Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Exporting agent events from the Endpoint Application Control (EAC) server

    • Updated:
    • 30 Jan 2015
    • Product/Version:
    • Endpoint Application Control 1.0
    • Platform:
    • Windows 2008 Enterprise
    • Windows 2008 Server R2
    • Windows 2012 Enterprise
Summary
Know how to retrieve EAC agent events from the server using the Export Tool in EAC.
Details
Public
The Export Tool fetches events from a server-side message queue. The queue uses a First In, First Out (FIFO) algorithm where the oldest messages appear at the top of the queue. These messages are those that have not been consumed by the export tool and not removed from the server because of the end of their retention.
The Export Tool uses the command:
EventExporter.bat command1 ... "Option=Value" ...
CommandDescription
CheckChecks for new data in the server. Exits with "1" when there are no new events; 0 if otherwise.
PeekFetches a batch of new events and does not mark them as consumed. A batch is stored as a single XML file that is named after the ID of the first message in the batch.
FetchRetrieves a batch of pending events and marks them as consumed in the server so that the next fetch returns fresh data.
CSVConverts all fetched batches to a single CSV file.
ClearClears all locally stored and fetched batches. Be careful, when clearing the local event store after events have been marked as consumed. It will not be possible to fetch the events again.
PerformWorks the same as "EventExporter.bat Fetch CSV Clear.
OptionDescription
ServerHostname or IP address of the EAC server.
Default "localhost"
PortPort number of the backend process of the EAC srver.
Default "8085"
UserName of an admin user that is declared within the web console.
Default "root"
PasswordThe password of the admin user.
Default "root"
BatchSizeThe number of event messages to fetch in one attempt.
Default "5"
CSVThe CSV file to use for storing exported events.
Default "exported-events.csv"
AppendSpecifies whether the CSV is appended or overwritten.
Default "false"
XmlStoreSpecifies the name of the folder to use for storing fetched events.
Default "C:\Users\alpd\Desktop\1187-tools\1187-tools\event-exporter\\events"
XSLChanges the XSLT template that is used to convert events to CSV.
Default "C:\Users\alpd\Desktop\1187-tools\1187-tools\event-exporter\\xsl\events-to-csv.xsl"
Examples:
To export (up to) 5 of the topmost events and not consume them:
 
You can use this for testing. It is a safe operation.
EventExporter.bat Peek CSV "Server=my-host" "Password=changeit"
To export the topmost events, mark them consumed, and create a CSV of all events that exist in the "events" store:
EventExporter.bat Fetch CSV "Server=my-host" "Password=changeit" "CSV=events.csv"
To convert all locally stored events to CSV:
EventExporter.bat CSV "CSV=all-local-events.csv"
To clear all locally stored events:
 
These events will no longer be added to the CSV.
EventExporter.bat Clear
To export the topmost events, mark them consumed, and append them to a CSV:
EventExporter.bat Clear Fetch CSV "Server=my-host" "Password=changeit" "CSV=events.csv" "Append=true"
Premium
Internal
Rating:
Category:
Configure; Troubleshoot
Solution Id:
1102649
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.