User guide

20
LCE Client
Configuration File
Red Hat / CentOS
LCE Client (Log Agent)
/opt/lce_client/lce_client.conf
LCE WMI Monitor Agent
/opt/wmi_monitor/wmi_monitor.conf
Tenable NetFlow Monitor
/opt/netflow_monitor/tfm.conf
Tenable Network Monitor
/opt/network_monitor/tnm.conf
Mac OS X
LCE Client (Log Agent)
/opt/lce_client/lce_client.conf
If changes must be made to an existing configuration file and the client is already running, make the changes, halt the
client, and then restart it. See “Halting the LCE Linux and Unix-Based Client”.
Once a 4.x client connects to a 4.x server, the .conf files are no longer used, and the policy files (provided by the LCE
server) will be used. Policy files are sent from the LCE server to the LCE client each time they are changed server-side.
Policies are covered in the “LCE Client Manager” section of this document.
LCE Client
LCE’s Linux and Unix-based clients can be used to monitor log files that contain events received from other devices. For
example, if a Linux server is configured to receive syslog events from a nearby router, the LCE Client and LCE server
will parse all events as if they originally came from the Linux server. If IP address information is in the syslog message,
then the LCE server assigns the source and destination events accordingly.
All that needs to be done for configuration here is to specify the LCE server’s IP address, and if needed, change the
server port. A default lce_client.conf configuration file is shown below:
# If using an LCE 4.x server, configure this file with the appropriate
# server information. After the first run, the client will be
# configured strictly from the Client Manager.
# If using an LCE 3.x server, replace this file with the
# lce_client.conf.v3_server file, which contains full
# configuration information.
options {
# LCE client log messages are written to a file named
# according to the date in the directory specified below.
log-directory /opt/lce_client/
# The following block defines the IP address at which the
# LCE server is located.
# Replace the below address with the IP address of the LCE server.
lce-server 203.0.113.250 {
}