User manual ZYXEL ZYWALL 2WE

[. . . ] ZyWALL 2/2WE Internet Security Gateway User's Guide Version 3. 60 March 2003 ZyWALL 2 and ZyWALL 2WE Copyright Copyright © 2003 by ZyXEL Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. All rights reserved. Disclaimer ZyXEL does not assume any liability arising out of the application or use of any products, or software described herein. Neither does it convey any license under its patent rights nor the patent rights of others. ZyXEL further reserves the right to make changes in any products described herein without notice. [. . . ] Enter the server name or IP address of the syslog server that will log the selected categories of logs. The log facility allows you to log the messages to different files in the syslog server. DESCRIPTION Mail Subject Send Log To Send Alerts To UNIX Syslog Active Syslog IP Address Log Facility Send Log Log Schedule This drop-down menu is used to configure the frequency of log messages being sent as E-mail: · Daily · Weekly · Hourly · When the Log is Full · None. If you select Weekly or Daily, specify a time of day when the E-mail should be sent. If you select Weekly, then also specify which day of the week the E-mail should be sent. If you select When Log is Full, an alert is sent when the log fills up. If you select None, no log messages are sent Centralized Logs 18-5 ZyWALL 2 and ZyWALL 2WE Table 18-2 Log Settings LABEL Day for Sending Log Time for Sending Log Log Send immediate alert Apply Reset DESCRIPTION Use the drop down list box to select which day of the week to send the logs. Enter the time of the day in 24-hour format (for example 23:00 equals 11:00 pm) to send the logs. Select the categories of alerts for which you want the ZyWALL to instantly e-mail alerts to the e-mail address specified in the Send Alerts To field. Click Reset to begin configuring this screen afresh. 18. 4 Reports Click the Logs and then the Reports tab to open the Reports screen. The Reports page displays which computers on the LAN send and receive the most traffic, what kinds of traffic are used the most and which web sites are visited the most often. Use the Reports screen to have the ZyWALL record and display the following network usage details: Web sites visited the most often Number of times the most visited web sites were visited The most-used protocols or service ports The amount of traffic for the most used protocols or service ports The LAN IP addresses to and/or from which the most traffic has been sent How much traffic has been sent to and from the LAN IP addresses to and/or from which the most traffic has been sent 18-6 Centralized Logs ZyWALL 2 and ZyWALL 2WE The web site hit count may not be 100% accurate because sometimes when an individual web page loads, it may contain references to other web sites that also get counted as hits. Many web sites include HTTP GET references to other web sites and the ZyWALL may count these as hits, thus the web hit count is not (yet) 100% accurate. Figure 18-3 Reports Enabling the ZyWALL's reporting function decreases the overall throughput by about 1 Mbps. Centralized Logs 18-7 ZyWALL 2 and ZyWALL 2WE Table 18-3 Reports LABEL Report Type DESCRIPTION Use the drop-down list box to select the type of reports to display. Web Site Hits displays the web sites that have been visited the most often from the LAN and how many times they have been visited. Protocol/Port displays the protocols or service ports that have been used the most and the amount of traffic for the most used protocols or service ports. LAN IP Address displays the LAN IP addresses to and /or from which the most traffic has been sent and how much traffic has been sent to and from those IP addresses. Start Collection / Stop Collection The button text shows Start Collection when the ZyWALL is not recording report data and Stop Collection when the ZyWALL is recording report data. The report also refreshes automatically when you close and reopen the screen. All of the recorded reports data is erased when you turn off the ZyWALL. 18. 4. 1 Web Site Hits In the Reports screen, select Web Site Hits from the Report Type drop-down list box to have the ZyWALL record and display which web sites have been visited the most often and how many times they have been visited. 18-8 Centralized Logs ZyWALL 2 and ZyWALL 2WE Figure 18-4 Web Site Hits Report Example Table 18-4 Web Site Hits Report LABEL Web Site DESCRIPTION This column lists the domain names of the web sites visited most often from computers on the LAN. The names are ranked by the number of visits to each web site and listed in descending order with the most visited web site listed first. The ZyWALL counts each page viewed in a web site as another hit on the web site. The count starts over at 0 if a web site passes the hit count limit (see Table 18-7). Hits 18. 4. 2 Protocol/Port In the Reports screen, select Protocol/Port from the Report Type drop-down list box to have the ZyWALL record and display which protocols or service ports have been used the most and the amount of traffic for the most used protocols or service ports. Centralized Logs 18-9 ZyWALL 2 and ZyWALL 2WE Figure 18-5 Protocol/Port Report Example Table 18-5 Protocol/Port Report LABEL Protocol/Port DESCRIPTION This column lists the protocols or service ports for which the most traffic has gone through the ZyWALL. The protocols or service ports are listed in descending order with the most used protocol or service port listed first. [. . . ] 13-4 Telnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4 TFTP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22-4 TFTP and FTP over WAN Will Not Work When. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23-5, 23-6 Time Zone. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ]