Getting log status information | IBM Partner Pavilion 2.3 specification

Getting log status information

Use the Log Status page in the Proventia Manager to view usage information for alert event log statistics.

Navigation: To access the Log Status page, click Status → Logs in the navigation pane.

This page provides usage information for the following alert event log statistics:

Table 35. Alert event log statistics

Statistic	Description

Number of Logged Alerts	The number of alert events that have been
	written to the log file.

Percentage Full	The percentage of allocated space that
	contains alert event log entries.

Time of Last Alert	The date and time the last alert was written
	to the log file.

Enterprise Scanner (ES) logs

Use the ES Logs page in the Proventia Manager to view details about the scanning processes controlled by the Enterprise Scanner agent.

Enterprise Scanner (ES) logs provide two types of information:

Table 36. Information provided by Enterprise Scanner (ES) logs

Type of information	Description

Alerts (notifications)	An informational message sent from an
	agent; triggered when an event meets set
	criteria.

Logs	Traces the execution logic of the agent.

Log descriptions

The following table describes the Enterprise Scanner (ES) logs:

Table 37. Enterprise Scanner (ES) log descriptions

Log name (file_name)	Description

Trace Log (CrmTrace.log)	Handles interaction with SiteProtector
	Sensor Services and Event Services
	components. The log file includes
	information about the following processes:
	v Interaction with the Sensor and Event
		services
	v	ESM startup
	v	Other operational details
	This log file is created under the file name
	\tmp\issCSFTrace.tmp; the log file name is
	changed about half way through the
	initialization of the CRM.

124Enterprise Scanner: User Guide

Image 132

IBM Partner Pavilion 2.3 manual Getting log status information, Enterprise Scanner ES logs, Log descriptions

Contents

User Guide Version Copyright statement Trademarks and Disclaimer Iv Enterprise Scanner User Guide Contents Part 3. Maintenance Part 4. Appendixes 163 About this book AudienceTopics Related publications Technical support contacts Part 1. Scanning from the Proventia Manager Chapters Enterprise Scanner User Guide Section a Network configuration Section B Policy configurationAd hoc scanning in the Proventia Manager Section a Network configuration Configuring the management network interfaceProcedure About this task Configuring the scanning network interface Option Description InterfaceMaximum IPs per discovery subtask Maximum assets per assessment subtask Configuring scanning interface DNS settings Configuring routes for perspective Assigning perspective to a scanning interfaceOption Description Perspective Destination Network Section B Policy configuration Defining assets for a discovery scanBefore you begin Option Metric Description Displaying assessment checks by groups If you want to Then Clear groupingsClick Clear Groupings Create groupings interactively Displaying information about assessment checks Selecting assessment checks with filters Click the Common Settings tab Option Description Discover and report TCP servicesDiscover and report UDP services Option Description Ports to scan with generic TCP checks Default Option Description Ports to scan with generic UDP checksOption Description Dynamically determine OS if previously Obtained information is older than Option Description Verify account access level before using Local group membership to verify accessAccess domain controllers to verify access Access level Lockout Allowed is enabled. When Option Description Allowed account lockoutTemporary lockout allowed Enterprise Maximum Allowable Lockout Duration Defining assessment credentials for a policy Option Description Account Type SSH Local Account Type SSH DomainDomain/Host Account Level Defining the service names associated with TCP and UDP ports Defining ports or assets to exclude from a scan If you want to Then Exclude portsExclude assets Excluded Hosts box Scan policy Required Interpreting scan results in the Proventia Manager Running an ad hoc scan Monitoring the status of a scan Action Icon Description Viewing the results of an ad hoc scan Exporting scan results from Proventia ManagerClick View/Manage Log Files Purging scan data from the database Field Description Enterprise Scanner User Guide Part 2. Scanning from the SiteProtector Console Enterprise Scanner User Guide Enterprise Scanner policies Inheritance indicators Initially blank or unconfigured?Policy inheritance with Enterprise Scanner policies General inheritance behavior Enterprise Scanner policies About this task Viewing asset or agent policies for Enterprise Scanner Select Network Enterprise Scanner from the Agent Type list Important Do not click Open Contents of an agent policy Agent policies for Enterprise ScannerAgent policy descriptions for Enterprise Scanner Policy inheritance with agent policies Network Locations policy Configuring routes for perspective Assigning perspective to a scanning interface Event notification settings for Enterprise Scanner Notification policyClick the Event Notification tab Access policy Configuring advanced parameters for event notificationClick the Advanced Parameters tab Account Purpose Configuring the management network interface Networking policy Configuring the scanning network interface Configuring scanning interface DNS settings Services policy Enable the network time protocol NTP Time policyIf you want to Then Change the date and time for the agent Network Time Protocol section Update Settings policy Asset policies for Enterprise ScannerAsset policy descriptions for Enterprise Scanner Policy contents Discovery policyScope Defining assets to discover Before you begin Assessment policy Displaying information about assessment checks Displaying assessment checks by groups Selecting assessment checks with filters Configuring common assessment settings Option Description Dynamically determine OS if SiteProtector Information is older than Try to confirm the access level Option Description Allowed account lockout Assessment Credentials policy Defining assessment credentials for a policy Option Description Account Type Windows Scan Control policy Option Description Job name Cycle start dateCycle duration Current cycle start date Scan Window policy Important consideration for multiple agents Defining when scanning is allowed Scan Exclusion policy Defining ports or assets to exclude from a scan Network Services policy Default settingsService definition Policy inheritance Configuring a Network Services policy Configuration options Ad Hoc Scan Control policyRunning an ad hoc discovery scan with Enterprise Scanner Running an ad hoc assessment scan with Enterprise Scanner Click the Debug Settings tab Click Generate Support Data File Understanding scanning processes in SiteProtector What is perspective? Policy How to use Applies to Defining perspectivesPlacing agents in the correct perspective Perspectives in policies Network locations and perspectives Scan jobs and related terms DefinitionsAssets with unassigned criticality Term Description Types of tasks Scheduled and running scansImportance of tasks and subtasks Common management tasks Priorities for running tasks Tasks per type of scanCriticality and assessment tasks Scan type Number of tasks Stages of a scanning process Task prioritizationDynamic prioritization Type of scan Reason for prioritization Process for a scanning cycle Stage Description Size of scan windows Calibration considerationsDiscovery cycle duration Assessment cycle duration Achieving the right balance Enterprise Scanner User Guide Background scanning in SiteProtector Determining when background scans run How policies apply to ad hoc and background scans Asset policies and ad hoc scansChanging assessment and discovery policies Type of scan Description Scan Control policy Scan window and refresh cycle examples Background scanning checklists for Enterprise Scanner Checklist for background discovery scanningChecklist for background assessment scanning Enabling background scanning Defining when scanning is allowed Option Description Next cycle start date Procedure Type a series of individual IP addresses, a Defining network services Defining assessment credentials for a policy Option Description Account Type SSH Local Monitoring scans in SiteProtector Viewing your scan jobs Viewing discovery job results Viewing assessment job results Assessment subtask explanationThis part of the description Describes Finished Assessment On ScanGroupName for hosts with Enterprise Scanner User Guide Managing scans in SiteProtector Command Impact Stopping and restarting scan jobsImpact of stopping scan jobs Impact of restarting scan jobs Suspending and enabling all background scans Registration and authentication Minimum scanning requirementsSteps to initiate a scan Type of scan Steps to initiate Troubleshooting scanning behaviors for ad hoc scans Scanning behaviors for ad hoc scansInheritance Priority Expected scanning behaviors for background scans Managing scans in SiteProtector Enterprise Scanner User Guide Interpreting scan results in SiteProtector OS identification Osid certainty What determines certainty?Sources of Osid Certainty of Osid sources How Osid is updated in Enterprise Scanner Conditions for reassessing OsidException Rules for updating Osid Setting up a Summary view for vulnerability management Summary page for vulnerability managementVulnerability management options Portal Description Portal Description Viewing vulnerabilities by asset in Enterprise Scanner About vulnerability assessmentCreating custom views Benefits Field descriptions Field Description Viewing vulnerabilities by detail in Enterprise Scanner Field Description Viewing vulnerabilities by object in Enterprise Scanner Field Vulnerability view by vulnerability name Field Description Running reports in the SiteProtector Console Types of assessment reportsReport descriptions Report Description Report Description Procedure Enterprise Scanner User Guide Logs and alerts Log files and alert notification Two types of log filesTwo types of information Log size System logs System log descriptions Getting log status information Enterprise Scanner ES logsLog descriptions Statistic Description Changing logging detail Downloading Enterprise Scanner ES log files DownloadDelete a log file Click View/Manage Log Files Delete Alerts log Risk level iconsEvent information icons Icon Description Downloading and saving an Alerts log Click Generate new log file from AlertsFile Description Clearing the Alerts log Finding specific events in the Alerts logClick Clear current Alerts from event log Enterprise Scanner User Guide If you want to Then Search the Alert log file by Alert ID NumberSearch by Alert Id# box Enterprise Scanner User Guide Ticketing and remediation Ticketing and Enterprise Scanner TicketsVulnerability auto ticketing Custom categories Remediation process overview for Enterprise Scanner Scanning recommendations Remediation tasks for Enterprise Scanner Task overview Option Tab Description Task 6 Close the ticket Part 3. Maintenance Enterprise Scanner User Guide Performing routine maintenance Shutting down your Enterprise Scanner Removing an agent from SiteProtector Types of backups If you restore a system before you make backupsDate of last system backup Options for backing up Enterprise Scanner Backing up configuration settings Making full system backups Click the Full Backup tab Choose an option Updating Enterprise Scanner Types of updates Update locationsType of update Content Update location Description Update options Installation options with scheduled updatesRollbacks and backups Updating options Configuring explicit-trust authentication with an XPU server Authentication method Advantages and Disadvantages Configuring an Alternate Update location Select the Use Alternate Update Server check boxOption Description Host or IP Name Option Description Trust Level CA Certificate Configuring an Http Proxy Configuring notification options for XPUsSelect Enable Proxy Scheduling a one-time firmware update Configuring automatic updatesClick the Update Settings tab Option Description Check for updates daily or weekly Option Description Check for updates at given intervals Option Description Do Not InstallAutomatically Install Updates Delayed Manually installing updates Viewing the status of the Enterprise Scanner agent Proventia Manager Home System statusNetwork interface status Model Updates status Protection statusHeader Viewing agent status in the SiteProtector Console Viewing agent status Troubleshooting the Enterprise Scanner sensor Module or process Description Troubleshooting optionViewing the status of the CAM modules Module or process Description Troubleshooting option Part 4. Appendixes Enterprise Scanner User Guide 165 Enterprise Scanner User Guide Product handling information Product safety labels World trade safety information Laser safety information Laser complianceProduct recycling and disposal Battery return program For Taiwan For the European Union Electronic emissions notices For CaliforniaFederal Communications Commission FCC Statement Canadian Department of Communications Compliance Statement European Union EU Electromagnetic Compatibility DirectiveEC Declaration of Conformity In German People’s Republic of China Class a Compliance Statement Japan Class a Compliance Statement Korean Class a Compliance Statement Enterprise Scanner User Guide Index 177 Reassessing 105 Rules Sources Scan job