Viewing the Security Log

The Security Log records potentially threatening activity directed towards your computer, such as port scanning, or denial of service attacks. The Security Log is probably the most important log file in the Personal Firewall.

Viewing the Security Log

To view the Security Log on the Personal Firewall:

1. Click the down-arrow near the Logs icon on the toolbar, and then choose Security Log...
   
   OR
   
   Click Tools|Logs|Security Log...
   
   OR
   
   Right-click the Tool Bar icon, and then click Logs|Security Log...

You can also click the down-arrow next to the Logs icon to choose a different log. The most recently viewed log appears by default, but you can choose any of the logs to view.

2. From the View list, select Local View, the default setting, or Source View. You can select how you view local and remote IP addresses or names.

• If you select Local View from the View list, then Remote Host, Remote MAC, Local Host, and Local MAC information appear. The Remote Host and Remote MAC always represent the IP address and MAC address of the attempted attacker whereas Local Host address and Local MAC always represent your IP address and your MAC address. Your system is always considered the Local system.

• If you select Source View from the View list, then Remote Host, Remote MAC, Local Host and Local MAC information no longer appear. Instead, Source Host, Source MAC, Destination Host, and Destination MAC appear.

• If someone sends a message or attacks your system, then the originator's IP address and MAC address are listed in the Source Host and Source MAC columns whereas your IP number and your MAC address are listed in the Destination Host and Destination MAC because you are the recipient.

• If you send a message or attack someone else's system, then your IP address and MAC address are listed in the Source Host and Source MAC columns whereas the recipient's IP number and MAC address are listed in the Destination Host and Destination MAC sections.

3. Click a different log name if you wish to view a different log.

4. Click Refresh or press F5 to update the log that you are viewing.

Icons for the Security Log

When you open a Security Log, icons are displayed at the left side of the first column. These are graphical representations of the kind of attack logged on each line, and they provide an easy way to scan the Security Log for possible system errors.

Personal Firewall Security Log Parameters and Description

The log is a data sheet, where each row represents a logged event, and the columns display information regarding the event. The columns are:

Description and Data Fields for the Security Log

Below the rows of logged events are the Description and Data fields. When you click on an event row, the entire row is highlighted. A description of the event, such as "Somebody is scanning your computer, with 13 attempts", appears in the Description field.

Back Tracing Hack Attempts for the Security Log

1. From the Traffic Log file, click on the event you want to back trace so that the entire row is highlighted.

2. Either right-click the row and select Back Trace from the pop-up window or click the Action menu and select Back Trace.

The Personal Firewall traces the event information. The Back Trace Information window is displayed with a trace route log.

3. To view detailed information on the original IP address, click the Whois>> button at the bottom of the Back Trace Information window. A drop panel appears, displaying detailed information about the owner of the IP Address from which the security event originated.

4. Click the Whois<< button again to hide the information.

Filtering the Log Events by Severity in the Security Log

1. In the Security log, you can filter the events that you are viewing by the severity level of the attack.

2. In the Log Viewer, open the Filter menu.

3. Select Severity.
   
   The Severity window appears.

4. Place check marks in each box next to the severity level(s) that you want to view.
   You have the following options:

• Critical

• Major

• Minor

• Information

You can view more than one type of event at once. The Log Viewer is automatically reloaded.

Filtering the Log Events by Date in the Security Log

To filter the log events by date:

1. Click the Filter menu in the Log Viewer window.

2. Select which events you want to view from the list:

3. The log displays the requested events.