Silicon Graphics Gauntlet, Administrator'S Manual, Page: 221 / 306

195
Chapter 20
20. Logging and Reporting
Logging is an important part of a properly configured firewall. Administrators can use
the information in logs to gather usage statistics, monitor activities, check for problems,
and investigate potential attacks. The logging features of the Gauntlet Internet Firewall
provide administrators with a wealth of information about activities to and through the
firewall. The logging features present the information in several formats. You should, of
course, configure both the logging and reporting features to match your security policy.
This chapter describes the concepts behind logging and reporting systems, configuring
these systems, and understanding the log and report formats.
Understanding Logging and Reporting
The Gauntlet Firewall follows the philosophy that it is easy to compress, consolidate,
summarize, and delete log information; it is impossible to retroactively gather log
information on an event that has already occurred. Disk space is a lot cheaper than
spending many hours debugging a problem that a program would have written to the
logs. For these reasons, the components of the Gauntlet Firewall log a wide variety of
activities and attributes.
These are the components of the Gauntlet Firewall:
• firewall kernel
• proxies
• authentication management system
• DNS
• sendmail