Silicon Graphics Gauntlet, Administrator'S Manual, Page: 224 / 306

198
Chapter 20: Logging and Reporting
Service Summary Reports
The Service Summary Reports include usage and user information on a per service basis.
For example, the default report for the TELNET gateway indicates the top 100 clients by
connections, the top 100 clients by amount of traffic, and the top 100 denied clients.
Each night the cron daemon on the firewall runs the daily script (/usr/gauntlet/bin/daily).
When the daily report option is turned on (it is on by default), this script calls a daily
report script (/usr/gauntlet/bin/daily-report) which calls other shell scripts to summarize
the logs for each service. The firewall mails the reports to the firewalladmin alias as
configured with gauntlet-admin. Note that the firewall stores the daily report in
/usr/tmp/daily-report.
When the weekly report is turned on, the cron daemon on the firewall runs the weekly
script (/usr/gauntlet/bin/weekly). This script calls the weekly reporting script
(/usr/gauntlet/bin/weekly-report) to summarize the services for the past week. The firewall
mails the reports to the firewalladmin alias. Note that the firewall stores the weekly
report in /usr/tmp/weekly-report.
Exception Reports
Exception Reports include noteworthy items. The Gauntlet Firewall defines a list of items
that are not noteworthy and ignores those sorts of entries in the logs. The firewall
considers all other events as possible security events. Thus, any item that you have not
specifically told the firewall to ignore, it reports. This report includes information that
could indicate a possible attack or other problems.
For example, the firewall default is to ignore successful authentications when parsing the
log file. Successful authentication attempts are a normal part of firewall activity.
However, unsuccessful authentication attempts could be a sign of a potential attack.
Therefore, the exception report includes all unsuccessful authentication attempts from
the logs.
To create the Exception Reports, the cron daemon periodically (the default is four times a
day but this can be configured in gauntlet-admin) runs a reporting script
(/usr/gauntlet/bin/frequentcheck). This script scans the log files for events that it can ignore,
as defined in another configuration file (/usr/gauntlet/config/frequentcheck.ignore). The
script summarizes all of the noteworthy items since the last time it created a report. The
firewall mails the reports to the firewalladmin alias. The firewall stores the exception
report in /usr/tmp/frequentcheck-report.