User guide

45
include
Optional sub key. Files at “location”
will only be monitored if they match
this pattern. Wildcards are allowed.
Optional sub key. Files at “location” will
only be monitored if they match this
pattern. Wildcards are allowed.
exclude
Optional sub key. Files at “location”
will NOT be monitored if they match
this pattern. Wildcards are allowed.
Optional sub key. Files at “location” will
NOT be monitored if they match this
pattern. Wildcards are allowed.
interval-
monitor-seconds
The number of seconds between scanning files
watched with “monitor-file”.
A non-zero integer.
monitor-
subdirectories
Whether or not to follow subdirectories given in
“monitor-file” and “monitor-file” “location” values.
Setting this to “1” when watching large directories
with no include/exclude filters (like C:\\Windows) may
impact performance.
0 or 1
(0=off,1=on)
send-new-
events-only
Whether to only send new events encountered.
Setting this to “0” results in sending all data in all logs
every time they are scanned, and thus it is NOT
recommended unless specifically directed by
Tenable Network Security.
0 or 1
(0=off,1=on)
heartbeat-
frequency
The number of seconds between each client
heartbeat message to the LCE server. If “0”, it will not
send heartbeats.
A positive integer.
statistics-
frequency
The number of minutes between each client host
performance statistics report (CPU, Disk Space, and
Physical Memory) sent to the LCE server. If “0”, it will
not send stats.
A positive integer.
compress-events
Whether or not to compress events before
transmitting them to the LCE server. Marginally
saves bandwidth, marginally increases CPU usage.
0 or 1
(0=off,1=on)
info
Enable or disable info-level logging in lce_client.log
(the LCE client debugging log).
0 or 1
(0=off,1=on)
verbose
Enable or disable verbose logging in lce_client.log
(the LCE client debugging log).
0 or 1
(0=off,1=on)
debug
Enable or disable debugging messages in
lce_client.log (the LCE client debugging log). This is
NOT recommended to be set to 1 unless specifically
directed by Tenable Network Security.
0 or 1
(0=off,1=on)
host
Host contains sub keys describing a remote machine on which this LCE Client will perform
monitoring via the WMI interface.
Sub Key
Description
Valid Values
ip
The IP address of the remote machine to
monitor
A valid IPv4 address.
namespace
The namespace of the WMI classes being
monitored (almost always root\cimv2)
A valid WMI namespace.