Configuring Tracking in a policy Rule

To configure tracking in a rule:

1. Right-click in the Track column.
2. Select a tracking option.
3. Install the policy.

Tracking Options

Select these options in the Track column of a rule:

• None - Do not generate a log.
• Log - This is the default Track option. It shows all the information that the Security Gateway used to match the connection. At a minimum, this is the Source, Destination, Source Port, and Destination Port. If there is a match on a rule that specifies an application, a session log shows the application name (for example, Dropbox). If there is a match on a rule that specifies a Data Type, the session log shows information about the files, and the contents of the files.
• Accounting - Select this to update the log at 10 minutes intervals, to show how much data has passed in the connection: Upload bytes, Download bytes, and browse time.

Note - When upgrading from R77.xx or from R80 to R80.20, there are changes to the names of the options in the Track column. To learn more see sk116580.

Advanced Track options

Detailed Log and Extended Log are only available if one or more of these Blades are enabled on the Layer: Applications & URL Filtering, Content Awareness, or Mobile Access.

• Detailed Log - Equivalent to the Log option, but also shows the application that matched the connections, even if the rule does not specify an application. Best Practice - Use for a cleanup rule (Any/Internet/Accept) of an Applications and URL Filtering Policy Layer that was upgraded from an R77 Application Control Rule Base.
• Extended Log - Equivalent to the Detailed option, but also shows a full list of URLs and files in the connection or the session. The URLs and files show in the lower pane of the Logs view.

Log Generation

• per Connection - Select this to show a different log for each connection in the session. This is the default for rules in a Layer with only Firewall enabled. These are basic firewall logs.
• per Session - Select this to generate one log for all the connections in the same session. This is the default for rules in a Layer with Applications and URL Filtering or Content Awareness enabled. These are basic Application Control logs.
  • Enable Firewall Sessions - If per session is enabled, a session log will be generated. If you want to log only sessions with applications (without the firewall session) then disable Enable Firewall Sessions. Note - this is only for layers with application control.

Alert:

For each alert option, you can define a script in Menu > Global Properties > Log and Alert > Alerts.

• None - Do not generate an alert.
• Alert - Generate a log and run a command, such as: Show a popup window, send an email alert or an SNMP trap alert, or run a user-defined script as defined in the Global Properties.
• SNMP - Send an SNMP alert to the SNMP GUI, or run the script defined in the Global Properties.
• Mail - Send an email to the administrator, or run the mail alert script defined in the Global Properties.
• User Defined Alert - Send one of three possible customized alerts. The alerts are defined by the scripts specified in the Global Properties.