Log

The Geo IP & Botnet Filter > Log page lists information detected by the Geo IP & Botnet Filter:

•
Location information that identifies the geographical location of the source IP for each event log message generated by Geo IP. Location information is also displayed on applicable SRA log and status pages. If Geo IP Logging is disabled, this column contains a Not Logged icon. If a location or country flag is not available, this column contains an Unknown icon.

Mousing over an icon in the Location field displays the City (if available), Region, and Country of the source IP.

•
Traffic detected by the Botnet Filter. Traffic from each IP is logged only once for each second, no matter if it’s denied or allowed.

Several functions can be perform on this page, including a flexible search mechanism and the ability to export the log to a file or email it. Following are instruction for using these functions.

•
Clicking on a log entry displays more information about the event, if available.
•
Click any of the headings to sort the log messages alphabetically by heading.

Searching the Log

Search for a value contained in a specific column of the log table or search for log entries that do not contain the specified value.

To view and search the log:
1
On the Geo IP & Botnet Filter > Log page, type the value to search for into the Search field. The search value is case sensitive.
2
Select the column in which to search from the drop-down list to the right of the Search field.
3
Do one of the following:
•
To start searching for log entries containing the search value, click Search.
•
To start searching for log entries that do not contain the search value, click Exclude.
•
To clear the Search field and display the first page of log entries, click Reset.

Controlling the Log Pagination

To adjust the number of entries on the log page and display a different range of entries:
1
On the Geo IP & Botnet Filter > Log page, enter the number of log entries that you want on each page into the Items per Page field. The Log page changes to show the new number of entries.
2
To view the log entries beginning at a certain number, type the starting number into the Item field and press Enter on your keyboard.
3
To view the first page of log entries, click the left-most button in the arrow control pad.
4
To view the previous page of log entries, click the left arrow in the arrow control pad.
5
To view the next page of log entries, click the right arrow in the arrow control pad.
6
To view the last page of log entries, click the right-most button in the arrow control pad.

Exporting and Emailing Log Files

You can export the current contents of the log to a file, or email the log contents by using the buttons in the top right corner of the Geo IP & Botnet Filter > Log page.

Exported files are saved with a .wri file name extension, and open with WordPad, by default.

Emailed files are automatically sent to the address configured on the Log > Settings page of the SRA management interface. If no address is configured, the Status line at the bottom of the browser will display an error message when you click the E-Mail Log button.

To export or email the log:
1
To export the log contents, click the Export button in the top right corner of the Geo IP & Botnet Filter > Log page. The File Download dialog box is displayed.

2
In the File Download dialog box, do one of the following:
•
To open the file, click Open.
•
To save the file, click Save, then browse to the folder where you want to save the file and click Save.
3
To email the log contents, click the E-Mail Log button in the top right corner of the Geo IP & Botnet Filter > Log page. The log contents are emailed to the address specified in the Log > Settings page.

Clearing the Log

You can remove all entries from the log on the Geo IP & Botnet Filter > Log page. The entries on the page are removed, and any attempt to export or email the log file while it is still empty will cause a confirmation dialog box to display.

To clear the log, perform the following:
1
On the top right corner of the Geo IP & Botnet Filter > Log page, click Clear.
2
Click OK in the confirmation dialog box.