The Dashboard is the control centre for the monitoring and forwarding pipeline. It shows whether the collector is running, how many events have been captured, and lets you turn monitoring and forwarding on or off with a single click.
¶ What this tab shows
- Monitoring — whether the collector is enabled. When active, the appliance reads the audit log and builds normalised events.
- Forwarding — whether normalised events are being evaluated against your policies/routes and shipped to destinations.
- Collector — whether the background collector worker is actually running right now (it is auto-started at boot and self-healed every few minutes).
- Total Events — the number of events captured since the collector started.
- Events Last Minute — the current event rate, a quick indicator of activity.
¶ How to use it
- Enable Monitoring first — this starts the collector and begins populating the Events and Statistics tabs. Monitoring is useful on its own, even without forwarding, for local visibility.
- Enable Forwarding once you have at least one destination and a policy. Events that match are then queued and delivered.
Monitoring and forwarding are independent switches. You can collect and inspect events locally without sending anything off-box; you only start forwarding when your destinations are ready.