Events collected by the agent that meet the filtering requirements as per the audit configuration, will be displayed in the Latest Events window. This display is NOT a display from the event log file, but rather a temporary display from a shared memory connection between the web UI and the SnareMSSQL service. This list will be empty if the agent has not yet found any matching events or if there has been a network problem and the agent has temporarily suspended event processing.

Events are not stored locally on the host (except for a temporary buffer stored by Microsoft SQL Server), but rather sent out over the network to one or more remote hosts.

Other useful information of the Latest Events window is as follows:

restricted to a list of 20 entries and cannot be cleared, except by restarting the SnareMSSQL service
new events will be displayed with an alarm bell icon next to it
events are highlighted in the criticality level colour nominated in your audit policies
the window will automatically refresh every 15 seconds or when the Latest Events menu item is selected
displays the status of the current network connection(s) to the log server
displays the date and time of the last HeartBeat sent, if applicable

Browser not supported