2 Installation 2.1 Introduction Where can I install GFI EventsManager on my network? GFI EventsManager can be installed on any computer which meets the minimum system requirements irrespective of the location on your network. Use GFI EventsManager to manage the events generated: • On the same computer where it is installed • On all the computers that are reachable from the computer on which it is installed. Figure 3 - GFI EventsManager deployment scenario GFI EventsManager can be deployed: 1. Within your network to monitor the activity of internal servers and workstations/end points. 2. On the DMZ to monitor and manage the events generated on your servers. 2.1.1 Deployment of GFI EventsManager on a local area network GFI EventsManager can be deployed on Windows based networks as well as on mixed environments where Linux and UNIX systems are being used as well. Figure 4 - Deployment of GFI EventsManager on LAN When installed on a Local Area Network (LAN) GFI EventsManager can manage Windows events, W3C event logs, Syslog messages, SNMP Trap and SQL Server audit messages generated by any hardware or software that is connected to the LAN, including: • Workstations and Servers (e.g. Apache web-servers) • Network appliances (e.g. Cisco PIX firewalls) • Third party software (e.g. GFI EndPointSecurity) • Specialized Services (e.g. Microsoft Internet Information Server - IIS) • PABXs, Keyless Access Systems, Intrusion detections systems, etc. When installed on a LAN, GFI EventsManager can also be used to collect events from hardware and software systems deployed on a Demilitarized Zone (DMZ). Since a firewall or a router usually protects this zone with network traffic filtering capabilities, you must make sure that: 1. The communication ports used by GFI EventsManager are not blocked by the firewall. For more information on the communication ports used by GFI EventsManager refer: http://kbase.gfi.com/showarticle.asp?id=KBID002770. 2. That GFI EventsManager has administrative privileges over the computers that are running on the DMZ. 2.1.2 Deployment of GFI EventsManager on a demilitarized zone Figure 5 - The DMZ sits between the internal LAN and the Internet GFI EventsManager can also be deployed on a Demilitarized Zone (DMZ). This is the neutral network which sits between the “internal” corporate network and the “outside world” (i.e. the internet). The deployment of GFI EventsManager on a DMZ helps you automate the management of events generated by DMZ hardware and software systems. Automate management of Web and Mail server events DMZ networks are normally used for the running of hardware and software systems that have internet specific roles such as HTTP servers, FTP servers, and Mail servers. Hence, you can deploy GFI EventsManager to automatically manage the events generated by: • Linux/Unix based web-servers including the W3C web-logs generated by Apache web-servers on LAMP web platforms. • Windows based web-servers including the W3C web-logs generated by Microsoft Internet Information Servers (IIS). • Linux/Unix and Windows based mail-servers including the Syslog ‘auditing services’ messages generated by Sun Solaris v. 9 or later. Automate management of DNS server events If you have a public DNS server, there’s a good chance that you are running a DNS server on the DMZ. Hence you can use GFI EventsManager to automatically collect and process DNS server events including those stored in your Windows’ DNS Server logs. Automate management of network appliance events Routers and firewalls are two network appliances commonly found in a DMZ. Specialized routers and firewalls (e.g. Cisco IOS series routers) not only help protect your internal network, but provide specialized features such as Port Address Translation (PAT) that can augment the operational performance of your systems. By deploying GFI EventsManager on your DMZ, you can collect the events generated by such network appliances. For example, you can configure GFI EventsManager to act as a Syslog Server and collect in real-time the Syslog messages generated by Cisco IOS routers.
