Example: Using Logs To Identify Infected Clients; Log Management - NETGEAR STM150 - ProSecure Web And Email Threat Management Appliance Reference Manual

ProSecure Web/Email Security Threat Management (STM) Appliance

Example: Using Logs to Identify Infected Clients

You can use the STM logs to help identify potentially infected clients on the network. For
example, clients that are generating abnormally high volumes of HTTP traffic might be
infected with spyware or a virus.
To identify infected clients that are sending spyware or a virus in outbound traffic, query the
STM spyware and virus logs and see if any of your internal IP addresses are the source of
spyware or a virus:
1. On the Log Query screen (see
type.
2. Select the start date and time from the drop-down lists.
3. Select the end date and time from the drop-down lists.
4. Next to Protocols, select the HTTP check box.
5. Click Search. After a while, the log displays onscreen.
6. Check if there are clients that are sending out suspicious volumes of data, especially to the
same destination IP address, on a regular basis.
If you find a client exhibiting this behavior, you can run a query on that client's HTTP traffic
activities to get more information. Do so by running the same HTTP traffic query and entering
the client IP address in the Client IP field.

Log Management

Generated logs take up space and resources on the STM internal disk. To ensure that there
is always sufficient space to save newer logs, the STM automatically deletes older logs
whenever the total log size reaches 50 percent of the allocated file size for each log type.
Automated log purging means that you do not need to constantly manage the size of the
STM logs and ensures that the latest malware incidents and traffic activities are always
recorded.
Note: The STM saves its logs every 5 minutes. If a power failure affects
the STM, logs that were created within the 5-minute period before
the power failure occurred are lost. Therefore, NETGEAR
recommends that you connect the STM to a syslog server to save
the logs externally.
For information about how to manually purge selected logs, see
Figure 111 on page 195), select Web traffic as the log
Chapter 6. Monitoring System Access and Performance
Clearing Logs on page 182.
| 199