McAfee MAP-3300-SWG - Web Security Appliance 3300, Product Manual

Page: 223 / 336

The appliance uses information from this database to display the reports that you can view from
Reports
on the navigation bar. Information about earlier events is removed periodically.
Retention limits are dependent on the type of hardware and the size of
the appliance hard disk space.
Table 216 Option definitions
Option Definition
Events
Items shown in the reporting database.
Default values are:
• 3000/3100 hardware — 31 days or 100000 items.
• 3200 hardware or the Virtual appliance — 500000 items.
• 3300/3400 hardware — 1000000 items.
Quarantined emails Maximum number or length of time that messages can be held in the quarantine
database.
Default value is 14 days or 20000 items.
Blocked emails Maximum number or length of time that blocked messages can be stored in the
database for use by the Message Search feature.
Default value is 3 days or 50000 items.
Delivered emails Maximum number or length of time that delivered messages can be stored in the
database for use by the Message Search feature.
Default value is 3 days or 100000 items.
Bounced emails Maximum number or length of time that bounced messages can be stored in the
database for use by the Message Search feature.
Default value is 3 days or 20000 items.
Event Options
Use this area to define the events that are stored in the database.
System
|
Appliance Management
|
Database Maintenance
|
Event Options
Table 217 Option definitions
Option Definition
Insert events into the
database
Select to add information about reporting events into the database. Be aware
that the database can fill quickly when reporting events are stored.
McAfee recommends that Content Security Blade Server users use the offbox
syslog feature for reporting events and deselect this option.
Insert only primary
events into the database
Select to add information only about primary reporting events into the
database, such as virus detections.
A message that triggers both a virus and spam "hit" is logged twice in the
database. If you deselect this option, only the detection that caused the primary
action on the message is logged in the database.
Pass on events to the
logging channels
Select to allow events to be passed to the logging channels from logging and
alerting sources such as syslog, SNMP, McAfee ® Web Reporter, and email
detections.
Overview of System features
Appliance Management
McAfee Email and Web Security Appliances 5.6.0 Product Guide 223