Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Руководство администратора

Страница: 478 / 861

477 Monitoring the security gateway
Monitoring log files
Prerequisites
None.
To perform a basic log search
1
In the SGMI, in the left pane, under Monitors, click Logs .
2 In the right pane, above the Event Logs table, click Search .
In the Log Search dialog box, on the Search tab, you can limit the events that are displayed by
checking one or more search criteria to be used.
The criteria are applied additively; only events that meet all of the search criteria are displayed in
the Event Logs table.
3
To display events with a specific event name, do the following:
■
Check Event name .
■
Next to the Event name field, click the ellipses (... ).
■
In the Select Event name dialog box, select an event from the Event Definition list.
To search the Event Definition list for an event name, do the following:
From the Search drop-down list select Contains or Starts with.
In the Search text box, type the text you want to search on.
■
Click Search .
■
Click OK .
4 To display a specific classification of events, check Classification , and then, from the drop-down
list, select one of the following:
■
Access allowed
■
Access denied
■
Configuration
■
Connection established
■
Internal
■
License
■
Operational
You can choose more specific classifications within these broad categories from the Advanced tab.
5 To display events that include a specific user name, check User , and then type the name of a user.
6 To display events that include a specific source IP address, check Source IP address , and then type
the IP address of the source of an event.
7
To display events with a specific destination port, check Destination port , and then type the port
number of the destination of the event.
8 To create a time window within which to search, check the Time text box, and then do the
following:
■
Select a start time by using the hours and minutes drop-down lists and selecting AM or PM.
■
Set the duration of the search window using the hours and minutes drop-down lists.
Alternatively, you can use the sliders on the time line to specify a start time and duration. The
values in the drop-down lists change accordingly.
9 Click OK .
Destination port The port number of the destination of the event.
Time: Start The beginning of the time period specified for the search.
Time: Duration The duration of the search period.