Web Gateway 7.1.5 Product Guide - McAfee

Logging
Monitoring
Logging 8
Appliance behavior can be recorded in log files. This section describes the available log file types,
explains their handling, and gives an example of configuring a log file to record found viruses.
Log file types
There are several types of log files on the appliance. They differ in the type of data that is recorded and
in the way the recording is done.
Log files that record the same kind of data are stored in a folder, which is called a log.
System log files
Some log files are maintained by the appliance system, which includes the operating system and
several system-related services. For these log files, data is recorded by system functions. You can view
these files on the user interface, but not edit or delete them.
Note: When system log files are unreadable, they are not shown on the user interface.
The files are also rotated in regular intervals by the system. There is no option for configuring this
rotation.
Module log files
Another type of log file is maintained by particular modules of the appliance, such as the proxy or
anti-malware module. Data for these log files is recorded by module functions. You can view these files
on the user interface, but not edit or delete them.
Rotation, deletion, and pushing of these files is handled by the Log File Manager, which you can
configure settings for. The files are stored in subfolders that are located on the appliance under
/opt/mwg/log.
All files in these folders are handled by the Log File Manager, except those that have mwgResInfo as a
part of their names. The folders with the following names are also not handled by the Log File Manager:
cores, feedbacks, tcpdump, migration, system, ruleengine_tracing, connection_tracing,
message_tracing.
Logs for module log files include the following:
• Audit log — Stores log files that record changes to the appliance configuration
• Debug log — Stores log files that record debugging information
• Migration log — Stores log files that record migration activities
• MWG errors logs — Stores log files that record errors occurring in modules of the appliance
There are separate errors logs for the core and coordinator subsystems, the Anti-Malware module,
the user interface, and the system configuration daemon.
• Update log — Stores log files that record updates of modules and files on the appliance
Rule-based log files
There are also log files that record data based on rules. The recording is executed by events that are
triggered when these rules apply. For example, a rule triggers an event when an object that a user
requested is infected by a virus. The triggered event writes an entry with information on the user, the
infected object, date and time of the request, and so on, to the log file.
You can edit the rules for this type of log files in the same way as any other rules.
The following rule-based log files are provided on the appliance by default:
• Access log — Stores log files that record requests and related information, including date and time,
user name, requested object, infection of an object, blocking of an object
McAfee Web Gateway 7.1.5 Product Guide 277