Reporting Logs

Logs > Log Settings | Reporting Logs

You can keep Report Logs either on the hard drive, in the database, or both. However,  Trend Micro recommends that you have IWSVA write the logs to the database only.

With the exception of quarantine logs, the default IWSVA log location is:

/var/iwss/log

• Note: /etc/iscan/log is a symbolic link to /var/iwss/log.

• Application Control log—protocols allowed and blocked

• Performance log—threads, CPU usage

• System Event log—product registration changes, system/service maintenance, etc.

• URL access log—access URLs

• URL blocking log—includes spyware, phish-related URLs, HTTP Inspection, and URL Blocking rules

• Virus log—includes viruses, worms, Trojans, etc.

Options

• Gather performance data—Includes IWSVA server name, event time and date, and performance metrics such as CPU utilization for the HTTPS, HTTP and FTP services, total responses processed by HTTPS, HTTP and FTP services, threads active at the log time. MORE>>

  • Logging interval: Specify how often you want IWSVA to measure performance status (from 1 to 2 minutes)

   

• Note: Gathering performance data can add noticeable overhead to IWSVA operations — the system may slow.

• Log HTTP/HTTPS/FTP access events—Includes all client FTP, HTTP, and HTTPS requests; IWSVA server name, time and date, client identification, IP address of the remote Web or FTP server, and the location and file name of whatever data was downloaded to the client machine (Web page elements as well as file downloads). MORE>>

  • Logging interval: Specify how often you want IWSVA to record access events (from 1 to 9 minutes).

  In addition, you can select one or all of the following options:

  • Log user’s visit along with all downloaded files and objects (verbose)

  • This verbose logging option captures all information for the user’s visit. It logs the initial connection to the site as well as all objects on the web pages downloaded. This option requires extensive disk space use and should only be enabled if your logging requirements need this type of extensive logging. Enabling this option can also reduce the performance of the system if fast disk drive subsystems are not available.

  • Log user’s visit along with any downloaded files and objects that are above the size KB.

  • This logging option captures the user’s visit, or connection, to the web site and all associated files or objects greater than the size specified. This option allows you to capture information about where each user has visited and allows you to reduce the amount of logging events collected by fine-tuning the size parameter. The larger the size parameter, the less detailed file and object information is collected from the downloaded pages. This option provides the best trade-off between performance, size of logs, and information collected.

  • Log files and objects downloaded that are at least XXXX KB

  • This logging option only captures file and objects downloaded that are larger than the specified size parameter. This option allows you to eliminate the collection of user connection information to the web site and is used to log events for web site objects equal to or greater than the specified size.  This option can dramatically lower the amount of disk space needed for logging and should be used only when large object logging is required without user connection information.

   

• Number of days to store logs in database—Use this option to "auto-delete" old logs as new ones are added. Default is 30 days.

• Database log update interval—Enter the frequency, in minutes, that you want IWSVA write new logs to the database (if there are no new logs since the last database write, nothing will be updated).

• Write logs to—By default, IWSVA writes all logs to the database.

• Database only—Select this option if you do not want IWSVA to write logs to the local hard drive.

• Database and log files—Select this option to have IWSVA store logs in the directory specified above, and in the database.

• Text only—Select this option if you want to reduce the size of the database due to large log files and if you want to export the log to third-party software to create reports.
  
  If you choose the text-only option, then neither reports nor logs can be viewed from within IWSVA.  In this case, you can only review the logs by directly opening the generated text files.

• Note: There is no automatic "clean up" of report logs written to the hard drive. You will need to delete old logs manually.

See also

• Export Logs and Reports to Excel

• How are Log Files Named?

• Important Log Notes