User manual NOVELL SENTINEL LOG MANAGER 1.0.0.5 ADMINISTRATION GUIDE 03-31-2010

[. . . ] novdocx (en) 19 February 2010 AUTHORIZED DOCUMENTATION Administration Guide Novell® 1. 0. 0. 5 March 31, 2010 SentinelTM Log Manager 1. 0. 0. 5 www. novell. com Sentinel Log Manager 1. 0. 0. 4 Administration Guide novdocx (en) 19 February 2010 Legal Notices Novell, Inc. , makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. , reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. Further, Novell, Inc. , makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. , reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes. [. . . ] EPS: Displays the events per second value received from the event sources. When you click the Name or EPS value column, a pop-up is displayed with additional information about the event source server. The pop-up displays the Collector Plugin, Description, Release Date, Scripting Language, Matching Rule, Applications, Universal, Event Sources, Events Per Second, Health, Event Sources Healthy, Event Sources With Warning, Event Sources With Error, Event Sources Offline, Collector Instances and Supported Devices fields with their values. The Collector Instances field displays the number of instances of the collector plug-in. Clicking on the Collector Instances field displays a Collectors pop-up with a list of Collector instances associated with the Collector plug-in. 68 Sentinel Log Manager 1. 0. 0. 4 Administration Guide novdocx (en) 19 February 2010 10 In the Event Source section, click the Next, Previous, First, and Last arrow links to scroll through all the event sources. 11 To view the event search result for an event source, select the event source from the list and click the Search link. A new search results tab is displayed with the search results using the universally unique identifier (UUID) of the event source (for example, rv24:"2CBFB8A0-F24B-102C-A498000C"). If multiple event sources are selected for search, the rv24:<UUID> expressions are combined with the OR operator in the search filter expression. Results for all selected event sources will be returned as shown in the following image: Configuring Data Collection 69 novdocx (en) 19 February 2010 12 To change the data logging status for one or more event sources, select the event sources from the list, click the Configure link, and select either Drop Data or Allow Data option, Drop Data: If Drop Data is selected, the selected event source(s) will drop all the events received. Messages will not be sent to the collector(s) the selected event sources are connected to. Allow Data: If Allow Data is selected, the selected event sources will forward events received to the Collector(s) they are connected to. NOTE: If you select a large number of event sources to change, it may take a while to complete. The event sources list will not show the Drop state (YES or NO) until after the changes are complete, and the display is refreshed from the database. 13 To change the associated collector plug-in for one or more event sources, select the event source(s) from the list, click the Configure link, and select the Collector Plugin option. The Set Collector Plugin window is displayed with the Collector Plugin Name and Supported Devices information. 70 Sentinel Log Manager 1. 0. 0. 4 Administration Guide novdocx (en) 19 February 2010 14 Select a new Collector plug-in name, then click Set. The selected event sources are connected to the selected Collector plug-in. NOTE: If you select a large number of event sources to change, it may take a while to complete. The event sources list will not show the new collector plug-in until after the changes are complete, and the display is refreshed from the database. 15 To change the time zone setting for one or more event sources, select the event source(s) from the list, click the Configure link, and select the Time Zone option. The Set Time Zone window is displayed. Configuring Data Collection 71 novdocx (en) 19 February 2010 16 Select a new time zone, then click Set. NOTE: If you select a large number of event sources to change, it may take a while to complete. The event sources list will not show the new time zone until after the changes are complete, and the display is refreshed from the database. Changes on this page might take some time to display completely. 4. 5 Viewing Events Per Second Statistics Section 4. 5. 1, "Viewing Graphical Representation of Events Per Second Value, " on page 72 Section 4. 5. 2, "Viewing Events Per Second Value of Event Source Servers, " on page 73 4. 5. 1 Viewing Graphical Representation of Events Per Second Value 1 Log in to the Sentinel Log Manager as an administrator. 3 In the Overview section, you can view events per second value of the incoming events in the last one minute. 72 Sentinel Log Manager 1. 0. 0. 4 Administration Guide novdocx (en) 19 February 2010 The graph shows the last 90 day statistics of all the events coming to the Sentinel Log Manager server. 4. 5. 2 Viewing Events Per Second Value of Event Source Servers 1 Log in to the Sentinel Log Manager as an administrator. [. . . ] wtmpsetup: This script enables following two important capabilities on UNIX operating systems: Enables the Syslog Connector auto-detection capability by injecting into the syslog stream a message that contains an identifier. The identifier allows the Syslog Connector to select and use the best collector for the operating system where the script is installed. For parsing the data, the identifier matches the most appropriate UniqueMatchingRule in the connection mode property of the Collector. If this script is not used, you can still configure the system to route data to the right Collector by manually reconfiguring the event source to send data by using the Web console or the Event Source Management Interface. [. . . ]