Where does TLC store Data?

The System Database

Installed on your Primary ManagerEach TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation. has a single Primary Manager that controls: 1. The storing of log messages in the Audit LoggerThe TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. File Store and Events in Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC., the System DatabaseInstalled on your Primary Manager, the System Database stores a record of all user logins and logouts, as well as all TLC objects defined in the TLC Console; for example, Monitored Assets, NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules, and Event Tickets stores a record of all user logins and logouts, as well as all TLC objects defined in the TLC Console; for example, Monitored Assets, Normalization Rules, and Event Tickets.

Storing Log Messages

Each Manager in your TLC environment can host an Audit Logger File StoreConsists of a series of compressed flat files containing the log messages collected by the Manager from Log Sources, and an index of terms contained in the log messages.. The Audit Logger is TLC's log-storage tool, and the Audit Logger File Store consists of:

A series of compressed flat files containing the log messages collected by the Manager from Log Sources, and

An index of terms contained in the log messages.

For more information about the Audit Logger, see What is the Audit Logger?.

You can also configure a Manager to forward log messages to a third-party log-archive tool. For further details, see What is Log-Message Forwarding?.

Storing Events

Each Manager also hosts one or more Event-Management Databases. An optional component of your TLC environment, an Event-Management DatabaseAn optional component of your TLC environment, an Event-Management Database stores Events. Types of Event-Management Databases include Event Databases, IDS Databases, and Firewall Databases. stores Events. An Event is either:

A log messageA data record generated by a Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. and collected by TLC. that the Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages).

An event or vulnerabilityA potential security weakness identified by a vulnerability scannerA device that monitors systems in your TLC environment (for example, a vulnerability scanner).. In an Event Database, you can import or collect vulnerabilities detected by a scanner. imported from a scanner (see What are Scanner Events?).

Table 28 describes each type of Event-Management Database.

By default, the TLC ManagerTripwire LogCenter Manager is the core software in your TLC environment. TLC Manager collects and processes log messages from a wide variety of systems and devices. installer creates a single Event DatabaseA type of Event-Management Database that stores Events from any Log Source and/or scanner. called 'Events.' With the Database Viewers in the TLC Console, you can review information about the Events in your Event-Management Databases (see The Event-Database Viewer).

Note	To configure user permissions for an Event-Management Database, see Working with Database Permissions.

Table 28. Types of Event-Management Databases and Database Viewers

Type	Stores Events from ...	Database Viewer
Event Database	... any Log Source and/or scanner (see What are Scanner Events?).	Event-Database ViewerA type of Database ViewerA TLC Console component in which you can review information about Events in Event-Management Databases. Types of Database Viewers include the Event-Database Viewer, IDS-Database Viewer, and Firewall-Database Viewer. in which you can query and work with the data in your Event Databases.
Firewall Database	... firewalls. These Events involve core firewall functionality and, typically, relate to network traffic.	Firewall-Database ViewerA type of Database Viewer in which you can query and work with the data in your Firewall Databases.
IDS Database	... IDS and IPS devices. These Events may include detected traffic anomalies, intrusions, etc.	IDS-Database ViewerA type of Database Viewer in which you can query and work with the data in your IDS Databases.