Sending Log Messages to an Event-Management Database

With this procedure, TLC queries the Audit Logger File StoreConsists of a series of compressed flat files containing the log messages collected by the Manager from Log Sources, and an index of terms contained in the log messages. for log messages to be saved as Events in a specified Event-Management DatabaseAn optional component of your TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation., an Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Database stores Events. Types of Event-Management Databases include Event Databases, IDS Databases, and Firewall Databases. (see How does Log-Message Normalization work?). To normalize each log messageA data record generated by a Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. and collected by TLC., TLC uses the Normalization Rules assigned to each Asset GroupA TLC object that may contain one or more Monitored Assets. containing the Monitored AssetAn object in the TLC Configuration Manager that represents a Log Source from which TLC collects log messages directly. that represents the message's Log Source (see Assigning Normalization Rules to Asset Groups), as well as any rules assigned to the Asset itself (see Table 51).

To send log messages from the Audit Logger to an Event-Management Database:

1.

In the side bar, select Events >Audit LoggerThe TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC..

2.

In the Audit Logger, select the Query tab.

3.

From the Output drop-down, select Database.

TLC adds a Database drop-down to the Query Criteria tab.

4.

From the Database drop-down, select the Event-Management Database to which the log messages will be exported.

Note	If you select the Clear check box, TLC will delete all Events in the selected database before importing the messages from the Audit Logger.

5.

Enter your other criteria for the query (see Table 80).

6.

Click Start.

When the process completes, click OK in the Information dialog.