Real-Time Event Viewer

Viewing Log Messages in the Real-Time Event Viewer

The Real-Time Event ViewerA TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component that displays log messages as they are collected by TLC. displays log messages as they are received by the Check Point CollectorA type of CollectorA TLC module that gathers or receives log messages from Log Sources. that listens for log messages from a Check Point Manager., Cisco IDS CollectorA type of Collector that gathers log messages from Cisco IDS sensors., Network CollectorA type of Collector that listens for Syslog and SNMP-based log messages from network devices., Oracle Database CollectorA type of Collector that gathers log messages from Oracle database audit logs., WinLog CollectorA type of Collector that collects log messages from Windows Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source. Logs via the Windows Management Instrumentation (WMI) protocol., or Advanced Windows CollectorA type of Collector that collects log messages from Windows Event Logs on Axon AgentA system on which Tripwire Axon Agent for TLC software has been installed. systems via the Secure Sockets Layer (SSL) protocol. for your Manager. The Real-Time Event Viewer can be a useful tool for troubleshooting problems with your Log Sources. For example, you can quickly verify that TLC is successfully collecting log messages from a Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages..

To view log messages in the Real-Time Event Viewer:

1.

In the side bar, select Events >Real-Time Event Viewer.

2.

At the top of the Real-Time Event Viewer, enter filter criteria to specify the log messages to be displayed in the viewer (see Table 76).

3.

Click Start.

The Real-Time Event Viewer presents a scrolling list of the Collector's log messages in the workspace (see Table 77).

To stop the Real-Time Event Viewer, click Stop.

To reset the filter criteria fields, click Clear.

To save the displayed log messages in a CSV file, click Save.

Tips

For busy Log Sources, the Real-Time Event Viewer will display log messages almost immediately. If you do not see any log messages for a Log Source, you can do something to the Log Source's host to prompt the creation of a log messageA data record generated by a Log Source and collected by TLC.. For example, you could log into the host, enter the configuration mode, and make a harmless, minor configuration change. When the Real-Time Event Viewer is running, you can enable and disable the Scrolling, Resolve IPs, and Wrap Text filter criteria to change the display of log messages.

Table 76. Real-Time Event Viewer filter criteria

Field	Description
Message-content filter	Limits the Real-Time Event Viewer to log messages containing specified text (e.g. "logon" or "administrator"). By adding a .NET regular expression to the specified text, you can further limit the Real-Time Event Viewer to log messages that 1) contain the specified text, and 2) satisfy the condition(s) specified by the regular expression. For example, if you enter the following criteria in the Message-content filter field, TLC will limit the Real-Time Event Viewer to log messages that 1) contain the string "administrator," and 2) satisfy the Process(1|2|3) regular expression: administrator || Process(1|2|3)
IP-address filter	A .NET regular expression for the IP address(es) of Log Sources. If a message's Log Source does not have an address that matches the expression, the Real-Time Event Viewer will not display the log message.
Collector	The Collector for which log messages will be displayed.
Messages displayed per second	Limits the event-per-second (EPS) speed with which the Real-Time Event Viewer displays log messages.
Auto-scroll	If enabled, the Real-Time Event Viewer automatically scrolls down the list of log messages as they are received.
Resolve IP addresses	If enabled, the Real-Time Event Viewer resolves the IP addresses of Log Sources and displays the host name in the Host1. A Log Source or a system involved in an Event. 2. A system on which TLC Manager, TLC Console, or Event-Management Database software is installed. Name column.
Wrap text	If enabled, the Real-Time Event Viewer wraps the content of log messages displayed in the Message column.

Table 77. Columns in the Real-Time Event Viewer

Column	Description
Timestamp	The date and time when the Collector created a log message.
IP	The IP address of the Log Source that created a log message.
Host Name	By default, the IP address of the Log Source. If Resolve IPs is selected in the filter criteria, this column displays the resolved host name of the Log Source.
Message	The content of a log message.