or forward log messages to another Manager (see What are Managers, Log Sources, and Monitored Assets?).

6.

Network limitations can also influence the use of Secondary Managers. For example, you should ensure that the appropriate ports are open (see Table 29), and you might place a Secondary Manager in the following positions:

At the remote end of a slow or saturated link.

At the remote end of a link with an intermittent connection (e.g. a Syslog or SNMP link).

At a network 'choke point,' such as a firewall or router.

7.

Access to data and resources may be required or prohibited by your organization. For instance, you might restrict user permissions in order to prevent unauthorized personnel from accessing TLC data.