Introduction

About this manual

How is this manual structured

This manual is structured in line with the logical chain of configuration operations required to get GFI EventsManager up and running.

Chapter 1 gives an overview of how GFI EventsManager works.

Chapter 2 explains how to run GFI EventsManager for the first time, including how to configure the database backend and how to process event logs for the first time.

Chapter 3 describes how to use the built-in events browser to analyze events stored in the GFI EventsManager database backend. This chapter explains how to use the tools and features provided in the events browser including:

•	Default event log queries and custom query builder

•	Event color-coding

•	Event finder tool.

Chapter 4 describes how to enable the GFI EventsManager ReportPack to create reports that further analyze the events stored in the GFI EventsManager database backend.

Chapters 5, 6, 7 and 8 guide you through the process of customizing essential parameters required for event processing. At the end of these chapters, you will be able to customize:

•	Event sources that will be monitored (e.g. SQL Server)

•	Log-types that will be collected and processed (Windows events, W3C, Syslog, SNMP Traps

•	Configuring and customizing event processing rules

•	Alerts and actions that will be triggered on key events

Chapter 9 describes how to configure alert recipient parameters including:

•	Personal details such as mobile phone number

•	Normal working hours

•	Type of alerts that will be sent to every recipient.

Chapter 10 describes how to analyze the status of GFI EventsManager as well as view statistical information and processed events.

 

Chapter 11 explains how to centralize events collected by other remote GFI EventsManager instances and how to optimize database backend performance.

Chapter 12 describes miscellaneous options such as command line operations and licensing.

Chapter 13 explains what main sources of information are available to help users troubleshoot product issues.

Glossary of terms used in this manual

Actions	The activity that will be carried out as a result to events matching specific conditions. For example you can trigger actions whenever an event is classified as critical. Actions supported by GFI EventsManager include Email alerts, event archiving and execution of scripts.
Alerts	Notifications which inform recipients that a particular event has occurred. GFI EventsManager can generate Email alerts, SMS alerts and Network alerts.
Archive	A collection on events stored in the SQL Server based database backed of GFI EventsManager.
Email alerts	Email notifications which inform recipients that a particular event has occurred. To enable email alerts, you must have access to an active mail server.
Event classification	The categorization of events as Critical, High Medium, Low or Noise.
Event logs	A collection of entries which describe events that occurred on the network or on a computer system. GFI EventsManager supports different types of event logs including: Windows Event Log, W3C Logs, Syslog, SNMP Traps and SQL Server audit events.
Event processing rules	A set of instructions which are applied against an event log.
Management Information Base	A MIB is the equivalent of a data dictionary or codebook. It associates object identifiers (OIDs) with a readable label and various other parameters related to an active network object such as a router. Its main function is to assemble and interpret SNMP messages transmitted from SNMP-enabled network devices. The information stored in MIBs is organized hierarchically and is normally accessible using a protocol such as SNMP.
Network alerts	Network messages (known as Netsend messages) which inform recipients that a particular event has occurred. These messages are sent through an instant messenger system/protocol and are shown as a popup in the system tray of the recipient’s desktop. To setup network alerts, you must specify the name or IP of the computers where the Netsend messages will be sent.
Noise	Repeated log entries which report the same event.
Rule-set folder	The folder which contains one or more rule-sets.
Rule-sets	A collection of event processing rules.
SMS alerts	SMS notifications which inform recipients that a particular event has occurred. In GFI EventsManager, SMS alerts can be sent through various sources including mobile phones with modem capabilities and email-to-SMS web-based gateways.
SNMP Object Identifier (OID)	An SNMP object identifier is an address made up of a sequence of ‘dotted’ numbers (e.g. 1.3.6.1.4.1.2682.1). These numbers uniquely identify and locate a specific device (e.g. hub) within the entire network. SNMP OIDs are a key component in the assembly of SNMP messages. In fact, an SNMP server cannot interpret or assemble messages which don’t have an OID. Individual vendors often create their own MIBs that only include the OIDs associated specifically with their device.
SNMP Traps	Notifications/alerts generated and transmitted by active network components (e.g. hubs, routers and bridges) to SNMP server(s) whenever important events such as faults or security violations occur. Data contained in SNMP Traps may contain configuration, status as well as statistical information such as number of device failures to date.
Syslog messages	Notifications/alerts most commonly generated and transmitted to a Syslog server by UNIX and Linux-based systems whenever important events occur. Syslog messages can be generated by workstations, servers as well as active network devices and appliances such as Cisco routers and Cisco PIX firewalls to record failures and security violations amongst other activities.
Unclassified events	Events that did not satisfy any of the event processing conditions configured in the event processing rules.
W3C logs	W3C is a common log format developed by the World Wide Web Consortium. W3C logs are text-based flat files used mainly by web servers including Microsoft Internet Information Server (IIS) to record web related events such as web logs.
Windows Event Logs	A collection of entries which describe events that occurred on a computer system running Windows OS.