ProSecure Web/Email Security Threat Management Appliance STM150 Reference Manual
5.In Select logs to send, select the check boxes for the log types that you want the STM150 to send via email.
6.In Format, click either Plain Text or CSV. If you want the STM150 to compress the log file before sending, select the Zip the logs to save space check box.
7.In Size, select the Split log size to: box and enter a file size (in Megabytes) to split the logs into fragments of the file size entered.
8.Click Apply.
The STM150 will email the selected logs based on the schedule you specified. If you want the STM150 to email available logs immediately, click the Send Now button (located next to the Send to text box).
Using Logs to Identify Infected Clients
In addition to identifying malware that has been detected on the network, you can also use the STM150 logs to help identify potentially infected clients on the network. Clients that are sending out abnormally high volumes of HTTP traffic, for example, indicate possible spyware infection.
To identify infected clients that are sending spyware in the outbound traffic, query the STM150 malware logs and see if any of your internal IP addresses are the source of spyware detected at the Internet gateway. Clients generating abnormally high amounts of HTTP traffic may also be infected by spyware or other malware.
To query log data that will show this information.
1.On the Log Query page, select Traffic as the log type.
2.Check the HTTP check box, and then run the query.
3.On the traffic logs result page, click the Size (Byte) column heading to sort the results in a descending order.
4.Check if there are clients that are sending out suspicious volumes of data, especially to the same destination IP address, on a regular basis.
If you find a client exhibiting this behavior, you can run a query on that client’s HTTP traffic activities to get more information. Do this by running the same HTTP traffic query and entering the client IP address in the Source IP text box.
Log Management
Generated logs take up space and resources on the STM150 disk. To ensure that there is always sufficient space to save newer logs, the STM150 automatically deletes older logs whenever the total log size reaches 50% of the allocated file size for each log type.
Monitoring System Performance |