Configuring event logging

GFI EndPointSecurity agents record events related to attempts made to access portable media devices. The agents also record events related to service operations. You can specify where these events are to be stored, in one or both of these locations:

•	The Windows Security Event Logs on the protected computer. You can view the events using the Windows Event Viewer, or collect all events to a central location using GFI EventsManager

•	A central Microsoft SQL Server database. You can view the events using the Logs Browser in the GFI EndPointSecurity management console.

You can also specify what types of events are to be logged:

•	Service events

•	Device connected events

•	Device disconnected events

•	Access allowed events

•	Access denied events.

You can specify the location and event types on a protection policy by policy basis.

To specify logging options:

1. Click on the Configuration tab.

2. Click Protection Policies.

3. From the left pane, select the protection policy for which you want to specify logging options.

4. From the right pane, click Set logging options in the Logging and Alerting section.

Screenshot 82 - Logging options - general tab

5. Click on the General tab to specify the locations where to store events for the protection policy.

Screenshot 83 - Logging options - filter tab

6. Click on the Filter tab to specify which event types are to be logged for the protection policy.

7. Click OK to finalize settings.

8. Deploy the protection policy updates on to the computers included in the policy. From the left pane, right-click on the protection policy you configured and select Deployment > Deploy agent(s).

NOTE: You can also use the keyboard shortcut CTRL + D to perform this step.