Nortel SMC 2450, Руководство по внедрению

Страница: 209 / 262

Logging Page 209 of 260
Secure Multimedia Controller Implementation Guide
size or after a specific interval of time. After log rotation, the logs are
e-mailed to the specified external system. You can individually configure
each of the different log types, depending upon expected log volume.
Security log rate-limiting
The security log has the greatest risk of becoming large, consuming
significant system resources, or both. This can occur, for example, if a log
message is generated for every packet that transmits to the SMC. To limit this
risk, the SMC provides various levels of control over the number of generated
log messages and their rate.
Features
Limit by message type
In the Web UI at the Multimedia Security > Security Settings > Log >
Messages page, you can enable or disable logging for certain types of
messages such as particular attacks, globally allowed packets, and globally
denied packets.
Limit by count
You can specify that logging only occurs for a limited number of messages in
a given period of time. Limiting by count prevents the CPU from becoming
over-used in managing log resources; however, it also provides an inaccurate
report of the state of the current system because log messages beyond the
limit are dropped.
IMPORTANT!
Logging for Unavailable Policies (that is, generating a log message for
any traffic that does not match an existing policy) is disabled by default,
because it has the potential of generating many messages in a new
installation; however, logging for Unavailable Policies messages are
helpful when debugging network communication problems by
logging
packets that are silently dropped by the firewall.