Collect Event Logs | Trend Micro Service Central

Views:

Logs contain information about agent activity. Collect Event Logs updates the StellarOne database with the latest information from the selected agents.

Note:

Only StellarProtect (Legacy Mode) supports this function.

Go to Agents > All.
Click the All group on the Agents screen. The Agents screen displays a list of agents managed by StellarOne.
Select the target agents by clicking the checkboxes next to them.
Click the Update button from the Tool Bar at the top of the Agents screen.
A pop-up window appears. Click the Collect Event Logs option.
Click Confirm.
A pop-up Command Deployment window with the endpoint list appears. The Status column shows if the event logs are succesfully collected.
Click Close to close the window.
Note:
StellarOne will update the date and time displayed in the Last Connection column on the Agents screen after each StellarProtect (Legacy Mode) agent successfully sends logs and status to StellarOne.
Go to Logs > Agent Events for viewing the collected event logs of the selected agents. Refer to Agent Events for more detailed instructions if needed.
Note:
By default, the selected agents will only send back the Warning and Critical level logs.
(Optional) Choose one of the ways to add the Information level logs in the collected event logs.
Note:
The log volume may surge if the Information level logs are included in the collected event logs.
- On the StellarOne console, export the agent's configuration file and change the value of InformationLog Enable to yes. Import the modified configuration file to the selected agent. Refer to Export Agent Configurations and Import Agent Configurations for more detailed instructions.
  Figure 1. Snippet of the Configuration File
- On the target StellarProtect (Legacy Mode) agent, open the Setup.ini file in the installer package and change the value of Level_InformationLog to 1. Be sure to save the changed file and run the installation again.
  Figure 2. Snippet of the Setup.ini File
Note:
Only after you change the event log setting for the target agents and apply the Collect Event Logs action to them, will the Information level logs be sent to StellarOne.