Table of Contents

4.1 Agents

To add a new agent to a configuration you can either change the configuration file and restart the system or change the configuration on the fly using the GUI. To add an agent you need to write in a file the agent's configuration. This is exactly like writing a configuration file, except that the only part needed is the AGENT{ }. That is, adding an agent follows the same format as declaring an agent in the configuration file. After you have written the new agent file you can add the agent to the current configuration by going to "Monitor Agents" -> "Add Agent from File". This will bring up the following window. From it you can select the location of the New Agent file. (an example configuration file can be found here, the example file for the agent to add can be seen here).

The GUI can also be used to remove agents. To do this go to "Monitor Agents" -> "Remove Agent". This will bring up the following window. From it you may select one of the agents and remove it.

4.2 Detectors

To add a detector to an agent select “Monitor Agents” -> “Detectors” -> "Add Detectors". This will bring up the following window. This is step one of a three step process. In this step we choose the agent(s) that we wish to add new detectors to. To do so we highlight their name by clicking on them and then click on the button labeled >>.

Step two of the process is to choose which detectors to add to the agent. They are selected in the same way as the agents were (by using the >> button).

Step three give a summary of the detectors that were added to what agents. To finally add the detectors click Finish.

Detectors can also be removed on the fly from the GUI. To do so go to “Monitor Agents” -> “Detectors” -> "Remove Detectors". This will bring up a new window that can be seen below. An agent should be selected, after that agent is selected a list of detectors will show up in the "Select Detector(s)" part of the window. after the detectors have been selected they can be removed with the "Remove Detectors" button.

In addition to adding and removing, some detectors can also be modified. The window can be brought up similarly to the examples above. To modify a detector select the agent, then the detector.

4.3 New Events

An agent's events will be determined by its detectors. If you decided to write a new detector/event it will be found automatically and will be addable by using the method given in 4.2.

4.4 New Machines

To add a new machine to the configuration on the fly start an agent server on that machine. Then simply follow the instructions above for adding agents on the fly.

4.5 Configuration Editor

The GUI has a built in configuration file editor. It can be accessed by going to "Window" -> "Configuration Editor". It can be used to configure an agent and launch it directly from the editor. Configuration files can be opened from the disk and saved to the disk.

4.6 Subscriptions

Agent subscriptions can be modified from the GUI. To add a new subscription select "Monitor Agents" -> "Subscriptions" -> "Add Subscription". This will bring up the following window. Only the first step in this process will be shown. To add a subscription select the agents that you wish to be subscribers, then select the subscribees, then choose the events.

To remove subscriptions "Remove Subscription" should be selected from the drop down menus instead of "Add Subscription". This will bring up the following window. Each agent's subscriptions can be seen by selecting it. The Subscriptions can be removed by clicking the "Remove Subscriptions" button.