Architecture Overview

LT Auditor ^MP uses a modular, distributed architecture. At a high level it consists of a central server that receives and processes audit data from a set of purpose-built collection modules, each responsible for gathering activity from a specific part of your environment. All collected data flows into the central platform where it is available for filtering, alerting, reporting, and compliance monitoring through the web-based interface.

Core components:

LT Auditor ^MP Server The central hub of the platform. It receives incoming audit log data, processes and normalizes it through configured receivers and transformation rules, stores it in the database, and serves the web-based interface. The server can be hosted on Windows Server, Linux (SLES, Ubuntu, Debian), or Docker.

PostgreSQL Database The backend database that stores all collected audit events, configuration, compliance rules, reports, and filter definitions.

Web UI A browser-based interface organized into functional modules — Define, Configure, Manage, Reports, View, Comply, and Admin. Accessible via any modern browser and protected by role-based access control.

Collectors Lightweight services that receive forwarded log data from collection modules and pass it to the LT Auditor ^MP server for processing. Collector connection settings are configured under Admin → Collector Details.

Collection Modules Separate installable components that collect audit activity from specific parts of your environment and forward it to the LT Auditor ^MP server via syslog or agent-based streaming. Each module targets a different data source:

Web UI module overview:

The LT Auditor ^MP web interface is organized into the following modules, each serving a distinct function in the audit lifecycle:

Define The foundation of the platform. Administrators define audit environments (e.g., Windows, Ubuntu, OpenText) and log categories within those environments. Each category defines the types of audit events collected, the operations that are auditable, and the data columns stored for that category. Everything else in the platform — receivers, filters, reports, views, and compliance rules — references environments and categories defined here.

Configure Where incoming audit data is shaped into structured records. Receivers define how raw log data is parsed, normalized, and mapped to environments and categories. Transformation rules extract field values, convert data types, apply conditional mappings, and enrich log data. Receivers can be tested against sample logs before deployment.

Manage Where administrators control which events are acted on. Audit filters define conditions that incoming events must meet, and specify what happens when they match — retain, alert, tag, discard, or forward. Filters are evaluated in priority order and can use AND/OR condition logic. Filter templates allow commonly used configurations to be reused across environments.

Reports Where structured snapshots of audit data are created and delivered. Reports are configured with filters, columns, grouping, and aggregation settings, then generated on demand or on a schedule. Scheduled reports are delivered via email in CSV, Excel, or PDF format. Reports can be shared, duplicated, templated, and linked to compliance rules as evidence.

View Where audit log data is accessed interactively in real time. Views are customizable interfaces for browsing, searching, and filtering live log data. They support full-text search, advanced filter conditions, column customization, sorting, pagination, auto-refresh, and log export.

Comply Where compliance obligations are managed. Compliance frameworks group related requirements, and compliance rules define specific criteria that must be met. Rules are evaluated against audit log data on a schedule or in real time. The compliance dashboard displays overall compliance scores, violation counts, and evidence links. Compliance reports can be generated on demand or scheduled for automatic delivery.

Admin Where system administration tasks are performed. Includes user account management, role assignments, collector configuration, and system settings.

Data flow:

1. Collection modules gather activity data from monitored systems
2. Data is forwarded to the LT Auditor ^MP server via syslog or agent-based streaming
3. Configured receivers parse and normalize the incoming data using transformation rules
4. Normalized data is stored in the PostgreSQL database
5. Audit filters evaluate incoming events and apply configured actions (retain, alert, tag, discard, forward)
6. Administrators interact with stored data through the View, Reports, and Comply modules

[Your administrator should add a network or architecture diagram here illustrating the deployment layout specific to your environment, including which collection modules are deployed and where.]