Juniper NETWORK AND SECURITY MANAGER 2010.3, Administration Manual

Page: 797 / 1016

around a specific time, how to use the find utility to locate log entries with a specific
value, and how to search by log ID to jump directly to a specific log entry.
• “Filtering Log Entries by Event and Time” on page 758—This section describes how to
create custom filters based on event data or time. You can apply these filters to a Log
Viewer column or cell to reduce the number of log entries that appear in the main
display area, helping you to focus your investigations on a specific group of log entries.
• “Filtering Log Entries by Range” on page 760—This section describes how to create
custom filters based on a user-defined range. You can apply these filters to a Log
Viewer column or cell to reduce the number of log entries that appear in the main
display area, helping you to focus your investigations on a specific group of log entries.
• “Customizing Columns” on page 762—The Log Viewer includes 46 columns of log entry
information; however, each predefined view includes only a small subset of available
columns. This section describes how to set viewable columns, change column display
order, resize columns, and hide or unhide a specific column.
• “Filtering Log Entries by Column” on page 764—This section describes how to select one
or more columns for filtering log entries and select filter settings for specified columns.
•
“Using Log Viewer Integration” on page 766—This section describes how to use the Log
Viewer integration to jump from a log entry directly to the responsible security policy
or managed device configuration.
•
“Identifying Irrelevant Attacks” on page 767—Irrelevant attacks are events that do not
affect your network or that you do not consider important. For example, if you do not
run an Apache Web server on your network, you do not need to worry about attacks
against Apache Web servers. This section describes how to use your log entries to
identify irrelevant attacks, then eliminate the attack object group that generated that
attack from your security policy.
Using Log Views
The Log Viewer enables you to view and analyze logs generated by the managed devices
in your network. For your convenience, many predefined views are included for critical
severity attacks, authentication failures, configuration log entries, scans, and other
important activities. Using filters, you can create your own unique, customized log entry
view, then save the custom view (with all its filters) and manage them in folders for future
use.
About Predefined Log Views
The Log Viewer provides several groups of predefined log views. By default, all predefined
log views display the latest logs.
Table 98 on page 747 lists and describes the EX Switch predefined log views.
Table 98: EX Series Switch Predefined Log Views
Description Log Type
Filters logs on devices whose device family name is
junos-ex .
All-Switch-logs
747 Copyright © 2010, Juniper Networks, Inc.
Chapter 19: Logging