Logs

What can I do here?

Use this window to see logs from all Security Gateways. The logs are stored on the Security Management Server and Log Servers.

Getting Here - Logs & Monitor > Open Log View

Showing Query Results

Query results can include tens of thousands of log records. To prevent performance degradation, SmartConsole only shows the first set of results in the Results pane. Typically, this is a set of 50 results.

Scroll down to show more results. As you scroll down, SmartConsole extracts more records from the log index on the Security Management Server or Log Server, and adds them to the results set. See the number of results above the Results pane.

For example, on the first run of a query, you can see the first 50 results out of over 150,000 results. When you scroll down, you can see the first 100 results out of over 150,000.

Customizing the Results Pane

By default, SmartConsole shows a predefined set of columns and information based on the selected blade in your query. This is known as the Column Profile. For example:

• The DLP column profile includes columns for: Blade, Type, DLP Incident UID, and severity.
• The Threat Prevention column profile includes columns for: Origin, Action, Severity, and Source User.

If no blade is specified, a column profile is assigned based on the blade that occurs most frequently in the query results. This is called Automatic Profile Selection, and is enabled by default.

The Column Profile defines which columns show in the Results Pane and in which sequence. You can change the Column Profile as necessary for your environment.

To use the default Column Profile assignments:

• Right-click a column heading and select Columns Profile > Automatic Profile Selection.

To manually assign Column Profile assignments by default:

• Right-click a column heading and select Columns Profile > Manual Profile Selection.

To manually assign a different Column Profile:

1. Right-click a column heading and select Columns Profile.
2. Select a Column Profile from the options menu.

To change a Column Profile:

1. Right-click a column heading and select Columns Profile > Edit Profile.
2. In the Show Fields window, select a Column Profile to change.
3. Select fields to add from the Available Fields column.
4. Click Add.
5. Select fields to remove from the Selected Fields column.
6. Click Remove.
7. Select a field in the Selected Fields.
8. Click Move Up or Move Down to change its position in the Results Pane.
9. Double-click the Width column to change the default column width for the selected field.
10. To change the column width, drag the right column border in the Results Pane.
11. To save the column width, right-click and select Save Profile.

    The column is applicable to future sessions.

Log Analysis

SmartConsole lets you transform log data into security intelligence. Search results are fast and immediately show the log records you need. The Security Gateways send logs to the Log Servers on the Security Management Server or on a dedicated server. Logs show on the SmartConsole Logs & Monitor Logs tab. You can:

• Quickly search through logs with simple Google-like searches.
• Select from many predefined search queries to find the applicable logs.
• Create your own queries using a powerful query language.
• Monitor logs from administrator activity and connections in real-time.