Working with Saved Queries in the Audit Logger

This topic explains how to: 

Create a Saved Query in the Audit LoggerThe TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC..

View existing Saved Queries.

Edit and save the properties of a Saved Query.

Copy or delete a Saved Query.

Export the results of a Saved Query to an XML file.

To work with Saved Queries in the Audit Logger:

1.

In the side bar, select Events >Audit Logger.

2.

In the Audit Logger, select the Query tab.

The Query Criteria tab opens. The left panel of this tab presents the hierarchy of all Saved Queries in the Audit Logger.

3.

To create a Saved Query, complete the following steps in the workspace of the Query Criteria tab:

a.

In the Name field, enter a name for the Saved Query.

b.

Specify one or more ClassificationThe process of categorizing log messages with Classification Tags. Tags and/or Terms.

c.

As needed, complete the remaining criteria (see Table 80).

d.

To run the query, click Start.

e.

If the query produces the desired results, click Save in the Query Criteria tab.

To edit the properties of a Saved Query:

a.

Select the query in the left panel of the Query Criteria tab.

b.

As needed, edit the fields in the workspace (see Table 80).

c.

Click Save.

To create a copy of a Saved Query, right-click the query in the left panel of the Query Criteria tab and select Copy Search.

To delete a Saved Query, right-click the query and select Delete Search.

To export the results of a Saved Query to an XML file, right-click the query and select Export Search.