I have recently install CSA MC 188.8.131.52 and the agent on a Win2003 server. I have a question of events showing up in the agent panel and not showing up in the MC events log.
I see a number of events in the agent 'panel' event viewer. At the end of the event is a number in brackets like .
When I look at the MC event viewer but those events are not being reported.
My query is:
#1 I believe the example [176} is the rule being triggered. So if the event is not showing up in the event viewer how to I find that rule in the policies? I finally did stumble across the rule and I see that logging is disabled for that rule, but finding that rule was a needle in the haystack search. Is there an easier way to find rules?
#2 Maybe I do not understand this part but in the MC I placed this server (the one with the MC) into 'Audit Mode' in hopes that would get the events from the agent to show up in the MC event log. No good. Is there a way to get all events - even if the rule says to not log the event - so show up in the MC log so I can creat an exception?