Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 19: Auditing and Reporting
Generating reports using the Admin Console
556
Report type Description
root_accesses This report contains a list of root access attempts by users who used the srole
command to change roles. This report lists the date that the root access attempts
occurred, the service (srole), the result of the attempt, which domain the user tried to
srole to, and who the user was. This report is generated daily.
service_denied This report lists instances when users were denied access to a service because of the
restrictions you set up in your active rules (also referred to as the Access Control List, or
ACL). The report lists the source and destination hosts, the user, the service that was
denied, and the total number of times a check was made. The meaning of these events
depends on several factors, including your site’s security policies. The report could
indicate that an internal user is trying to access an unauthorized system on the Internet.
It might also indicate a service that internal users need, and you may want to consider
making it available.
Note: This report is automatically generated and e-mailed on a daily basis to the
Sidewinder G2 administrator. See “Viewing administrator mail messages on Sidewinder
G2” on page 350 for information on viewing this e-mail.
service_traffic This report lists proxy information on how often Internet services were used during a
specific period of time. You can use this information to gauge how heavily your
Sidewinder G2 is being used.
The report lists each service, the number of kB sent to the server, the number of kB sent
to the client, the total number of kB, and the number of connections that were made.
When a service uses a non-standard port (for example, 8000 or 8010), the service’s
port number will also appear in the Service column.
Note: This report is automatically generated and e-mailed on a daily basis to the
Sidewinder G2 administrator. See “Viewing administrator mail messages on Sidewinder
G2” on page 350 for information on viewing this e-mail.
traffic This report lists information about a specific host’s activity while using the system. This
report provides a section for the traffic generated, services denied, and probes
generated by the host that was specified.
udb_action This report, made up of two sections, shows the actions performed on the Sidewinder
G2’s user database. One section of the report shows the actions performed on the
system components of the user database. The other section of the report shows the
actions performed on user components of the user database.
The user database report lists the date the action occurred, which user it affects, what
action was made to the database (either an addition, a deletion, or a modification), what
type of data, or class, received the action, and which administrator changed the data.
user_activity This report lists information about a specific user’s activity on the system. This report
provides a section for the traffic generated, root access attempts, services denied, and
user database actions involving the specified user.
More...