Thank you. Now a question about logs and events. I have the Log observer, State, and Service events enabled. If I understand correctly, the Log observer event should insert into the Events log other qualifying log entires, such as antivirus update and IPS log entries.
There are no IPS entries in the IPS log (I want to investigate that separately) but there are antivirus updates. But so far only State events are in the Events log. Am I missing something on the configuration side or misunderstand how the Events log works?