Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 19: Auditing and Reporting
Auditing on the Sidewinder G2
The number of audit events you can scroll through on each page is dependent
on the Lines Per Page value you entered in the Audit Viewing window (see
page 535). For example, if you selected 50 audit events per page, you can
scroll through 50 events at a time. To move to the next 50 events, click Next
Page or Previous Page, accordingly.
When you click an audit event in the table, the detailed audit information for
that audit event is displayed in the bottom portion of the window (it also
appears in the Info column). The following information is displayed in the table:
Note: Some audit types will not contain information for each table column. If a
column is blank, that information does not apply for that particular audit event.
• Time — This row lists the time at which an audit event occurred.
• Type — This row lists the type of each audit event (for example,
Administration configuration change indicates that the audit event
represents a configuration change made on the Sidewinder G2).
• Service — This row lists the service type associated with an audit event.
• Source IP — This row lists the source IP address associated with an audit
event.
• Source Burb — This row lists the source burb associated with an audit
event.
• Dest IP — This row lists the destination IP address associated with an audit
event.
• Dest Burb — This row lists the destination burb associated with an audit
event.
• Info — This row provides detailed audit information associated with an
audit event. (This information is also displayed in the bottom portion of the
window if you click an audit event.)
Ordering the audit event table
Initially, the audit events are listed in chronological order. However, you can reorder
any column alphabetically or numerically by clicking the heading. You
can also right-click a heading to select a default filtering option or create a
custom filter. For information on filtering tables, see “Admin Console
conventions” on page 25.
To view the details of a particular audit event in the real time audit results, you
must first click Stop to end real time audit. This will enable the table and allow
you to use the window as you would if you were viewing a snapshot of audit
events.
Important: If you click Stop when viewing audit events in real time and then click
Start, the table will be cleared and new real time audit events will be displayed as
they happen.
537