Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Generating
reports using the
Admin Console
Chapter 19: Auditing and Reporting
Generating reports using the Admin Console
The Sidewinder G2 Reports window in the Admin Console allows you to
generate commonly used reports based on pre-defined report formats, such as
administrative user connections, network probe attempts, traffic information,
and active rule (ACL) usage, to name a few.
The report information that is displayed is pulled from the audit database.
When audit events are generated, information relevant to each event (such as
a date and time, process identification information, user identity, and address
information) is automatically appended to the audit information to help an
administrator identify and categorize the audit data that is stored. If the report is
comprised of numerous areas, the information in the report is appropriately
categorized for ease of viewing.
For example, if you run the traffic report, you will receive a summary of the
various types of proxy traffic as follows: service, source host, destination, and
user. If you want to view only traffic generated by users, you could instead run
the user_traffic report to view only a summary of all user traffic.
You can further refine your results by running the user_activity report and
specify a single user whose activity you want to view. When you run the
user_activity report, you will receive a detailed report of all of that user’s
system activity, organized into sections (such as general traffic, root access
attempts, rule violations, and so on). The information contained in a report will
depend on the time frame you specify.
Note: To view reports using a command line interface, see the cf_reports man
page.
To generate reports using the Admin Console, select Audit and Reports >
Reports. The following window appears.
Important: You must enable the auditdbd server before you can generate reports.
See “Enabling and disabling servers” on page 65 for information on enabling the
auditdbd server.
551