This article applies to:
Question:
What does "DEFAULT" mean in the traffic logs?
Reply
What does "DEFAULT" mean in the traffic logs?
The username field of the Realtime Traffic Log (shadow.log) gives you an indication whether the user was being filtered by the (1) Global Group Profile, (2) IP Group Profile, (3) NT/LDAP Group Profile.
1. If the word "DEFAULT" appears by itself in the username field, this indicates that the user was being filtered by the Global Group Profile.
e.g.
10.45.90.14,DEFAULT,2008/08/31,12:05:36,REFERE,0,3,,http://WWW.DICTIONARY.COM...
2. If the word "IPGROUP" appears by itself in the username field, this indicates that the user was being filtered by an IP Group Profile.
e.g.
10.45.90.14,IPGROUP,2008/08/31,12:05:36,REFERE,0,3,,http://WWW.DICTIONARY.COM...
3a. If the word "DEFAULT" appears in the username field, in-between the name of your NT/LDAP domain, and the username, this indicates that the user was authenticated, and was being filtered by the default Rule assigned to the domain.
e.g.
10.45.90.14 ,8e6domain\DEFAULT\jsmith,2008/08/31...
3b. If you've created sub-groups under your domain on the R3000 (this is usually done to assign different profiles for different groups of users), the word "DEFAULT" will be replaced by the name of the sub-group.
e.g.
10.45.90.14 ,8e6domain\Tech Support\jsmith,2008/08/31...
3c. If you've created an "Individual" profile for a specific user under your NT/LDAP domain on the R3000, this is reflected by the word "INDIVIDUAL" in the username field.
e.g.
10.45.90.14 ,8e6domain\INDIVIDUAL\jsmith,2008/08/31...
- This article was previously published as:
- 8e6 KB 294819
To contact Trustwave about this article or to request support:
Add Your Comments
Comment submission is disabled for anonymous
users.
Please send feedback to Trustwave Technical Support or the Webmaster.
|
|
Article ID: 12561
Last Modified: 9/5/2008
Type: INFO
Article not rated yet.
Article has been viewed 3,871 times.
|
