Administrator's Guide - Kerio Software Archive

22.4 SecurityAntibombingServer overload protection — see chapter 15.2, section Security Options.[16/Jun/2004 18:53:43] Directory harvest attack from213.7.0.87 detected• [16/Jun/2004 18:53:43] — the date and time of the failed attack.• Directory harvest attack — type of attack.• from 213.7.0.87 — IP address of the computer used for the attempt.• detected — action performed (detected and blocked).If the sender was found in databases of blacklisted serversThe sender was found in a blacklist database (ORDB, own IP address group).[13/Apr/2004 17:44:02] IP address 212.76.71.93 found in DNSblacklist ORDB, mail from to• [13/Apr/2004 17:44:02] — the date and time when the message was received.• 212.76.71.93 — IP address used for sending the message.• found in DNS blacklist ORDB — type of action (the address was found in a databaseof blacklisted servers).• from — email address of the sender.• to — email address of the recipient.WipeUser’s mobile device got lost or stolen and the administrator wiped all user data out ofthe device (for details, see section 36.5).Three types of records regarding wipe are used in the Security log. The first recordinforms about initiation of the wipe process. This record is always included. At this stage,the wipe process can be stopped. The second record type appears if the wipe processis stopped and cancelled. The third record is logged if the wipe process is completedsuccessfully. The wipe is applied upon the next connection of the device to the server.• An example of a record of an initiation of the wipe process is provided below:[22/Aug/2006 12:30:23] Device with idC588E60FCF2FB2C107FBF2ABE09CA557(user:will be wiped out by request Adminjwayne@company.com)• An example of a record of a cancellation of the wipe process is provided below:[22/Aug/2006 12:36:51] Wiping out of the deviceC588E60FCF2FB2C107FBF2ABE09CA557 (user: jwayne@company.com)has been cancelled by Admin• The third example shows information about successful wipe-out of the data on thedevice:[22/Aug/2006 12:31:11] Device C588E60FCF2FB2C107FBF2ABE09CA557255