1.3	Key Features

Extended event log support

GFI EventsManager is able to process various event log types including Windows Event Logs, W3C logs, Syslog and SNMP Trap messages. This allows you to collect more data from the different hardware and software systems that are most commonly available on a typical corporate network. For a summary list of hardware and software systems that are supported by GFI EventsManager out of-the-box refer to: http://kbase.gfi.com/showarticle.asp?id=KBID003302.

Rule-based event log management

GFI EventsManager ships with a pre-configured set of event processing rules that allow you to filter and classify events collected from a variety of event-log sources. You can run these default rules without performing any configuration or you can choose to customize these rules or create tailored ones that suite your network infrastructure. For a list of event-log sources that can be processed by GFI EventsManager out-of-the-box refer to: http://kbase.gfi.com/showarticle.asp?id=KBID002868.

Event log scanning profiles

GFI EventsManager 8 allows you to organize event log scanning rules into ‘Scanning Profiles’. In a scanning profile, you can configure the set of event log monitoring rules that will be applied to a specific computer or group of computers. The benefits of these profiles include:

•	The simplification product administration tasks by providing a centralized way of tuning event processing rules.

•	Allowing administrators to create different sets of event log rules that suit the roles of scanned event sources and the corporate network environment. For example, you can setup a set of rules which apply only to workstations in a particular department.

Allow granular configuration of rules

Administrators can create an event processing profile that is generic for all computers and a number of separate profiles which complement the generic profile by providing additional and more specialized event log rules on a computer by computer basis.

Translates cryptic Windows events

One major drawback of Windows Event Logs is that they are not user friendly - too cryptic for the user to understand. In fact this is one of the main reasons why only few administrators really peer into Windows Event Logs. GFI EventsManager overcomes this problem by translating event descriptions into a way that is more users friendly and easier to understand.

Enhanced event scanning engine

GFI EventsManager includes an event scanning engine that has been tuned to effectively speed up event scanning for maximum performance. This engine adopts a plug-in based concept that allows the ‘plugging-in’ of additional features/modules without having to perform physical changes to the existing code – hence more stability without effecting scalability.

Automatic noise reduction

GFI EventsManager identifies and removes unwanted event data (such as noise and background process generated events) providing you with only the relevant, usable data. Hence facilitates event forensics by reducing the amount of events to be analyzed.

Enhanced real-time actions

GFI EventsManager can generate alerts or trigger actions such as script execution when key events are detected. You can alert one or more people in various ways including: email, network messages, and SMS notifications sent through an email-to-SMS gateway or service. Actions can be configured to trigger on event classification or by configuring specific conditions in event processing rules.

Advanced event filtering features

GFI EventsManager ships with a number of event filtering features including:

•

Pre-configured event queries and a custom event query builder: The pre-configured event queries allow you to sift event log data and browse only the required events - without deleting any records from your database backend. The built-in event query builder allows you to create your own custom event queries.

•	Event color-coding capabilities: Through this feature you can selectively color particular events in specific colors. This way during log browsing you can easily identify important events through their color.

•	Event finder tool: With this tool you can quickly locate important events by providing specific search criteria such as event type.

Event centralization

GFI EventsManager enables you to monitor and manage events generated by Windows\Linux\Unix systems, network devices and software applications through a single user console.

User access privileges

GFI EventsManager allows you to assign management console access privileges on a user-by-user basis. This means that you can allow specific users to access the GFI EventsManager console for event-browsing only and at the same time allow other more privileged users to access and change the GFI EventsManager configuration settings.

SQL Server audit

GFI EventsManager allows you to automatically monitor the operational health status of your SQL Servers. This is achieved by processing in real-time the activity logs/messages generated by day-to-day SQL Server operations. SQL server activity that is monitored includes server startup, login activity, backups, server-side traces and more. Additionally, GFI EventsManager can also alert you via email, network or SMS notifications on key events like server shutdown and consecutive failed logins.

Database operations (WAN Connector)

The Database Operations module allows you to collect events data from GFI EventsManager installations on multiple sites and locations across your network into a central database. This add-on integrates and centralizes events collected and processed and allows you to backup/restore events on demand. Through Database Operations you can manage the size of the database – without the need for manual intervention – not only through centralization but by also being able to export events and back them up as needed.

Management Information Base

Management Information Base (MIBs) contain definitions and device information that are provided by device manufacturers. GFI EventsManager ships with MIB definitions for the following vendors: Cisco, 3Com, IBM, HP, Check Point, Alcatel, Dell, Netgear, SonicWall, Juniper Networks, Arbor Networks, Oracle, Symantec, Allied Telesis and others. GFI EventsManager also allows you to edit the MIB tree.