Using the Logs Browser

Screenshot 37 - GFI EndPointSecurity Logs browser

GFI EndPointSecurity allows you to keep an audit trail of all events generated by GFI EndPointSecurity agents deployed on network computers. Events can be stored in a Windows Event Log and/or a Microsoft SQL Server database backend.

NOTE: To maintain an audit trail, you must enable logging. For information on how to do this, refer to the ‘Configuring event logging and notifications’ section in the ‘Customizing the default protection policy’ chapter.

Use the ‘Logs Browser’ view to access and browse events currently stored in the database backend. Event data is organized into columns and clicking on a particular event will show additional information in a dedicated events description pane.

GFI EndPointSecurity also includes a query builder to simplify searching for specific events. Using the event query builder you can create custom filters that sift events data and display only the information that you need to browse – without deleting one single record from your database backend.

To access the ‘Logs Browser’ view:

1. Click on the Tools tab

2. Click Logs Browser

3. In the left pane, select Agent logs – database to list all events currently stored in the database backend.

Creating event queries

To create custom event queries

1. Click on the Tools tab

2. Click Logs Browser

3. In the left pane, select Agent logs – database

4. Right-click and select Create query… This will bring up the event query builder

Screenshot 38 - Create new query

5. Specify a name and a description for the new query

6. Click Add, configure the required query condition(s) and click OK Repeat until all required query conditions have been specified

7. Click OK to finalize your settings. The custom query is added as a sub-node within Agent logs – database.