Log files and alert notification | IBM Partner Pavilion 2.3 manual

Log files and alert notification

Enterprise Scanner maintains log files on the appliance to use for diagnosing problems with the agent. The log files contain details about the scanning and operational processes running on the agent.

Two types of log files

Enterprise Scanner maintains two types of log files:

Table 32. Types of log files

Log type	Description

Enterprise Scanner (ES)	Contains details about the scanning
	processes controlled by the agent.

System	Contains details about the operational
	processes running on the appliance.

Two types of information

System and ES logs provide two types of information:

Table 33. Types of log information

Header	Description

Alerts (notifications)	An informational message sent from an
	agent; triggered when an event meets set
	criteria.

Logs	Traces the execution logic of the agent.

Log size

Enterprise Scanner performs a refresh procedure to limit the size of individual log files. When a log file reaches 50 MB, Enterprise Scanner backs up and stores the current log file, and then generates a new log file.

Viewing log files

The Proventia Manager does not provide detailed analysis of log files. You can download and save the file in a text editor if you want to view log files.

122Enterprise Scanner: User Guide

Image 130

IBM Partner Pavilion 2.3 Log files and alert notification, Two types of log files, Two types of information, Log size

Contents

User Guide Version Copyright statement Trademarks and Disclaimer Iv Enterprise Scanner User Guide Contents Part 3. Maintenance Part 4. Appendixes 163 Audience About this bookTopics Related publications Technical support contacts Part 1. Scanning from the Proventia Manager Chapters Enterprise Scanner User Guide Section B Policy configuration Section a Network configurationAd hoc scanning in the Proventia Manager Procedure Section a Network configurationConfiguring the management network interface About this task Maximum IPs per discovery subtask Configuring the scanning network interfaceOption Description Interface Maximum assets per assessment subtask Configuring scanning interface DNS settings Option Description Perspective Configuring routes for perspectiveAssigning perspective to a scanning interface Destination Network Before you begin Section B Policy configurationDefining assets for a discovery scan Option Metric Description Click Clear Groupings Displaying assessment checks by groupsIf you want to Then Clear groupings Create groupings interactively Displaying information about assessment checks Selecting assessment checks with filters Discover and report UDP services Click the Common Settings tabOption Description Discover and report TCP services Option Description Ports to scan with generic TCP checks Option Description Dynamically determine OS if previously DefaultOption Description Ports to scan with generic UDP checks Obtained information is older than Access domain controllers to verify access Option Description Verify account access level before usingLocal group membership to verify access Access level Temporary lockout allowed Enterprise Lockout Allowed is enabled. WhenOption Description Allowed account lockout Maximum Allowable Lockout Duration Defining assessment credentials for a policy Domain/Host Option Description Account Type SSH LocalAccount Type SSH Domain Account Level Defining the service names associated with TCP and UDP ports Exclude assets Defining ports or assets to exclude from a scanIf you want to Then Exclude ports Excluded Hosts box Scan policy Required Interpreting scan results in the Proventia Manager Running an ad hoc scan Monitoring the status of a scan Action Icon Description Exporting scan results from Proventia Manager Viewing the results of an ad hoc scanClick View/Manage Log Files Purging scan data from the database Field Description Enterprise Scanner User Guide Part 2. Scanning from the SiteProtector Console Enterprise Scanner User Guide Enterprise Scanner policies Policy inheritance with Enterprise Scanner policies Inheritance indicatorsInitially blank or unconfigured? General inheritance behavior Enterprise Scanner policies About this task Viewing asset or agent policies for Enterprise Scanner Select Network Enterprise Scanner from the Agent Type list Important Do not click Open Agent policy descriptions for Enterprise Scanner Contents of an agent policyAgent policies for Enterprise Scanner Policy inheritance with agent policies Network Locations policy Configuring routes for perspective Assigning perspective to a scanning interface Notification policy Event notification settings for Enterprise ScannerClick the Event Notification tab Click the Advanced Parameters tab Access policyConfiguring advanced parameters for event notification Account Purpose Configuring the management network interface Networking policy Configuring the scanning network interface Configuring scanning interface DNS settings Services policy If you want to Then Change the date and time for the agent Enable the network time protocol NTPTime policy Network Time Protocol section Asset policies for Enterprise Scanner Update Settings policyAsset policy descriptions for Enterprise Scanner Discovery policy Policy contentsScope Defining assets to discover Before you begin Assessment policy Displaying information about assessment checks Displaying assessment checks by groups Selecting assessment checks with filters Configuring common assessment settings Option Description Dynamically determine OS if SiteProtector Information is older than Try to confirm the access level Option Description Allowed account lockout Assessment Credentials policy Defining assessment credentials for a policy Option Description Account Type Windows Scan Control policy Cycle duration Option Description Job nameCycle start date Current cycle start date Scan Window policy Important consideration for multiple agents Defining when scanning is allowed Scan Exclusion policy Defining ports or assets to exclude from a scan Service definition Network Services policyDefault settings Policy inheritance Configuring a Network Services policy Ad Hoc Scan Control policy Configuration optionsRunning an ad hoc discovery scan with Enterprise Scanner Running an ad hoc assessment scan with Enterprise Scanner Click the Debug Settings tab Click Generate Support Data File Understanding scanning processes in SiteProtector What is perspective? Placing agents in the correct perspective Policy How to use Applies toDefining perspectives Perspectives in policies Network locations and perspectives Assets with unassigned criticality Scan jobs and related termsDefinitions Term Description Importance of tasks and subtasks Types of tasksScheduled and running scans Common management tasks Criticality and assessment tasks Priorities for running tasksTasks per type of scan Scan type Number of tasks Dynamic prioritization Stages of a scanning processTask prioritization Type of scan Reason for prioritization Process for a scanning cycle Stage Description Discovery cycle duration Size of scan windowsCalibration considerations Assessment cycle duration Achieving the right balance Enterprise Scanner User Guide Background scanning in SiteProtector Determining when background scans run Changing assessment and discovery policies How policies apply to ad hoc and background scansAsset policies and ad hoc scans Type of scan Description Scan Control policy Scan window and refresh cycle examples Checklist for background discovery scanning Background scanning checklists for Enterprise ScannerChecklist for background assessment scanning Enabling background scanning Defining when scanning is allowed Option Description Next cycle start date Procedure Type a series of individual IP addresses, a Defining network services Defining assessment credentials for a policy Option Description Account Type SSH Local Monitoring scans in SiteProtector Viewing your scan jobs Viewing discovery job results This part of the description Describes Finished Assessment Viewing assessment job resultsAssessment subtask explanation On ScanGroupName for hosts with Enterprise Scanner User Guide Managing scans in SiteProtector Impact of stopping scan jobs Command ImpactStopping and restarting scan jobs Impact of restarting scan jobs Suspending and enabling all background scans Steps to initiate a scan Registration and authenticationMinimum scanning requirements Type of scan Steps to initiate Inheritance Troubleshooting scanning behaviors for ad hoc scansScanning behaviors for ad hoc scans Priority Expected scanning behaviors for background scans Managing scans in SiteProtector Enterprise Scanner User Guide Interpreting scan results in SiteProtector Sources of Osid OS identification Osid certaintyWhat determines certainty? Certainty of Osid sources Exception How Osid is updated in Enterprise ScannerConditions for reassessing Osid Rules for updating Osid Vulnerability management options Setting up a Summary view for vulnerability managementSummary page for vulnerability management Portal Description Portal Description Creating custom views Viewing vulnerabilities by asset in Enterprise ScannerAbout vulnerability assessment Benefits Field descriptions Field Description Viewing vulnerabilities by detail in Enterprise Scanner Field Description Viewing vulnerabilities by object in Enterprise Scanner Field Vulnerability view by vulnerability name Field Description Report descriptions Running reports in the SiteProtector ConsoleTypes of assessment reports Report Description Report Description Procedure Enterprise Scanner User Guide Logs and alerts Two types of information Log files and alert notificationTwo types of log files Log size System logs System log descriptions Log descriptions Getting log status informationEnterprise Scanner ES logs Statistic Description Changing logging detail Delete a log file Click View/Manage Log Files Downloading Enterprise Scanner ES log filesDownload Delete Event information icons Alerts logRisk level icons Icon Description Click Generate new log file from Alerts Downloading and saving an Alerts logFile Description Finding specific events in the Alerts log Clearing the Alerts logClick Clear current Alerts from event log Enterprise Scanner User Guide Number If you want to Then Search the Alert log file by Alert IDSearch by Alert Id# box Enterprise Scanner User Guide Ticketing and remediation Vulnerability auto ticketing Ticketing and Enterprise ScannerTickets Custom categories Remediation process overview for Enterprise Scanner Scanning recommendations Remediation tasks for Enterprise Scanner Task overview Option Tab Description Task 6 Close the ticket Part 3. Maintenance Enterprise Scanner User Guide Performing routine maintenance Shutting down your Enterprise Scanner Removing an agent from SiteProtector Date of last system backup Types of backupsIf you restore a system before you make backups Options for backing up Enterprise Scanner Backing up configuration settings Making full system backups Click the Full Backup tab Choose an option Updating Enterprise Scanner Type of update Content Types of updatesUpdate locations Update location Description Rollbacks and backups Update optionsInstallation options with scheduled updates Updating options Configuring explicit-trust authentication with an XPU server Authentication method Advantages and Disadvantages Option Description Host or IP Configuring an Alternate Update locationSelect the Use Alternate Update Server check box Name Option Description Trust Level CA Certificate Configuring notification options for XPUs Configuring an Http ProxySelect Enable Proxy Click the Update Settings tab Scheduling a one-time firmware updateConfiguring automatic updates Option Description Check for updates daily or weekly Automatically Install Updates Option Description Check for updates at given intervalsOption Description Do Not Install Delayed Manually installing updates Viewing the status of the Enterprise Scanner agent Network interface status Proventia Manager HomeSystem status Model Protection status Updates statusHeader Viewing agent status in the SiteProtector Console Viewing agent status Module or process Description Troubleshooting option Troubleshooting the Enterprise Scanner sensorViewing the status of the CAM modules Module or process Description Troubleshooting option Part 4. Appendixes Enterprise Scanner User Guide 165 Enterprise Scanner User Guide Product handling information Product safety labels World trade safety information Laser compliance Laser safety informationProduct recycling and disposal Battery return program For Taiwan For the European Union For California Electronic emissions noticesFederal Communications Commission FCC Statement European Union EU Electromagnetic Compatibility Directive Canadian Department of Communications Compliance StatementEC Declaration of Conformity In German People’s Republic of China Class a Compliance Statement Japan Class a Compliance Statement Korean Class a Compliance Statement Enterprise Scanner User Guide Index 177 Reassessing 105 Rules Sources Scan job