Log & Event Manager
Total Page:16
File Type:pdf, Size:1020Kb
Log & Event Manager Copyright © 1995-2012 SolarWinds Worldwide, LLC. All rights reserved worldwide. No part of this document may be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the written consent of SolarWinds. All right, title, and interest in and to the software and documentation are and shall remain the exclusive property of SolarWinds and its respective licensors. SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS, NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. The SolarWinds, the SolarWinds & Design, ipMonitor, LANsurveyor, Orion, and other SolarWinds marks, identified on the SolarWinds website, as updated from SolarWinds from time to time and incorporated herein, are registered with the U.S. Patent and Trademark Office and may be registered or pending registration in other countries. All other SolarWinds trademarks may be common law marks or registered or pending registration in the United States or in other countries. All other trademarks or registered trademarks contained and/or mentioned herein are used for identification purposes only and may be trademarks or registered trademarks of their respective companies. Microsoft®, Windows®, and SQL Server® are registered trademarks of Microsoft Corporation in the United States and/or other countries. LEM User Guide Chapter 1: Introduction 1 Chapter 2: Installing and Configuring 3 Requirements 3 LEM Port and Firewall Information 4 Preparing the Installation Files 5 Installing the Virtual Appliance 6 Installing the LEM Reports 7 Connecting to the Web Console 7 Installing the LEM Desktop Console Software 8 Installing the Agent 9 Configuring Non-Agent Devices 11 Configuring Manager Tools 13 Chapter 3: Useful Tasks with LEM 17 Tour Log & Event Manager 17 Ops Center 17 Monitor 18 Explore 19 Build 20 Rules – Additional Details 20 Manage 20 Analyze 21 Additional Information 22 Adding Devices 22 Which Do I Pick? 22 Agent Installation 23 Configuring Non-Agent Devices 24 Configuring Connectors for Agent and Non-Agent Devices 24 i LEM User Guide Troubleshooting 25 Additional Information 26 Verifying Data 27 Which Do I Pick? 27 nDepth: A Fully Integrated IT Search Solution 28 LEM Reports: For Compliance and Historical Reporting Needs 29 Troubleshooting 30 Additional Information – nDepth 31 External resources: 31 Additional Information – LEM Reports 31 Adding Filters 32 Which Do I Pick? 32 Use the Default Filters as Examples 33 Other Filter Scenarios 33 Example: Change Management 34 Troubleshooting 34 Additional Information 35 Adding Rules 36 Use Pre-configured Rules to Get Started 36 Example: Change Management 37 Other Rule Scenarios 39 Troubleshooting 39 Additional Information 40 Analyzing Data 41 Analyze Data 41 Which Do I Pick? 41 nDepth: A Fully Integrated IT Search Solution 42 LEM Reports: For Compliance and Historical Reporting Needs 43 Troubleshooting 44 ii Table of Contents Additional Information – nDepth 45 Additional Information – LEM Reports 45 Chapter 4: Leveraging LEM 47 Monitoring Windows Domain Controllers for Brute Force Hacking Attempts 47 Configuring the SolarWinds LEM Agent 48 Monitoring Firewalls for Port Scans and Malformed Packets 55 Monitoring Antivirus Software for Viruses that are Not Cleaned 59 Setting Antivirus Software to Log to a LEM Appliance 60 Configuring the Antivirus Tool on a LEM Manager 60 Creating a LEM Rule to Track When Viruses Are Not Cleaned 61 Monitoring Proxy Servers for Suspicious URL Access 62 Monitoring Microsoft SQL Databases for Changes to Tables and Schema 65 Leveraging the Incidents Report in Security Audits 68 Chapter 5: Introduction to the Console 70 Starting the LEM Consoles 70 Opening Views in the Console 71 Working with Grids 72 Rearranging Grid Columns 72 Sorting a Grid by its Columns 72 Logging In and Out of Managers 73 Logging Into a Manager 74 Logging Out of a Manager 74 iii LEM User Guide Exiting the LEM Console 74 Chapter 6: Ops Center 75 Ops Center Features 76 Widgets 77 Widget Manager 77 Using the Widget Builder 79 Viewing Specific Widget Data 84 Refreshing a Widget’s Data 85 Opening a Filter From a Widget 85 Editing a Widget’s Chart Presentation 87 Resizing a Widget 88 Viewing a Widget’s Legend 88 Widget Storage 89 Chapter 7: Monitor 90 Monitor View Features 90 Filters and Filter Groups 92 Standard LEM Filters 93 Filter Creation 96 Features of Filter Creation 97 Alerts 98 Applying a Filter to the Alert Grid 98 Sorting the Alert Grid 99 Highlighting Alerts 99 Copying Alert Data to the Clipboard 101 Marking Alerts as Read and Unread 102 Removing Alerts 103 iv Table of Contents Using the Alert Details/Alert Description Pane 103 Alert Severity Levels 105 Chapter 8: Explore 107 nDepth 107 nDepth's visual tools 108 nDepth's Primary Uses 108 Exploring Alerts vs. Log Messages 109 Opening nDepth 109 Opening nDepth From Another Data Source 110 nDepth key features 110 nDepth's Search Bar 112 nDepth Explorer Toolbar 114 nDepth's History Pane 116 Using the nDepth Histogram 117 Histogram Features 117 Searching the Activity Associated with a Particular Histogram Bar 119 Moving the Search Period 119 Changing the Period's Start and End Time 120 Using Result Details 121 Interpreting Search Results in Alerts Mode 122 Interpreting Search Results in Log Messages Mode 122 Adding Search Strings from Result Details 124 Using Explorers with Result Details 125 Responding to Result Details 126 Exporting Result Details Data to a Spreadsheet 127 Common nDepth Data Fields 127 Common Data Fields Categories in Alerts Mode 127 Common Data Field Categories in Log Messages Mode 128 v LEM User Guide Using the Word Cloud 129 Opening the Word Cloud 130 Viewing Statistics in the Word Cloud 130 Filtering the contents of the Word Cloud 130 Exploring Items in the Word Cloud 131 Using the Tree Map 132 Opening the Tree Map 133 Resizing Tree Map Categories 133 Exploring items in the Tree Map 133 Using nDepth widgets 134 Default nDepth chart widgets 134 nDepth explorer and widget icons 135 Viewing a widget's details 136 Creating a search string from a widget item 136 Adding new nDepth Widgets 137 Editing nDepth idgets 138 Adding a chart widget to the nDepth Dashboard 138 Adding a main nDepth view to the nDepth Dashboard 139 Using Search Builder 139 Opening Search Builder 141 Switching from the search bar to Search Builder 141 Search Builder features 142 Configuring a Search with Search Builder 145 Utilities 147 Explorer Types 147 NSLookup Explorer 149 Traceroute Explorer 150 Whois Explorer 151 Manually Exploring an Item 151 vi Table of Contents Chapter 9: Build 153 Groups 153 Group types 153 Groups View Features 155 Refining the Groups Grid 156 Rules 157 Rules View Features 157 Rules Grid Columns 157 Refine Results Form 159 Users 160 Users View Features 160 Users Grid Columns 161 Refining the Users Grid 161 Viewing a User’s System Privileges 162 Chapter 10: Manage 164 Appliances View Features 164 Appliances Grid Columns 165 Details Pane 167 Configuring Alert Distribution Policy 168 Practical Uses for Alert Distribution Policy 168 Opening the Alert Distribution Policy Window 169 About the Alert Distribution Policy Window 170 Configuring Alert Distribution Policy 172 Pushing alert policy to lower-level alert types 173 Exporting a Manager’s Alert Policy 174 Nodes 175 Nodes View Features 175 Nodes Grid Columns 177 vii LEM User Guide Refining the Agents Grid 179 Chapter 11: Access Controls 181 Adding New Users 181 Editing User Settings 186 Deleting Users 187 Restrict and Unrestrict LEM Reports 187 Chapter 12: Utilizing the Console 189 Filters 189 Creating Filters for Real-time Monitoring 189 Features of the List Pane 191 Features of the Conditions Box 195 199 Creating a New Filter 199 Editing an existing filter 200 Cloning an Existing Filter 200 Pausing Filters 202 Resuming Paused Filters 203 Turning Filters On and Off 204 Copying a Filter 204 Importing a Filter 205 Exporting a Filter 206 Deleting a Filter 206 Managing Filter Groups 207 Adding a New Filter Group 207 Renaming a Filter Group 208 Rearranging Filter Groups 208 Moving a Filter From One Group to Another 208 viii Table of Contents Deleting a Filter Group 209 Responding to Alerts 210 Using the Respond Form’s Drag and Drop Functionality 211 Event Explorer 213 Opening the Event Explorer 213 Event Explorer Features 214 Exploring Alerts 215 Using the Event Map 216 Reading an Event Map 216 Event Map Legend 217 Using the Event Grid 218 Viewing information in the event grid 218 Exploring From the Event Grid 219 Using the Alert Details Pane 219 Opening and Closing the Alert Details Pane 220 Viewing an Event’s Alert Details 220 Exploring From the Alert Details Pane 221 Performing nDepth Searches 222 Creating Search Conditions 224 Deleting Items From Search Strings 225 Creating Custom Timeframes 226 Saving a Search 227 Using a Saved Search 228 Making Changes to a Saved Search 228 Exporting nDepth Search Results to PDF 229 Exploring Search Results from Graphical Views 230 Taking Action on Alert Details 231 Deleting a Saved Search 231 Creating Search Conditions 232 ix LEM User Guide Deleting