WatchGuard Firebox System 4.6 User Guide

Setting up the LiveSecurity Event ProcessorSetting up the LiveSecurity Event ProcessorThe LiveSecurity Event Processor controls logging and notification. It also providesscheduling services for the Firebox; if the Event Processor is not running, you may beunable to connect to the Firebox.Installing the Event Processor programThe LiveSecurity Event Processor program is separate from the WatchGuard ControlCenter and Policy Manager. It must be installed and the log encryption key enteredon all Event Processors. Although it can be installed on the Management Stationduring the QuickSetup wizard installation process, you must also install and run it onany additional Event Processors.The LiveSecurity Event Processor program is available both as a command-line utilityand, on a Windows NT host, as a service. During installation, the setup utility detectswhether or not the host is operating Windows NT or Windows 2000. If so, it installsthe program as a service that automatically starts when you restart the machine:1 Run the WatchGuard Firebox System installation wizard.2 When the wizard asks if you would like to set up logging and notification, selectYes.Running an Event Processor on Windows 98If the Event Processor is to be run on a Windows 98 operating system, it must be runfrom the command line in a DOS window or directly from the Startup folder. A DOSwindow stays open as long as the LiveSecurity Event Processor is running. If youmust log off a Windows 98 Event Processor, the program exits and logging will notwork. On the Event Processor host:1 Open a DOS window.Select Start => Programs => MS-DOS Prompt.2 Change directories to the WatchGuard installation directory.The default installation directory is C:\Program Files\WatchGuard.3 Enter the following command:controld -iThe Event Processor starts. You can minimize the DOS window. Do not, however, close thewindow. Closing the DOS window halts the Event Processor.Running an Event Processor on Windows NT or Windows 2000If the Event Processor is to be run on a Windows NT or Windows 2000 operatingsystem, there are two methods to run it: interactive mode from a DOS window or as aWindows NT service. The default method on installation is for it to run as a WindowsNT service.As a Windows NT or Windows 2000 ServiceBy default, the Event Processor is installed to run as a Windows NT service, startingautomatically every time the host computer restarts. You can also install and run theEvent Processor manually:1 At the command line, type:User Guide 73