Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 302 / 1026

•
To track all events from a specific source IP address, create a filter on source address
column; when applied, the filter displays only the log entries that use the specified
source address.
•
To track all events for a specific category or subcategory of log entries, such as
Configuration or Attack log entries, create a filter on the category or subcategory
column; when applied, the filter displays only the log entries with the specified category
or subcategory designation.
For more details on using the Log Viewer, see “Logging” on page 739. For step-by-step
instructions on creating a filter, see the
Network and Security Manager Online Help topic
“Setting Filters”.
Identifying Administrative Changes
Use the Audit Log Viewer to identify administrative changes made to your managed
devices. Audit log entries also identify the administrator who made the change, the action
performed, and the date and time of the change. You can track changes by time of logging,
administrator name, action, targets, and devices. If an administrator made a change to
a device or an object, you might want to update the affected devices.
For details on using the Audit Log Viewer, see “Using the Audit Log Viewer” on page 788.
Reviewing Reports
Use Report Manager to determine when you are receiving too many attacks of a certain
type and order them by an IP address. For example, if you determine that the current
device configuration and security policy cannot block scans, you might want to create a
new rule in the security policy that guards against those attacks, and then update the
device.
Report Manager provides three types of reports: time-based reports, event-based reports,
and severity-based reports.
• To identify common events, select an event-based report to see the frequency of
events in a bar graph or pie chart. To see details for a specific event, right-click the
event and select
View in Log Viewer to display a custom view in a new window. You
can save a detailed view as a custom report. For example, when viewing the Top Alarms,
expand a location to view the data that makes up this location.
• To examine how specific rules in your security policy are performing, select the
Administrative > Top Rules report. You might need to fine-tune an inefficient rule to
better handle events in your network traffic.
For details on using Report Manager, see “Reporting” on page 809.
Using Preview Tools
When you update a managed device, you overwrite the existing configuration that is
running on the physical device. Therefore, it is important to verify a configuration before
sending it to the device.
Copyright © 2010, Juniper Networks, Inc. 252
Network and Security Manager Administration Guide