Analyze log, alert, and audit entries
The Log Analysis view provides various tools to analyze logs, alerts, and audit entries.
For more details about the product and how to configure features, click Help or press F1.
Steps
- Select Logs.
- Select Analyze.
Log Analysis view
Use this view to analyze log data.
Option | Definition |
---|---|
Toolbar | |
Stop | Aborts the running query. |
Save | Saves a snapshot of entries. |
Columns |
|
Aggregate |
|
Statistics menu | Shows the monitored data as charts. Select one of the predefined statistical items or select Select to create a custom statistical item. |
Visualizations |
|
Option | Definition |
---|---|
Log entry table — Several menu options are available when you select a log entry and right-click. | |
Whois | Looks up the selected IP address in the online Whois database. |
New Host | Opens the Host Properties dialog box that allows you to create a Host element using the IP address in the log entry. |
Details | Shows the Details view of the selected record. |
Logs by Record | Returns from the Log Analysis view to the Logs view. |
Tools | Copy — Copies the entry details to the clipboard. |
View Rule | Views the rule that generated the log entry (if applicable). |
Add Filter: <field name> | Adds the item and its value as a new filter row in the Query pane. |
Filter: <field name> | Opens the Filter Properties dialog box that allows you to create a Filter element. |
Option | Definition |
---|---|
Query pane — Allows you to filter the records displayed in the Logs view. | |
Query drop-down list | Select a Log Data Context to limit the type of log data that it displayed. To select a Log Data Context that is not in the list, select Select. To create a Log Data Context, select New. |
New | Adds a filter to the Filter list. |
Save | Saves the changes. |
Time limit drop-down list |
|
Open Calendar | Select the dates from where you want to query data. |
Apply | Retains and applies your changes. |
Option | Definition |
---|---|
Fields pane | |
Category drop-down list |
|
Field | The name of the field. |
Value | The value in the field. |