Web Gateway 7.1.5 Product Guide - McAfee

8
Monitoring
Logging
• Found viruses log — Stores log files that record the names of viruses and other malware that were
found to infect requested objects
The log also records date and time, user name, IP address of the client a request was sent from,
requested URL.
• Incident logs — A number of logs for storing log files that record incidents concerning various
functions, such as licensing, monitoring, or updates
To these default logs, you can add logs that you have created yourself.
View log files
The log files that exist on the appliance can be viewed on its user interface.
To view log files on the appliance:
1 Select the Troubleshooting top-level menu.
2 On the appliances tree, go to the appliance you want to view log files for and select Log Files. A list
of log file folders appears.
3 Double-click the folder or subfolder with the log files you want to view. The folder opens to display its
log files.
4 Select the log file you want to view and, on the toolbar above the list, click View.
Log file handling using rules
When log files use rules, they have their entries written by events of those rules. If a logging rule
applies, one event sets the parameter values that are recorded, another writes these values into a log
file. The log for this file is specified by the settings of the write event. These settings include also
options for configuring log file rotation, deletion, and pushing.
So, when handling log files using rules, you need to take care of the following:
• Logging rules — Rules including the criteria and events that write log file entries when the criteria
are matched
• Logging rule sets — Rule sets containing logging rules
These rule sets are nested on the appliance in top-level rule sets known as log handlers. A Default
log handler is provided after the initial setup.
• Logging event settings — Settings that specify the log for the log files and measures, such as
rotation, deletion, and pushing
The log and the measures are handled by a particular module (or engine) on the appliance. By
default, this is the File System Logging engine.
If you want to use log files of your own, you need to configure all these items in an appropriate way.
For more information, see Use self-configured log files.
278 McAfee Web Gateway 7.1.5 Product Guide