Firewall Analyzer archives the logs received from each device, and zips them in regular intervals. The Archived Files page files that have been archived for each device, along with options to load the file to search, and delete the file.
Encrypting Archived Log files
Firewall Analyzer encrypts the log archive files to ensure the log data is secured for future forensic analysis and internal audits. Encryption makes the log data unreadable for human. It can be only decrypted by the Firewall Analyzer application.
Time stamping
The time stamping technique ensures that the archive data files are tamper proof. If there is a modification of file, this technique will reveal that the file has been tampered.
Loading Archived Files
The Archived Files page lists the files that have been zipped for each device, along with the archived time, file size, and archiving status.
The list contains the following columns:
Attribute Description
Device The name of the device for which the log file is archived.
File Name Start
Time The starting time of the log file archiving process. Archived
Time The completion time of the log file archiving process. File Size The file size of the archived logs.
Status
You can view the log file archiving status in this column. The status values are: All, Loaded, Loading, Not Loaded, Verified and Tampered. The
appropriate status value will be displayed, denoting the file archiving status. While loading Archived Files, if the archived file is tampered, it will not be loaded and marked as Tampered. If it is not tampered, it will be marked as
Verified.
Action You can carry out the following actions on the archived log files. The Actions
are: Load to Search and Report. The Actions are discussed below.
To load an archived file for search, click the Load to Search link against the device for which you need to see archived data. Once the file is fully loaded, you can search for data in the archives, and view specific information.
If you click Load to Search link, the Raw Log Search screen pops up. In the screen, on top you will find Device Name : <>, Defined Criteria : -, Searched From : Traffic
162 Zoho Corp.
You will find Edit Search Criteria link to edit and modify the search criteria.
On clicking the link, you will find Device Name pix501(non-editable), Search Time
From: <> To: <>. Next there will be two tabs: Search Traffic Logs and Search Security Logs. Choose one of the tabs as required. Define the search criteria in the Define Criteria section using the options Match all of the following, Match any of the following, select criteria and logical operator from the from the list and enter the
value in the text box. Use Add Criteria and Remove Criteria links to add more than one criterion. The search criteria for Security logs are: Protocol, Source, Destination,
User, Virus, Attack, Severity, URL, Status, Rule, VPN, Duration, Message. The search
criteria for Traffic logs are: Protocol, Source, Destination, User, Sent (in Bytes), Received
(in Bytes), Rule, VPN.
Then, you can view the raw logs Search Result Between [ YYYY-MM-DD HH:MM:SS
to YYYY-MM-DD HH:MM:SS ]. You can click View All Security Logs link to view all
the security logs.
Below that, you will find Formatted Logs, Raw Logs tabs. You can choose the tabs to view either formatted logs or raw logs. Click Configure Columns to select the
columns to be displayed for the formatted logs The columns are: All Columns, Device,
Host, User, Protocol, Destination, Date/Time, Virus/Attack, VPN, Severity, Rule
Number/ID, Status, URL, Duration, Description, StartTime. You can export the search
result as report in PDF or CSV format using Export as: PDF, CSV link.
Below that, the number of lines of logs displayed are indicated in the Showing : _ to _
of total _ logs field. The number lines displayed per page is indicated in the View per page : 5 [10] 20 25 50 75 100 250 500 field. Default value is 10. The default
columns displayed are: Host, Protocol, Destination, Date/Time, Status, Severity, and
Description. You can add or remove columns using Configure Columns icon given
above.
Click the icon against an archived file to delete it.
Once deleted, the archived data cannot be retrieved.
Viewing Data from Archived Files
Once the archive is fully loaded, click the Report link to search for specific data in the archive. In the popup window that opens, enter the criteria for the data, such as the firewall, user name, protocol, etc. You can enter a maximum of three criteria.
Choose the time interval for which you want to see the data that meets all the criteria. Click Generate Report to view the records that match the criteria that you have specified.
Changing Archive Settings
Click the Archive Settings link to change the archiving intervals or to disable
archiving. In the File Archive Settings popup window, uncheck the Enable Raw Logs
Archiving check box to disable file archiving.
Log files are archived at specific interval configured in this screen.
163 Zoho Corp.
The archiving options available are described below:
Attribute Default Value Description
File Creation
Interval 12 hours
The time interval after which a log file is created for each host from which event logs are collected.
Zip
Compression
Interval 24 hours
The time interval after which log files created for each host are zipped to save disk space.
Start Initial Compression
at _ Hrs _ Mins
The time at which log files created for each host are zipped for the first time to save disk space.
Retain logs
for Forever
You can retain the archive log data as per the compliance audit requirement or internal audit policy requirement. The options available are: Forever, 1
Year, 6 Months, 3 Months, 1 Month and 1 Week. Select the option that suits
your requirement.
Archive File
Encryption Disable
Firewall Analyzer comes with a feature to encrypt the archive data. To enable encryption of archive data, select the
Enable radio button and to disable,
select Disable radio button.
Time
Stamping Disable
Firewall Analyzer comes with a feature to timestamp the archive data. To enable time stamping of archive data, select the Enable radio button and to disable, select Disable radio button.
Change Raw Logs Archive Location <Firewall Analyzer Home>\server\default\archive directory
By default the Archive Location for the event logs and syslogs in Firewall Analyzer is <Firewall Analyzer
Home>\server\default\archive
directory, you can change this location by clicking the Edit link and providing the location as per your requirement.
Change Raw Logs Indexing Location <Firewall Analyzer Home>\server\default\indexes directory
By default the Index Location for the event logs and syslogs in Firewall Analyzer is <Firewall Analyzer
Home>\server\default\indexes
directory, you can change this location by clicking the Edit link and providing the location as per your requirement.
You can create instant zip file of the existing log files waiting to be archived. Click Zip
Now to create a zipped file with the currently available log files.
Click Save to save the archiving options, if you have changed them. Click Close to close the Archive Settings box.
Note: The currently active log files (i.e., logs not yet archived) will be stored in the
<Firewall Analyzer Home>\server\default\archive\localhost\hot directory. The archived log files (i.e., logs archived as according to the archive settings) will be stored in the <Firewall Analyzer Home>\server\default\archive\localhost\cold directory. The archived log files loaded into database for analysis will be stored in the Warm directory. The log files will be stored in the <Firewall Analyzer
Home>\server\default\archive\localhost\warm directory for 1 day and after that the log files will be purged.
164 Zoho Corp.