S W G U s e r G u i d e
Chapter 10: Defining and Customizing Logging Policy
58
Defining a Rule in a Logging Policy
If you duplicated a policy, it already has the same rules as were found in the original policy. You can
edit these rules. You can also create new rules from scratch.
You can specify if the rule should be applied to specific users and/or if specific users should be
excluded. One method is by specifying User Lists to which the rule should or should not apply.
Â
To define a rule in a Logging policy
1. In the Policy tree, expand the policy so that you display its existing rules. For instructions on
displaying the Policy tree, see
Step 1
in the procedure
Defining a Logging Policy
.
2. Do any of the following:
• To edit an existing rule, click the rule in the tree, and then in the main pane, click
Edit
.
• To add a rule to a policy that has no rules, or to add a rule to the bottom of the rule list in the
policy, right‐click the policy and choose
Add
Rule
.
• To add a rule directly above an existing rule, right click the existing rule, and select
Insert
Rule
.
The main window displays the Rule Definition screen.
The screen contains three tabs:
General
,
Applies
, and
Except
.
3. Fill in the
General
tab as follows.
a. Enter a name for the rule.
b. Provide a description of the rule. This description is optional.
c. If the rule has an
Enable
Rule
checkbox, ensure that the checkbox is appropriately selected or
cleared, depending on whether or not the rule should be enabled after being committed.
d. In the
Send
To
area, check the locations to which the transaction data should be sent. The
options are as follows:
•
Weblog
—Sends information to the M86 log database, which is viewable via the Log View.
•
Archive
—Sends log information in files to an external remote location. This selection
ensures that relevant information is archived.
•
Report
—Sends information to the M86 reports database.
•
Syslog
— Sends information to one or two UNIX Syslog facilities logging data.
4. To apply the rule to specific users, select the
Applies
tab, and click the radio button for the cate‐
gory of users to which the rule should apply. Note the following:
•
All
Users
is the default.
•
All
Recognized
Users
All users identified by the system.
•
All
Unrecognized
users
are all transactions that have only IP address information and belong
to the unknown users groups. For more information, see the
Management
Console
Refer
ence
Guide
.
NOTE:
If
you
will
be
using
User
Lists
to
identify
users
to
which
the
rule
should
or
should
not
apply,
be
sure
to
define
those
lists.
For
instructions,
see
Defining User Lists
.
NOTE:
Rules
in
a
policy
are
checked
sequentially
from
the
top,
and
the
first
rule
to
be
activated
in
a
policy
determines
the
handling
of
the
content.
Therefore,
the
sequential
placement
of
rules
in
a
policy
is
significant.
For
instructions
on
moving
a
rule
within
a
policy,
see
Relocating an Item in a Tree
.
