Working with Locations

A LocationA custom category used to classify Monitored Assets by geography. is a custom category used to classify Monitored Assets by geography. In the Audit LoggerThe TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. and Database Viewers, you can search for log messages based on the Locations assigned to your Monitored Assets.

To add, edit, or delete Locations:

1.

In the side bar, select Resources >Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. Groups, Managers, Locations, Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases), normalization objects (NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules, Aliases, and Normalized-Message Filters), and correlation objects (CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engines, Rules, Lists, and Actions)..

2.

In the side bar of the Configuration Manager, select Resources >Locations.

3.

To create a new Location:

a.

ClickAdd.

b.

In the Location dialog, enter a Name and Description for the Location and click OK.

To edit a Location:

a.

In the workspace, double-click the Location.

b.

Edit the Location properties dialog and click OK.

To delete a Location, select the Location and clickDelete.

Next	See Assigning Locations to a Monitored Asset.

About Locations and the Audit Logger

Some organizations require the physical partitioning of log-message data in the Audit Logger. If you enable the Separate Data by Location setting in the Audit Logger tab of a Manager's properties dialog (see Table 43), TLC will create and maintain an Audit Logger sub-directory for each of your Locations. When TLC collects a log messageA data record generated by a Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. and collected by TLC. from a Log Source, the log message will be written to the sub-directory of each Location assigned in the properties dialog of the Log Source’s Monitored AssetAn object in the TLC Configuration Manager that represents a Log Source from which TLC collects log messages directly. (see Working with Monitored Assets).

For example, assume that you have three Locations named Location 0 (the default Location), Location 1, and Location 2. If TLC collects a log message for a Monitored Asset to which Location 0 and Location 2 are assigned, the Audit Logger writes the log message to both the Location 0 sub-directory and the Location 2 sub-directory.

If this feature is enabled, you can also limit Audit Logger searches to log-message data for a single Location by specifying the Location in the Monitored Assets field of the Audit Logger's Query Criteria tab. For more information, see Working with Audit Logger Queries.

Caution	If you enable and then disable the 'Separate data by Location' setting, some log messages stored in Location sub-directories may be omitted from Audit Logger queries. Therefore, Tripwire recommends that you do not disable this setting once it has been enabled.