Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 833 / 1026

To control the size of this buffer (the number of matching log entries), you can configure
the Max Log Count for your investigations. The limit defines the number of matching log
entries the Log Investigator accepts for its calculations.
You can set the following log entry limits:
•
100,000 log entries
• 200,000 log entries
• 400,000 log entries
•
600,000 log entries
•
800,000 log entries
• 1,000,000 log entries
NOTE: Setting a large buffer limit can degrade Log Investigator performance.
The maximum buffer size of one million log entries uses all memory on the
GUI Server and is not recommended.
Setting Log Investigator Filters
Log Investigator filters operate much like Log Viewer filters: You set criteria for log entries
and the Log Investigator filters out log entries that do not match the filter criteria. Using
the
Filter Summary dialog box, you can select and apply multiple filters to the Log
Investigator matrix.
To set filters, from the View menu, select Set Filter . Table 106 on page 783 details filter
types:
Table 106: Log Investigator Filters
Description Sample Filters Filter Type
Identifies packets by the time when a packet
is sent from a device. Time Generated Time Filter
Identifies packets based on information
about an address of a device from which the
packet was sent or an address of a device to
which the packet was sent. Src Addr
Src Intf
Dst Addr
Dst Intf
Address Filters
Identifies packets based on the direction they
are heading to or from a specified device. Packets In
Packets Out
Packets Total
Direction Filters
783 Copyright © 2010, Juniper Networks, Inc.
Chapter 19: Logging