Administration Guide › User Accounts › Tasks Associated with Roles › Administrator Tasks › Log Collection Configuration and Customization

Log Collection Configuration and Customization

Only users with the role of Administrator can configure and maintain features related to log collection. Administrators perform log collection tasks from the Administration tab, Log Collection subtab.

Administrators use the Log Collection Explorer to configure connectors on agents, which is required for log collection. They also apply subscription updates to agents, when applicable.

Working with the event refinement library is optional. The out-of-the-box functionality, which is regularly updated, is designed to meet the needs of most customers.

Administrator tasks involving log collection include the following:

• Configure and manage the installed agents from a CA Enterprise Log Manager server dedicated to collection.
• Query the Archive Catalog on a CA Enterprise Log Manager reporting server.

  The archive catalog is the record of all databases that have ever been on the CA Enterprise Log Manager server. The archive catalog includes recently created databases, databases that have been backed up and moved, and databases that have been deleted before they were backed up, if any.

• Configure CA adapters used by CA Audit.
• Manage the event refinement library.
  • Work with predefined integrations and create new integrations from scratch or based on a copy of a predefined integration.

    Integration is the means by which unclassified events are processed into refined events so that they can be displayed in queries and reports.

  • Create a syslog listener from the predefined listener.
  • Create new parsing files from scratch or based on a copy of a selected predefined file.

    A message parsing file (XMP), associated with a specific event source type, applies parsing rules that break down the raw event into name/value pairs.

  • Create new mapping files from scratch or based on a copy of a selected predefined file.

    Data mapping (DM) files are XML files that use the CA Common Event Grammar (CEG) to transform events from the source format into one that can be stored for reporting and analysis in the Event Log Store.

  • Create summarization rules from scratch or based on a copy of a selected predefined rule.

    Summarization rules are rules that combine certain native events of a common type into one refined event.

  • Create suppression rules from scratch or based on a copy of a selected predefined rule.

    Suppression rules prevent certain refined events from appearing in your reports.

  • Create event forwarding rules.

    Event forwarding rules specify that selected events are forwarded to third-party products, such as those that correlate events, after being saved in the event log store.

• Create profiles.

  A profile specifies the set of data filters and tags that appear for selection. Data filters limit the data displayed in query or report; tag filters limit the tags displayed in the query tag list and in the report tag list.

More information:

How to Create an Agent Group

How to Configure Agent Management

How to Apply Subscription Updates