Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 19: Auditing and Reporting
Generating reports using the Admin Console
554
Report type Description
http_virus This report provides information on Web viruses that are detected by the Sidewinder
G2. The report includes virus frequency, hits by source address, and detected Web
viruses.
ipf_dest_traffic This report lists IP Filter information on the destination host traffic that the Sidewinder
G2 connected to, sorted by the number of bytes transferred. The report lists the
destination host, the service used, the number of kB transferred, and the number of
connections that were made.
ipf_host_traffic This report produces IP Filter information for source host traffic on internal and external
networks. You might use this data for tracking which systems have the heaviest traffic
going to and from the Sidewinder G2. The report lists the source host, the number of kB
sent to the server, the number of kB sent to the client, the total number of kB, and the
number of connections that were made.
ipf_port_traffic This report lists IP Filter traffic port information that occurred over a specific period of
time.
The report lists each service, the number of kB sent to the server, the number of kB sent
to the client, the total number of kB, and the number of connections that were made.
When a service uses a non-standard port (for example, 8000 or 8010), the service’s
port number will also appear in the Service column.
ipf_traffic This report provides a summary of the IP Filter port, host, and destination reports.
mail_virus This report provides information on mail viruses that are detected by the Sidewinder G2.
The report includes virus frequency, hits by source, and detected mail viruses.
performance This report summarizes utilization information (based on one-hour increments) for CPU
percentage and load average, as well as real, virtual, and mbuf memory usage.
probes_attempted This report lists information about attempts made to connect or send a message to a
Sidewinder G2 port that either has no service associated with it or is associated with an
unsupported service. This report contains a section for probes received in each burb on
the system. The report lists where the probe originated from and how many probes
occurred. The output of this report will be similar to the following:
For each burb, the above report lists the time of the report,
the interval covered by the report, the source host,
destination host, destination port, and the number of probes
generated by this source/destination host pair. Up to five
destination port values are displayed.
Depending on how you have set up your auditing configuration, you may have already
been notified of these probe attempts. If you were not notified, you may want to change
your auditing options as described in Chapter 16.
Note: This report is automatically generated and e-mailed on a daily basis to the
Sidewinder G2 administrator. See “Viewing administrator mail messages on Sidewinder
G2” on page 350 for information on viewing this e-mail.
More...