Need to change what events the Data Center Security agent sends to the manager

Products

• Data Center Security Server
• Data Center Security Server Advanced

Issue/Introduction

Need to reduce the number of events the agent sends to the manager, or send additional needed events to the DCS manager 

Resolution

To change the events the DCS agent sends to the manager you must modify the Log Rules in the Prevention or Detection Config deployed to the agent.

To modify the Log Rules:

1. In the DCS: Server Console go to Configs
2. Go to Prevention or Detection depending on the Config you must modify
3. Navigate the Workspace Folders to the location of the Config you must modify and double-click the Config
4. Go to the Log Rules tab
5. Add/Modify the Log Rule to be applied to this config
6. Click OK in the Parameters window
7. Apply/Reapply the Config to the agent(s)

Note: Before deploying to multiple agents, test the behavior with one single agent.  With the change in the number of events the Manager must process, performance may change significantly depending on other settings in your environment.

For more information about agent log files refer to th ethe SDCS:SA Administration Guide