Log Management

OfficeScan keeps comprehensive logs about security risk detections, events, and updates. Use these logs to assess your organization's protection policies and to identify OfficeScan agents at a higher risk of infection or attack. Also use these logs to check agent-server connection and verify that component updates were successful.

OfficeScan also uses a central time verification mechanism to ensure time consistency between OfficeScan server and agents. This prevents log inconsistencies caused by time zones, Daylight Saving Time, and time differences, which can cause confusion during log analysis.

The OfficeScan server receives the following logs from OfficeScan agents:

• Viewing Virus/Malware Logs

• Viewing Spyware/Grayware Logs

• Viewing Spyware/Grayware Restore Logs

• Viewing Firewall Logs

• Viewing Web Reputation Logs

• Viewing Suspicious Connection Logs

• Viewing Suspicious File Logs

• Viewing C&C Callback Logs

• Viewing Behavior Monitoring Logs

• Viewing Device Control Logs

• Viewing Scan Operation Logs

• Viewing Data Loss Prevention Logs

• Viewing OfficeScan Agent Update Logs

• Viewing Connection Verification Logs

The OfficeScan server generates the following logs:

• OfficeScan Server Update Logs

• System Event Logs

The following logs are also available on the OfficeScan server and OfficeScan agents:

• Windows Event Logs

• OfficeScan Server Logs

• OfficeScan Agent Logs