How to change what events the Data Center Security agents send to the manager.

Products

• Data Center Security Server
• Data Center Security Server Advanced

Issue/Introduction

You must either reduce the number of events the agent sends to the manager, or there are additional events you need the agent to send to the manager. 

Resolution

To change the events the DCS agent sends to the manager you must modify the Log Rules in the Prevention or Detection Config deployed to the agent.

To modify the Log Rules:

1. In the DCS: Server Console go to Configs.
2. Go to Prevention or Detection depending on the Config you must modify.
3. Navigate the Workspace Folders to the location of the Config you must modify and double-click the Config.
4. Go to the Log Rules tab.
5. Add/Modify the Log Rule to be applied to this config.
6. Click OK in the Parameters window.
7. Apply/Reapply the Config to the agent(s)

Note: Before deploying to multiple agents test the behavior with one.  With the change in the number of events the Manager must process, performance may change significantly depending on other settings in your environment.

For more information about agent log files read the SDCSSA Administration Guide.