Export (0) Print
Expand All
This topic has not yet been rated - Rate this topic

Chapter 5: Using the Incidents Log

 

Applies to: Forefront Security for Office Communications Server

Topic Last Modified: 2009-02-04

Forefront Security for Office Communications Server provides a variety of reports designed to help administrators analyze its state and performance. These include the Incidents Log, a database (Incidents.mdb) that stores a record of all viruses, keywords, files, or file types caught either by a scan job or a filter.

noteNote:
For more information about the Incidents Log and maintaining the database, refer to the Reporting and statistics section in the Forefront Security for Office Communications Server User Guide.

In this chapter

The Incidents Log stores the following information for each incident:

 

Field Description

Time

Date and time of the incident.

State

Action taken by Forefront Security for Office Communications Server.

Folder

Name of the folder where the file was found.

File

Name of the virus, message, or file attachment that triggered the incident.

Incident

The type and name of the incident detected, such as a virus or filter match.

Sender Address

The e-mail address of the person who sent the infected or filtered message.

Recipient Addresses

The e-mail addresses of the recipients of the infected or filtered message.

To view the Incidents Log:
  1. Under REPORT, click Incidents.

    6ddd3aa6-acc0-4949-abe8-801ffa242afd
  2. Scroll right to see all the data for each incident.

  • In the Incidents work pane, click a column heading (Time, State, and so on) to sort data based on that column.
    Forefront Security for Office Communications Server automatically sorts the data.

A filter affects only what you view on the screen; it does not modify the contents of the database.

To filter the Incidents Log:
  1. In the Incidents work pane, check the Filtering box.

    d230ead8-14e7-4a41-a26a-02d315486aaa
  2. Select a value for Field from the list.

  3. Choose the filter criteria to the right.

    For example, you may want to show only those incidents whose Time is today between 9am and 12pm.

  4. Click Save to apply the filter.

    noteNote:
    To remove the filter and restore the full Incidents Log, clear the Filtering box, and then click Save.

You can export Incidents data to a formatted text file or a delimited text file (for use in a spreadsheet). If you are using a filter on the Incidents Log, Forefront Security for Office Communications Server exports only the data set you have filtered.

To export Incidents Log data to a file:
  1. In the Incidents work pane, click Export.

  2. In the Save box, select a destination, and either the Formatted Text or Delimited Text format.

  3. Type a different name for the file if you wish, and click Save.

The Incidents Log can grow very large, which can affect performance. To manage its size, you can specify a number of days after which Forefront Security for Office Communications Server will purge from the database all records older than the number of days you have specified.

To manage the size of the Incidents Log:
  1. In the Incidents work pane, check the Purge box.

  2. Select how many days you want to keep Incidents Log data.

  3. Click Save for the new setting to take effect.

    When the time comes for Forefront Security for Office Communications Server to clear the Incident database, you will be asked to confirm the deletion. If the Incidents Log is very large, the deletion process can take a long time.

    noteNote:
    To stop clearing the database, clear the Purge Box, and click Save.
 
Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft. All rights reserved.