Symantec 20032623 - Endpoint Protection Small Business Edition, Руководство по внедрению

Страница: 278 / 351

Table 19-3
Log types (continued)
Contents and actions Log type
The Computer Status log contains information about the real-time operational status
of the client computers in the network.
Available information includes the computer name, IP address, infected status,
protection technologies, Auto-Protect status, versions, definitions date, user, last
check-in time, policy, group, domain, and restart required status.
You can also clear the infected status of computers from this log.
Computer Status
The Network Threat Protection logs contain information about attacks on the firewall
and on intrusion prevention. Information is available about denial-of-service attacks,
port scans, and the changes that were made to executable files. They also contain
information about the connections that are made through the firewall (traffic), and
the data packets that pass through. These logs also contain some of the operational
changes that are made to computers, such as detecting network applications, and
configuring software.
No actions are associated with these logs.
Network Threat Protection
The SONAR log contains information about the threats that have been detected during
SONAR threat scanning. These are real-time scans that detect potentially malicious
applications when they run on your client computers.
Available information includes items such as the time of occurrence, event actual
action, user name, computer/domain, application/application type, count, and
file/path.
See “About SONAR” on page 195.
SONAR
The Risk log contains information about risk events. Available information includes
the event time, event actual action, user name, computer/domain, risk name/source,
count, and file/path. Risk
The Scan log contains information about virus and spyware scan activity.
Available information includes items such as the scan start, computer, IP address,
status, duration, detections, scanned, omitted, and domain.
No actions are associated with these logs.
Scan
The system logs contain information about events such as when services start and
stop.
No actions are associated with these logs.
System
Monitoring protection with reports and logs
Viewing logs
278