Monitor, Search, and Analysis

Monitoring, searching, and analyzing are done through a number of features in the Client Console. These include:

In addition, the following tools assist with further using these monitoring, searching, and analyzing features.

Tool Selector

Monitoring and searching the system for logs is done with the Tool Selector. It provides a user-friendly method to manage the many views of Personal Dashboard and Investigator. In the system layout, it is docked at the left of the window. The Tool Selector is specific to the Tool in which it resides.

To unpin the Tool Selector, click the pin icon in the upper-right corner of the Tool Selector so that the point faces left. This collapses the Tool Selector so that it is a tab along the left that you can then open to see the groups and views.
To pin the Tool Selector, click the pin icon in the upper-right corner of the Tool Selector so that it appears to be pointing down into the screen. This keeps the Tool Selector visible while working within the tool.

The Tool Selector has four groups of views. Each group is encapsulated in a box that can be collapsed or expanded by clicking the arrow at the right of the header. Views that are open and displayed within the window are listed in bold within the group. Views that are not open and displayed within the window will be listed in regular text (not bold).

To bring a view into the window, select it within the group box. It changes to bold and is brought forth as the active displayed view within the window.
To remove a view from the window, select it within the group box. It changes from bold to regular text and is removed from the tabs of available views within the window.

Context Menus

LogRhythm provides several tools to search and retrieve log data. After your search results appear, right-click to access additional options in the following locations:

Investigate. Log / Event Analyzer and Log Viewer tabs
Log Miner. Aggregate Log Messages section
Tail. Aggregate Log/Event List section, Log/Event List section
Personal Dashboard. Aggregate Event List section

These are the options in the context menus of LogRhythm search tools. Not all options are found in every menu.

Context Menu Option	Description
Select All	Select all search results.
Check All	Select the Action check box for all search results.
Check All Displayed	Select the Action check box for all displayed search results.
Uncheck All -> Check All Displayed	Clear the Action check box for all rows, then select the Action check box for just the rows that are displayed.
Uncheck All	Clear the Action check box for all search results.
Uncheck All Displayed	Clear the Action check box for all displayed results.
Action	Remove Selected Logs Remove All But Selected Logs Filter In Selected Logs Filter Out Selected Logs Investigate Sample of Selected Logs Investigate Selected Logs
Report	Open the Report Wizard where you can run reports with the selected search results as input.
Export the Grid to a File	Export grid to a csv file.
Chart Events	Toggle the graph between Logs and Events.
Copy Selected Logs to Rule Builder	Access the MPE Rule Builder with populate the Test Center tab.
Copy Selected Logs to Rule Builder and Load Rule	Access the MPE Rule Builder and load with data in the Test Center tab
Export All Logs	Export all logs via the LogRhythm Log Exporter.
Export Selected Logs	Export all logs via the LogRhythm Log Exporter.
Send All Logs	Display the Log Submission Tool that will guide you through sending all logs in the search results to LogRhythm support.
Send Selected Logs	Display the Log Submission Tool that will guide you through sending the selected logs in the search results to LogRhythm support.
Edit Event Settings	Display the Edit Policy Event Settings window.
Create an Alarm Rule	Create an alarm rule using information in the log message.
Create a GLPR	Create Global Log Processing Rule (GLPR) rule using information in the log message.
Contextualize	Access information about hosts, ports, or users associated with a log or event.
Correlate	Narrow the displayed search results even further based on the selected log or event.
AI Engine Search and Drill Down	Drill down on selected logs with the AI Engine Event Drill Down Manager.
Add Values to a List	Add selected values to a list.
Copy Values to Clipboard	Add selected values to the clipboard.
Add Origin Host as Known Host	Add the origin host of the selected log to an entity.
Add Impacted Host as Known Host	Add the impacted host of the selected log to an entity.
Grid Properties	Select which aggregate log fields to include in the grid.