What SmartEvent component creates events?

The Consolidation Policy controls how logs are aggregated and stored, but it does not create SmartEvent events.

The Correlation Unit processes incoming logs against the Correlation Policy rules and creates events when log patterns match defined criteria. It is the active engine that transforms raw log data into actionable SmartEvent events, distinct from the GUI or policy components that display or define rules.

SmartEvent Policy defines the rules and criteria for what constitutes an event, but the actual event creation is performed by the Correlation Unit.

SmartEvent GUI is the management console used to view and manage events; it does not create them.