Web Gateway 7.1.5 Product Guide - McAfee

8
Monitoring
Logging
• List.OfString.ToString (Antimalware.VirusNames) — List with the names of the found viruses
and other malware items
The list is converted into a string.
• URL — URL that was requested
• FileSystemLogging.WriteLogEntry ... — Executes the write event.
The entry that is to be written and the log file it is written into are specified with the event:
• (User-Defined.logLine) — Event parameter specifying the entry
This is a log file line with the parameter values that have been set by the other event of the rule.
• — Event settings specifying the log file
Note: Clicking the settings name on the user interface opens the settings for editing.
You can modify this logging rule or create similar rules of your own. For more information, see Create a
sample logging rule.
Create a sample logging rule
This section describes steps for creating a sample logging rule. The rule is taken from the Found Virus
Log Rule Set, which is provided on the appliance by default.
Note: The rule name is slighty modified to avoid a conflict with the existing rule.
To create a sample logging rule:
1 Go to Policy | Rule Sets.
2 From the Rule Sets menu, select Log Handler and then the Found Viruses Log rule set.
3 On the settings pane, click Add Rule. The Add Rule Window opens with the Name step selected. In
the main window area, items appear for adding a name and other general settings.
4 Add the following general settings:
a Name — Type Write Found Malware Log.
Note: The name of the already existing logging rule is Write Found Viruses Log.
b Enable rule — Deselect this checkbox, so the sample rule gets not enabled.
5 Select Rule Criteria. Items for adding the criteria appear.
6 Click Add. The Add Criteria window opens.
7 Add the criteria of the rule (Antimalware.Infected equals true):
a From the Property list, select Antimalware.Infected.
b In the Operator list, leave equals.
c In the Parameter area, select true from the Value list.
8 Click OK. The Add Criteria window closes and the added criteria appears in the main window area. It
lets the rule write a log file entry if an object is actually found to be infected.
9 Select Action and from the Action list, select Continue. This action lets the filtering process continue
after the log file entry has been written.
10 Select Events.
11 Click Add and from the drop-down menue that appears select Set Property Value. The Add Set
Property window opens.
12 From the list under Set this property (string), select User-Defined.logLine.
280 McAfee Web Gateway 7.1.5 Product Guide