Installing CA Enterprise Log Manager - CA Technologies

log recordlog sensormanagement servermapping analysismeshed federationmessage parsingA log record is an individual audit record.A log sensor is an integration component designed to read from a specific logtype such as a database, syslog, file, or SNMP. Log sensors are reused. Typically,users do not create custom log sensors.The management server is a role assigned to the first CA Enterprise Log Managerserver installed. This CA Enterprise Log Manager server contains the repositorythat stores shared content, such as policies, for all its CA Enterprise LogManagers. This server is typically the default subscription proxy. While notrecommended for most production environments, the management server canperform all roles.A mapping analysis is a step in the Mapping File wizard that lets you test andmake changes to a data mapping (DM) file. Sample events are tested against theDM file and results are validated with the CEG.A meshed federation of CA Enterprise Log Manager servers is a topology thatestablishes a peer relationship between servers. In its simplest form, server 2 isa child of server 1 and server 1 is a child of server 2. A meshed pair of servershas a two-way relationship. A meshed federation can be defined such that manyservers are all peers of one another. A federated query returns results from theselected server and all its peers.Message parsing is the process of applying rules to the analysis of a raw event logto get relevant information such as timestamp, IP address, and user name.Parsing rules use character matching to locate specific event text and link it withselected values.message parsing file (XMP)A message parsing file (XMP) is an XML file associated with a specific eventsource type that applies parsing rules. Parsing rules break out relevant data in acollected raw event into name/value pairs, which are passed to the data mappingfile for further processing. This file type is used in all integrations, and inconnectors, which are based on integrations. In the case of CA Adapters, XMPfiles can also be applied at the CA Enterprise Log Manager server.message parsing libraryThe message parsing library is a library that accepts events from the listenerqueues and uses regular expressions to tokenize strings into name/value pairs.Glossary 263