User's Manual

6-1
v1.0, September 2009
Chapter 6
Monitoring System Access and Performance
This chapter describes the system monitoring features of the STM. You can be alerted to important
events such as attacks and login failures. You can also view the system status and real-time traffic
and security information. In addition, the diagnostics utilities are described.
This chapter contains the following sections:
• “Configuring Logging, Alerts, and Event Notifications on this page.
• “Monitoring Real-Time Traffic, Security, Statistics, and Web Usage” on page 6-11.
• “Viewing System Status” on page 6-19.
• “Querying Logs and Generating Reports” on page 6-22.
• “Viewing and Managing the Quarantine Files” on page 6-33.
• “Using Diagnostics Utilities” on page 6-40.
Configuring Logging, Alerts, and Event Notifications
You can configure the STM to e-mail logs and alerts to a specified e-mail address. For example,
the STM can e-mail security-related events such as malware incidents, infected clients, and failed
authentications. By default, the STM logs content filtering events such as attempts to access
blocked sites and URLs, unwanted e-mail content, spam attempts, and many other types of events.
To receive the logs in an e-mail message, the STM’s notification server must be configured and
e-mail notification must be enabled. If the notification server is not configured or e-mail
notification is disabled, you can still query the logs and generate log reports to view on the Web
Management Interface screen or to save in CSV format.
For more information about logs, see “Querying Logs and Generating Reports” on page 6-22.
Note: All log and report functions that are part of the Logs & Reports configuration
menu and some of the functions that are part of the Diagnostics configuration
menu require that you configure the e-mail notification server—see “Configuring
the E-mail Notification Server” on page 6-2.