Log Management

What is the Audit Logger?

Tripwire LogCenter (TLC) stores log messages in the Audit Logger File StoreConsists of a series of compressed flat files containing the log messages collected by the Manager from Log Sources, and an index of terms contained in the log messages., a series of compressed flat files. When TLC receives a log messageA data record generated by a Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. and collected by TLC. from a CollectorA TLC module that gathers or receives log messages from Log Sources., TLC first places the message in an internal cache known as the Audit LoggerThe TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. Buffer. When the log messages in the buffer exceed specified time and size thresholds, TLC:

1.

Calculates 256-SHA checksums to verify the integrity of each file created when the buffer is flushed to disk,

2.

Saves each message (in its original format) in the Audit Logger File Store,

3.

Indexes the key terms in each message (to support standard search-engine queries), and

4.

(Optional) Encrypts each message with the AES-256 algorithm.

Due to this unique design, TLC provides high-speed performance capable of storing all log messages generated by the Log Sources on your network. To learn how TLC determines if a log message should be saved in the Audit Logger File Store, see What are Collectors?.

The Audit Logger is the component of the TLC Console in which you can work with the log messages collected by TLC. In the Audit Logger, you can:

Review statistics about the Audit Logger's capacity, data compression, and log-message traffic (see Viewing Audit Logger Vital Statistics).

Run SQL-like queries of stored log messages (see Working with Audit Logger Queries).

Generate graphs of queried data (see Displaying Audit Logger Data in a Graph).

Run Reports about the Audit Logger's messages (see Generating an Audit Logger Report).

Send log messages from the Audit Logger to an Event-Management DatabaseAn optional component of your TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation., an Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Database stores Events. Types of Event-Management Databases include Event Databases, IDS Databases, and Firewall Databases. (see Sending Log Messages to an Event-Management Database).

Tip	The Audit Logger File Store can reside on a local disk drive on a Manager or a fiber-attached network storage device (such as iSCSI storage).

The Audit Logger File Store is located in the directory specified when you installed TLC Manager (see Installing TLC Manager on your Primary Manager). If Separate Data by LocationA custom category used to classify Monitored Assets by geography. is enabled for the Audit Logger (see Working with Managers), the Audit Logger directory will contain a folder for each of your Locations (see About Locations and the Audit Logger). For example:

<audit_logger_file_store>\1\

Each Location folder contains a sub-folder for each day since TLC Manager was installed. The name of each sub-folder is based on the date when the sub-folder was created (e.g., 20150822), and each sub-folder contains a collection of zip files with the data in the Audit Logger.

TLC updates the Audit Logger Index whenever it adds a new log file to the Audit Logger File Store. In addition, TLC performs a daily clean-up of the Index which involves the removal of references to log files that have been moved to an offline archive, as well as the indexing of any files that have been moved from offline storage to the Audit Logger File Store.