Netgear STM150 User Manual download pdf (Page 86)

ProSecure Web/Email Security Threat Management Appliance STM150 Reference Manual

5-10 Monitoring System Performance

v1.1, March 2009

5. In Select logs to send, select the check boxes for the log types that you want the STM150 to

send via email.

6. In Format, click either Plain Text or CSV. If you want the STM150 to compress the log file

before sending, select the Zip the logs to save space check box.

7. In Size, select the Split log size to: box and enter a file size (in Megabytes) to split the logs

into fragments of the file size entered.

8. Click Apply.

The STM150 will email the selected logs based on the schedule you specified. If you want the

STM150 to email available logs immediately, click the Send Now button (located next to the

Send to text box).

Using Logs to Identify Infected Clients

In addition to identifying malware that has been detected on the network, you can also use the

STM150 logs to help identify potentially infected clients on the network. Clients that are sending

out abnormally high volumes of HTTP traffic, for example, indicate possible spyware infection.

To identify infected clients that are sending spyware in the outbound traffic, query the STM150

malware logs and see if any of your internal IP addresses are the source of spyware detected at the

Internet gateway. Clients generating abnormally high amounts of HTTP traffic may also be

infected by spyware or other malware.

To query log data that will show this information.

1. On the Log Query page, select Traffic as the log type.

2. Check the HTTP check box, and then run the query.

3. On the traffic logs result page, click the Size (Byte) column heading to sort the results in a

descending order.

4. Check if there are clients that are sending out suspicious volumes of data, especially to the

same destination IP address, on a regular basis.

If you find a client exhibiting this behavior, you can run a query on that client’s HTTP traffic

activities to get more information. Do this by running the same HTTP traffic query and entering

the client IP address in the Source IP text box.

Log Management

Generated logs take up space and resources on the STM150 disk. To ensure that there is always

sufficient space to save newer logs, the STM150 automatically deletes older logs whenever the

total log size reaches 50% of the allocated file size for each log type.

1 2 ... 81 82 83 84 85 86 87 88 89 90 91 ... 94 95

No comments

Netgear STM150 User Manual Page 86