Sentinel Log Manager is installed with a rule that forwards events to another sentinel system. The rule is called Forward Events To Another Sentinel System. By default, the Forward Events To Another Sentinel System rule is configured to filter out internal system events and events with a severity that is less than four. This rule filters out the following three types of system events:
Audit (A)
Performance (P)
Internal (I)
You can also change the conditions of the rule to filter more events or remove conditions to filter fewer events.
Novell recommends that you configure the rule to forward only those events that you want to store on the Sentinel system for more in-depth reporting and analysis.
The Forward Events To Another Sentinel System rule is installed with Log Manager, but it is in the inactive (off) state. To forward the system events to another Sentinel system, the rule must be activated, and the Sentinel Link Integrator settings must be configured.
Log in to the Sentinel Log Manager as an administrator.
Click in the upper left corner of the page.
The tab is displayed on the right pane of the page.
The Forward Events To Another Sentinel System rule is displayed under the tab.
To activate the Forward Events To Another Sentinel System rule, click the check box next to the rule.
If the rule is activated, a Successfully activated the rule message is displayed.
In addition to activating the Forward Events To Another Sentinel System rule, you must also configure the Sentinel Link Integrator settings.
Configuring the Send to Sentinel Link settings is same as configuring the Sentinel Link Integrator settings. The Send to Sentinel Link settings configures the Sentinel Link Integrator instance that is pre-installed on Sentinel Log Manager.
To configure the Send to Sentinel Link settings, refer to Sending the Events to a Sentinel Link.