How does GFI EventsManager work?

Figure 2 - The GFI EventsManager operational stages

The operational functionality of GFI EventsManager is divided into 2 stages:

•	Stage 1: Event Collection

•	Stage 2: Event Processing

A description of every stage is provided below.

Stage 1: Event Collection

During the Event Collection stage, GFI EventsManager collects logs from specific event sources. This is achieved through the use of 2 event collection engines: The Event Retrieval Engine and the Event Receiving Engine.

The Event Retrieval Engine - The Event Retrieval Engine is used to collect Windows Event Logs and W3C logs from networked event sources. During the Event Collection process this engine will:

1.	Log-on to the event source(s)

2.	Collect events from the source(s)

3.	Send collected events to the GFI EventsManager Server

4.	Log-off from the event source(s).

The Event Retrieval Engine collects events at specific time intervals. The event collection interval is configurable from the GFI EventsManager management console.

The Event Receiving Engine - The Event Receiving Engine acts as a Syslog and an SNMP Traps server; it listens and collects Syslog and SNMP Trap events/messages sent by various sources on the network. As opposed to the Event Retrieval Engine, the Event Receiving Engine receives messages directly from the event source; therefore it does not require to remotely log-on to the event sources for event collection. Further to this, Syslog and SNMP Trap events/messages are collected in real-time and therefore no collection time intervals need to be configured.

By default, the Event Receiving Engine listens to Syslog messages on port 514 and to SNMP Trap messages on port 162. Both port settings are however customizable via the GFI EventsManager management console.

Stage 2: Event Processing

During this stage, GFI EventsManager will run a set of Event Processing Rules against collected events. Event Processing rules are instructions that:

•	Analyze the collected logs and classify processed events as Critical, High, Medium, Low or Noise (unwanted or repeated events)

•	Filter events that match specific conditions

•	Trigger email, SMS and network alerts on key events

•	Trigger remediation actions such as the execution of executable files or scripts on key events

•	Optionally archive collected events in the database backend.

GFI EventsManager can be configured to archive events without running Event Processing rules. In such cases, even though no rules will be applied against collected logs, archiving will still be handled by the Event Processing stage.