Method A: If you know the postgres user password you can use the pgAdmin utility: 1. Open pgAdmin by opening the Windows Start Menu to EventSentry pgAdmin4. If you have set a password for the PgAdmin application in the past it may prompt you for that password. 2. Double click on EventSentry Database under the Servers category ...
If you go into the Windows event viewer on your EventSentry server select the Application log and look for event 117 118 119 122 or 123 from EventSentry Collector as the source. If these events exist here are the steps you can take to resolve these error events and allow the agents to connect: Event 117 This error is generated beca...
Please follow the steps below prior to upgrading any EventSentry installation: 1. Save a copy of your current settings. Home Export 3.0 and up or File Export 2.93 and older 2. Back up your database see database vendor documentation or KB235 for the builtin database 3. See below to determine if your upgrade path is supported a...
This guide shows how to restore an EventSentry .backup file created with pgdump see KB235https://www.eventsentry.com/kb/235howdoibackupthebuiltineventsentrydatabase onto a separate dedicated PostgreSQL server for example to access archived/historical data without risking disk space or performance issues on your producti...
Moving EventSentry and the Web Reports: 1 Export your current EventSentry settings from the Management Console toolbar by clicking Home Export. Then transfer this file to your new server. Edit the file in a text editor such as Notepad and do CTRLH find and replace and enter this as the Find value: name of your old ...
To move an existing MSSQL database to a different server simply detach the database from the existing server copy it to the new system and reattach it. After the DB is online simply initialize the database again and update all connection strings: 1. Stop all EventSentry services. If you are not using the collector then all remote agents sho...
The EventSentry dashboard includes the generic Search tile which can be used to display data from any page in the web reports e.g. syslog data. The Search tile also offers the ability to extract select data strings from events and display them in custom columns. This method can be applied to any type of event logged to the event log. This ...
The Archive feature in EventSentry enables continuous parallel synchronization between a primary and secondary database. Once activated both databases remain active: one handles live data while the other serves as a realtime archive. Archiving is not retroactive the archive database will only store data collected from the moment the featur...
First we recommend you make a backup of the database in case you have any issues and need to reinstall: How do I back up the built in EventSentry database Once you39ve got a backup then you can proceed with moving the database by following these steps: Stop the EventSentry Database v14 Service Control Panel Administrative Tools ...
EventSentry can detect malicious activity in a variety of ways including: Failed Logons RDP ... Log File Activity Outgoing process activity Port Scans NetFlow Windows Syslog Once a malicious IP is detected it can be helpful to report the IP address to an online reputation system for IP addresses like abuseipdb.com. Automatic...
Yes EventSentry Web Reports supports LDAP authentication allowing users to sign in with their Active Directory credentials. Overview: By default Web Reports uses builtin authentication where passwords are stored and managed within the application. For environments with a Windows Active Directory infrastructure enabling LDAP supp...
Note: These instructions are only for EventSentry 3.4 and newer. For older versions please see knowledge base article 238 Step 1: Prepare the Certificate Open a command prompt as an administrator and navigate to the following folder the directory may change depending on where you installed EventSentry: cd \Program Files\Ev...
EventSentry writes debug information to log files to help troubleshoot configuration and software issues. To prevent disk space issues all log files are capped at a maximum size and will automatically rotate e.g. 1.log becomes 2.log once the limit is reached. Log File Locations: Modern Versions Current: SYSTEMROOT\system32\ev...
The EventSentry collector has numerous advantages compared with agents connecting directly to the EventSentry database and is recommended for most installations: Remote connections to the database server can be restricted Agents don39t require SQL ODBC drivers Communication between agents and the collector is encrypted and can be compresse...
If the Forgot your password option does not work verify that you are entering your username and not your email address. If you aren39t able to use Forgot your password you can use one of the three options below to reset the password manually. Option 1: Automated reset script Only available for EventSentry 5.x and later NOTE: You ...
EventSentry integrates with AbuseIPDB in the following ways if an AbuseIPDB API token is configured in the management console under Global Options Security AbuseIPDB Token and Get Threat Intel is checked. Scheduled download of the current AbuseIPDB black list utilized by the Collector and Network Services/NetFlow component...
Some antivirus software products e.g. McAfee starting with version 8.x block and/or intercept outgoing connections to port 25. This will interfere with the EventSentry SMTP notification actions which sends emails using SMTP port 25. You will need to disable or customize the SMTP protection feature of your antivirus product to make the SMTP ...
You will need to take additional configuration steps when configuring EventSentry to access resources located on different computer. By default the EventSentry agent runs under the LocalSystem account. This is a builtin system account that has administrative permissions on the local host but usually has no permissions on remote computers. T...
Starting in EventSentry 5.1 a new way to purge your database is available in Web Reports. This purge job runs more efficiently on large databases and is recommended over the database purge package in the console. If you first installed EventSentry on version 5.1 or later then the Web Reports purge should have been set up by default but if yo...
Yes EventSentry can be installed without an internet connection on an airgapped network. If you choose to install the EventSentry Web Reports optional component the installer will attempt to download the Web Reports installer directly. To avoid this attempt please download the Web Reports Only installer from the Account area and have BOTH ...
Backup Settings Your Web Reports settings are stored in this folder: C:\Program Files\EventSentry\WebReports\conf\ configuration.xml healthmatrix.xml jobs.xml preferences.xml reports.xml users.xml Note that if you have EventSentry installed in a custom location your settings will be located in the installdir\EventSentr...
Overview Customers frequently report that after deleting large amounts of data from their EventSentry database the database file size remains unchanged or the free disk space doesn39t increase as expected. This behavior is normal and by design for both PostgreSQL and Microsoft SQL Server databases. Why This Happens Databases are optimiz...
When deploying agents with the management console and not via MSI the user running the management console needs to meet the following prerequisites on each remote host. If security policies prevent this then agents can also be installed manually or with an MSI installerhttps://www.eventsentry.com/documentation/help/html/installationmanualm...
If you receive an Application Error or you have been instructed by our support team to send your support logs please follow the instructions below. First navigate to your Web Reports instance then click Support in the very bottom right of Web Reports. Next click zip all logs to include all recent log files. If the W...
While overall performance and CPU statistics from nonWindows hosts can easily be obtained via SNMP getting the CPU usage of each process requires a few additional configuration steps. Since EventSentry39s performance monitoring feature supports importing data returned from an external process examplehttp://demo.eventsentry.io/dashboard/id/...