Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 832 / 1026

By default, the Left Axis uses the data type Top Sources and the Top Axis uses the data
type Top Destinations. To change these settings, select the desired data type in the data
point source menu.
Setting Data Points
A data point is a single data type field that matches the axis setting. By default, each axis
collects 10 data points for each evaluation. These default settings create a Log Entry
Matrix of 100 cells (the top 10 source IP addresses are correlated against the top 10
destination IP addresses, creating a 100-cell matrix). For example, a data point count of
6 for each axis would create a 36-cell matrix.
You can set the data point higher (maximum 40) or lower (minimum 5), depending on
your investigation requirements. To change these settings, select the desired data type
in the data point count field. The higher the data count, the larger the log entry matrix—and
the more processing power required by the Log Investigator UI. Using large data counts
can slow performance.
In this example, you swap the setting for the Left and Top Axes of the Log Investigator
to see how each axis controls data.
Set the filter to Attacks, then configure the Left and Top Axes:
•
To identify which of the most popular source addresses are generating attacks against
the most popular destinations:
• Select the Left Axis (the independent axis) as Top Sources.
• Select the Top Axis (the dependant axis) as Top Destinations.
The Left Axis displays all attacks for the Top Source IP addresses, while the Top Axis
displays the number of attacks for each of the Top Destinations attacked by the Top
Sources.
• To identify which of the most popular destination addresses are receiving attacks from
the most popular sources:
•
Select the Left Axis (the independent axis) as Top Destinations.
• Select the Top Axis (the dependant axis) as Top Sources.
The Left Axis displays all attacks against the Top Destination IP addresses, while the
Top Axis displays the number of attacks for each Top Source IP address that attacked
a Top Destination.
Setting a Log Entry Limit
You can limit the number of log entries used in Log Investigator calculations. The NSM
Device Server stores log entries from managed devices and the management system;
when the GUI Server accesses a log entry to display its information in the UI, that log
entry is placed in a log buffer. As the Log Investigator searches your log database for log
entries that match the filter, time period, and data type criteria, it places all matching log
entries in the log buffer.
Copyright © 2010, Juniper Networks, Inc. 782
Network and Security Manager Administration Guide