Administrator's Guide - Kerio Software Archive

22.5 Connection Log
A typical example of this record type is the change of traffic rules. When the user hits
Apply in Configuration → Traffic policy, a complete list of current traffic rules is written
to the Config log.
Example:
[18/Apr/2008 12:06:03] Admin - New traffic policy set:
[18/Apr/2008 12:06:03] Admin - 1: name=(ICMP traffic)
src=(any) dst=(any) service=("Ping")
snat=(any) dnat=(any) action=(Permit)
time_range=(always) inspector=(default)
• [18/Apr/2003 12:06:03] — date and time of the change
• Admin — login name of the user who did the change
• 1: — traffic rule number (rules are numbered top to bottom according to
their position in the table, the numbering starts from 1)
• name=(ICMP Traffic) ... — traffic rule definition (name, source,
destination, service etc.)
Note: The default rule (see chapter 7.1) is marked with default instead of the positional
number.
22.5 Connection Log
The Connection log gathers information about traffic matching traffic rules with the Log matching
connections enabled (see chapter 7) or meeting certain conditions (e.g. log of UPnP traffic
— see chapter 18.2).
How to read the Connection Log
[18/Apr/2008 10:22:47] [ID] 613181 [Rule] NAT
[Service] HTTP [User] james
[Connection] TCP 192.168.1.140:1193 -> hit.google.com:80
[Duration] 121 sec [Bytes] 1575/1290/2865 [Packets] 5/9/14
• [18/Apr/2008 10:22:47] — date and time when the event was logged (note:
Connection logs are saved immediately after a disconnection).
• [ID] 613181 — Kerio Control connection identification number
• [Rule] NAT — name of the traffic rule which has been used (a rule by which the traffic
was allowed or denied).
• [Service] HTTP — name of a corresponding application layer service (recognized by
destination port).
291