Example: Use The Logs To Identify Infected Clients; Log Management - NETGEAR UTM5 Reference Manual

Example: Use the Logs to Identify Infected Clients

You can use the UTM logs to help identify potentially infected clients on the network. For
example, clients that are generating abnormally high volumes of HTTP traffic might be
infected with spyware or other malware threats.
To identify infected clients that are sending spyware in outbound traffic, query the UTM
malware logs and see if any of your internal IP addresses are the source of spyware.

To identify infected clients:
1. On the Log Query screen (see
2. Select the start date and time from the drop-down lists.
3. Select the end date and time from the drop-down lists.
4. Next to Protocols, select the HTTP check box.
5. Click Search. After a few minutes, the log displays onscreen.
6. Check if there are clients that are sending out suspicious volumes of data, especially to the
same destination IP address, on a regular basis.
If you find a client exhibiting this behavior, you can run a query on that client's HTTP traffic
activities to get more information. Do this by running the same HTTP traffic query and
entering the client IP address in the Client IP field.

Log Management

Generated logs take up space and resources on the UTM internal disk. To ensure that there
is always sufficient space to save newer logs, the UTM automatically deletes older logs
whenever the total log size reaches 50 percent of the allocated file size for each log type.
Automated log purging means that you do not need to constantly manage the size of the
UTM logs and ensures that the latest malware threats and traffic activities are always
recorded.
Note: After the UTM reboots, traffic logs are lost. Therefore, NETGEAR
recommends that you connect the UTM to a syslog server to save
the traffic logs externally. Other logs (that is, nontraffic logs) are
automatically backed up on the UTM every 15 minutes. However, if
a power failure affects the UTM, logs that were created within this
15-minute period are lost.
For information about how to manually purge selected logs, see
System, Email, and Syslog Logs
ProSecure Unified Threat Management (UTM) Appliance
Figure 288
on page 439.
Monitoring System Access and Performance
on page 480), select Traffic as the log type.
Configure and Activate
484