My question is that I am only getting logs from my file server. The file server is my biggest concern, it has the LEM agent installed and is setup as FIM.
So if my PC writes a file to the file server my alert comes from my server, not my PC. So I can't shutdown the IP of the PC, just the file server. Is this normal or should I also be getting alerts from my PC.
Here is a sample monitor I received.
