Web Gateway 7.1.5 Product Guide - McAfee

8
Monitoring
Logging
Modify a default logging rule to record key words
You can modify a default logging rule that writes entries into the Access Log to include the key words
that led to the blocking of text with “bad” key words.
To modify this rule:
1 Go to Policy | Rule Sets.
2 From the rule sets menu, select Log Handler.
3 Expand the Default log handler rule set and select the nested Access Log rule set. The rules of this
rule set appear on the settings pane.
4 Select the Write access.log rule and click Edit. The Edit Rule window opens.
5 Select Events and in the Events field, select the Set User-Defined.logLine = ... event.
6 Click Edit. The Edit Set Property window opens.
7 Click Add. The Please Enter a String window opens.
8 Click Property and from the list of properties, select List.LastMatches.
9 Click OK. The window closes and the List.LastMatches property is added to log line that is written into
the Access Log.
10 Click Add again, select Value in the window, and in the input field type the following string: “ ”
(whitespace embedded in quotes).
11 Click OK to close the Edit Set Property window.
12 Click Finish to close the Edit Rule window. The modified rule appears on the settings pane.
13 Click Save Changes.
After modifying the rule in this way, the log line for the Access Log contains a string that is the value of
the List.LastMatches property.
If a blocking rule blocks access to text based on a comparison to a list of bad key words, this string
contains the matching key word or words that led to the blocking.
For more information, see Use of a property in a logging rule to record blocking key words.
290 McAfee Web Gateway 7.1.5 Product Guide