Event Definitions: Difference between revisions

From Edge Threat Management Wiki - Arista
Jump to navigationJump to search
m (Dmorris moved page Event Logging to Events without leaving a redirect)
No edit summary
Line 1: Line 1:
All event data is stored in the [[Global DB Schema]] in a relational database. As Untangle and applications process traffic they create Event objects that add and modify content in the database.
All event data is stored in the [[Database Schema]] in a relational database. As Untangle and applications process traffic they create Event objects that add and modify content in the database.
Each event has it's own class/object with certain fields that modify the database in a certain way.  
Each event has it's own class/object with certain fields that modify the database in a certain way.  


The list below shows the classes used in the event logging and the column fields available within each event. These can be used to add Alert Events or for other event handling within Untangle.  
The list below shows the classes used in the event logging and the attributes of each event object. These can be used to add alerts in [[Reports]] or for other event handling within Untangle.  


== HostTableEvent ==
== HostTableEvent ==
<section begin='HostTableEvent' />
<section begin='HostTableEvent' />


These events are created by the base system and inserted to the [[Global_DB_schema#host_table_updates|host_table_updates]] table when the host table is modified.
These events are created by the base system and inserted to the [[Database_Schema#host_table_updates|host_table_updates]] table when the host table is modified.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 40: Line 40:
<section begin='DeviceTableEvent' />
<section begin='DeviceTableEvent' />


These events are created by the base system and inserted to the [[Global_DB_schema#device_table_updates|device_table_updates]] table when the device list is modified.
These events are created by the base system and inserted to the [[Database_Schema#device_table_updates|device_table_updates]] table when the device list is modified.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 77: Line 77:
<section begin='PenaltyBoxEvent' />
<section begin='PenaltyBoxEvent' />


These events are created by the [[Bandwidth Control]] and inserted to the [[Global_DB_schema#penaltybox|penaltybox]] table.
These events are created by the [[Bandwidth Control]] and inserted to the [[Database_Schema#penaltybox|penaltybox]] table.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 114: Line 114:
<section begin='SessionStatsEvent' />
<section begin='SessionStatsEvent' />


These events are created by the base system and update the [[Global_DB_schema#sessions|sessions]] table when a session ends with the updated stats.
These events are created by the base system and update the [[Database_Schema#sessions|sessions]] table when a session ends with the updated stats.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 124: Line 124:
|long
|long
|The number of bytes sent from the client to Untangle
|The number of bytes sent from the client to Untangle
|-
|c2pChunks
|long
|The number of chunks/packets sent from the client to Untangle
|-
|-
|class
|class
|Class
|Class
|The class name
|The class name
|-
|endTime
|long
|The end time/date
|-
|-
|p2cBytes
|p2cBytes
|long
|long
|The number of bytes sent to the client from Untangle
|The number of bytes sent to the client from Untangle
|-
|p2cChunks
|long
|The number of chunks/packets sent to the client from Untangle
|-
|-
|p2sBytes
|p2sBytes
|long
|long
|The number of bytes sent to the server from Untangle
|The number of bytes sent to the server from Untangle
|-
|p2sChunks
|long
|The number of chunks/packets sent to the server from Untangle
|-
|-
|s2pBytes
|s2pBytes
|long
|long
|The number of bytes sent from the server to Untangle
|The number of bytes sent from the server to Untangle
|-
|s2pChunks
|long
|The number of chunks/packets sent from the server to Untangle
|-
|-
|sessionId
|sessionId
Line 171: Line 159:
<section begin='SessionEvent' />
<section begin='SessionEvent' />


These events are created by the base system and update the [[Global_DB_schema#sessions|sessions]] table each time a session is created.
These events are created by the base system and update the [[Database_Schema#sessions|sessions]] table each time a session is created.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 217: Line 205:
|Class
|Class
|The class name
|The class name
|-
|clientCountry
|String
|The client country
|-
|-
|clientIntf
|clientIntf
|Integer
|Integer
|The client interface ID
|The client interface ID
|-
|clientLatitude
|Double
|The client latitude
|-
|clientLongitude
|Double
|The client longitude
|-
|-
|entitled
|entitled
Line 237: Line 237:
|Short
|Short
|The ICMP type
|The ICMP type
|-
|localAddr
|InetAddress
|The local host address
|-
|-
|policyId
|policyId
|Long
|Integer
|The policy ID
|The policy ID
|-
|policyRuleId
|Integer
|The policy rule ID
|-
|-
|protocol
|protocol
Line 249: Line 257:
|String
|String
|The protocol name
|The protocol name
|-
|remoteAddr
|InetAddress
|The remote host address
|-
|serverCountry
|String
|The server country
|-
|-
|serverIntf
|serverIntf
|Integer
|Integer
|The server interface ID
|The server interface ID
|-
|serverLatitude
|Double
|The server latitude
|-
|serverLongitude
|Double
|The server longitude
|-
|-
|sessionId
|sessionId
Line 269: Line 293:




== SessionNatEvent ==
== SessionMinuteEvent ==
<section begin='SessionNatEvent' />
<section begin='SessionMinuteEvent' />


These events are created by the base system and update the [[Global_DB_schema#sessions|sessions]] table each time a session is NATd with the post-NAT information.
These events are created by the base system and update the [[Database_Schema#sessions|session_minutes]] table each minute a session exists.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 279: Line 303:
! Description
! Description
|-
|-
|sClientAddr
|c2sBytes
|long
|The number of bytes sent from the client to the server
|-
|class
|Class
|The class name
|-
|s2cBytes
|long
|The number of bytes sent from the server to the client
|-
|sessionId
|long
|The session ID
|-
|timeStamp
|Timestamp
|The timestamp
|}
<section end='SessionMinuteEvent' />
 
 
== SessionNatEvent ==
<section begin='SessionNatEvent' />
 
These events are created by the base system and update the [[Database_Schema#sessions|sessions]] table each time a session is NATd with the post-NAT information.
 
{| border="1" cellpadding="2" width="90%" align="center"
! Attribute Name
! Type
! Description
|-
|sClientAddr
|InetAddress
|InetAddress
|The server-side (post-NAT) client address
|The server-side (post-NAT) client address
Line 313: Line 370:
<section begin='QuotaEvent' />
<section begin='QuotaEvent' />


These events are created by the [[Bandwidth Control]] and inserted or update the [[Global_DB_schema#quotas|quotas]] table when quotas are given or exceeded.
These events are created by the [[Bandwidth Control]] and inserted or update the [[Database_Schema#quotas|quotas]] table when quotas are given or exceeded.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 350: Line 407:
<section begin='SettingsChangesEvent' />
<section begin='SettingsChangesEvent' />


These events are created by the base system and inserted to the [[Global_DB_schema#settings_changes|settings_changes]] table when settings are changed.
These events are created by the base system and inserted to the [[Database_Schema#settings_changes|settings_changes]] table when settings are changed.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 361: Line 418:
|The class name
|The class name
|-
|-
|timeStamp
|hostname
|String
|The hostname
|-
|settingsFile
|String
|The settings file
|-
|timeStamp
|Timestamp
|Timestamp
|The timestamp
|The timestamp
|-
|username
|String
|The username
|}
|}
<section end='SettingsChangesEvent' />
<section end='SettingsChangesEvent' />
Line 392: Line 461:
<section begin='InterfaceStatEvent' />
<section begin='InterfaceStatEvent' />


These events are created by the base system and inserted to the [[Global_DB_schema#settings_changes|interface_stat_events]] table periodically with interface stats.
These events are created by the base system and inserted to the [[Database_Schema#settings_changes|interface_stat_events]] table periodically with interface stats.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 425: Line 494:
<section begin='SystemStatEvent' />
<section begin='SystemStatEvent' />


These events are created by the base system and inserted to the [[Global_DB_schema#server_events|server_events]] table periodically.
These events are created by the base system and inserted to the [[Database_Schema#server_events|server_events]] table periodically.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 459: Line 528:
|long
|long
|The total size of the disk
|The total size of the disk
|-
|diskUsed
|long
|The amount of disk used
|-
|diskUsedPercent
|float
|The percentage of disk used
|-
|-
|load1
|load1
Line 491: Line 568:
|long
|long
|The total amount of memory
|The total amount of memory
|-
|memUsed
|long
|The amount of used memory
|-
|memUsedPercent
|float
|The percentage of total memory that is used
|-
|-
|swapFree
|swapFree
|long
|long
|The amount of free swap
|The amount of free swap
|-
|swapFreePercent
|float
|The percentage of total swap that is free
|-
|-
|swapTotal
|swapTotal
|long
|long
|The total size of swap
|The total size of swap
|-
|swapUsed
|long
|The amount of used swap
|-
|swapUsedPercent
|float
|The percentage of total swap that is used
|-
|-
|timeStamp
|timeStamp
Line 510: Line 607:
<section begin='TunnelStatusEvent' />
<section begin='TunnelStatusEvent' />


These events are created by [[IPsec VPN]] and inserted to the [[Global_DB_schema#ipsec_tunnel_stats|ipsec_tunnel_stats]] table periodically.
These events are created by [[IPsec VPN]] and inserted to the [[Database_Schema#ipsec_tunnel_stats|ipsec_tunnel_stats]] table periodically.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 543: Line 640:
<section begin='VirtualUserEvent' />
<section begin='VirtualUserEvent' />


These events are created by [[IPsec VPN]] and inserted to the [[Global_DB_schema#ipsec_user_events|ipsec_user_events]] table when a user event occurs.
These events are created by [[IPsec VPN]] and inserted to the [[Database_Schema#ipsec_user_events|ipsec_user_events]] table when a user event occurs.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 600: Line 697:
<section begin='AlertEvent' />
<section begin='AlertEvent' />


These events are created by [[Reports]] and inserted to the [[Global_DB_schema#alerts|alerts]] table when an alert fires.
These events are created by [[Reports]] and inserted to the [[Database_Schema#alerts|alerts]] table when an alert fires.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 637: Line 734:
<section begin='ConfigurationBackupEvent' />
<section begin='ConfigurationBackupEvent' />


These events are created by [[Configuration Backup]] and inserted to the [[Global_DB_schema#configuratio_backup_events|configuratio_backup_events]] table when a backup occurs.
These events are created by [[Configuration Backup]] and inserted to the [[Database_Schema#configuratio_backup_events|configuratio_backup_events]] table when a backup occurs.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 670: Line 767:
<section begin='WebCacheEvent' />
<section begin='WebCacheEvent' />


These events are created by [[Web Cache]] and inserted to the [[Global_DB_schema#web_cache_stats|web_cache_stats]] table periodically.
These events are created by [[Web Cache]] and inserted to the [[Database_Schema#web_cache_stats|web_cache_stats]] table periodically.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 719: Line 816:
<section begin='PrioritizeEvent' />
<section begin='PrioritizeEvent' />


These events are created by the [[Bandwidth Control]] and update the [[Global_DB_schema#sessions|session]] table when a session is prioritized.
These events are created by the [[Bandwidth Control]] and update the [[Database_Schema#sessions|session]] table when a session is prioritized.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 752: Line 849:
<section begin='HttpResponseEvent' />
<section begin='HttpResponseEvent' />


These events are created by HTTP subsystem and update the [[Global_DB_schema#http_events|http_events]] table when a web response happens.
These events are created by HTTP subsystem and update the [[Database_Schema#http_events|http_events]] table when a web response happens.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 770: Line 867:
|String
|String
|The content type
|The content type
|-
|httpRequestEvent
|HttpRequestEvent
|The corresponding HTTP request event
|-
|-
|requestLine
|requestLine
Line 785: Line 886:
<section begin='HttpRequestEvent' />
<section begin='HttpRequestEvent' />


These events are created by HTTP subsystem and inserted to the [[Global_DB_schema#http_events|http_events]] table when a web request happens.
These events are created by HTTP subsystem and inserted to the [[Database_Schema#http_events|http_events]] table when a web request happens.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 827: Line 928:
|SessionEvent
|SessionEvent
|The session event
|The session event
|-
|sessionId
|Long
|The session ID
|-
|-
|timeStamp
|timeStamp
Line 842: Line 939:
<section begin='ApplicationControlLiteEvent' />
<section begin='ApplicationControlLiteEvent' />


These events are created by [[Application Control Lite]] and update the [[Global_DB_schema#sessions|sessions]] table when application control lite identifies a session.
These events are created by [[Application Control Lite]] and update the [[Database_Schema#sessions|sessions]] table when application control lite identifies a session.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 875: Line 972:
<section begin='FirewallEvent' />
<section begin='FirewallEvent' />


These events are created by [[Firewall]] and update the [[Global_DB_schema#sessions|sessions]] table when a firewall rule matches a session.
These events are created by [[Firewall]] and update the [[Database_Schema#sessions|sessions]] table when a firewall rule matches a session.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 909: Line 1,006:




== WebFilterEvent ==
== WebFilterQueryEvent ==
<section begin='WebFilterEvent' />
<section begin='WebFilterQueryEvent' />


These events are created by [[Web Filter]] and update the [[Global_DB_schema#http_events|http_events]] table when web filter processes a web request.
These events are created by [[Web Filter]] and inserted to the [[Database_Schema#http_query_events|http_query_events]] table when web filter processes a search engine search.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 918: Line 1,015:
! Type
! Type
! Description
! Description
|-
|blocked
|Boolean
|True if blocked, false otherwise
|-
|category
|String
|The category
|-
|-
|class
|class
Line 931: Line 1,020:
|The class name
|The class name
|-
|-
|flagged
|contentLength
|Boolean
|long
|True if flagged, false otherwise
|The content length
|-
|host
|String
|The host
|-
|method
|HttpMethod
|The method
|-
|-
|nodeName
|nodeName
Line 939: Line 1,036:
|The name of the application
|The name of the application
|-
|-
|reason
|requestId
|Reason
|Long
|The reason
|The request ID
|-
|requestUri
|URI
|The request URI
|-
|sessionEvent
|SessionEvent
|The session event
|-
|term
|String
|The search term/phrase
|-
|-
|timeStamp
|timeStamp
Line 947: Line 1,056:
|The timestamp
|The timestamp
|}
|}
<section end='WebFilterEvent' />
<section end='WebFilterQueryEvent' />




== ApplicationControlLogEvent ==
== WebFilterEvent ==
<section begin='ApplicationControlLogEvent' />
<section begin='WebFilterEvent' />


These events are created by [[Application Control]] and update the [[Global_DB_schema#sessions|sessions]] table when application control identifies a session.
These events are created by [[Web Filter]] and update the [[Database_Schema#http_events|http_events]] table when web filter processes a web request.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 959: Line 1,068:
! Type
! Type
! Description
! Description
|-
|application
|String
|The application
|-
|-
|blocked
|blocked
|boolean
|Boolean
|True if blocked, false otherwise
|True if blocked, false otherwise
|-
|-
Line 976: Line 1,081:
|The class name
|The class name
|-
|-
|confidence
|flagged
|Integer
|Boolean
|The confidence (0-100)
|True if flagged, false otherwise
|-
|-
|detail
|nodeName
|String
|String
|The details
|The name of the application
|-
|-
|flagged
|reason
|boolean
|Reason
|True if flagged, false otherwise
|The reason
|-
|protochain
|String
|The protochain
|-
|ruleId
|Integer
|The rule ID
|-
|sessionEvent
|SessionEvent
|The session event
|-
|state
|Integer
|The state
|-
|-
|timeStamp
|timeStamp
Line 1,008: Line 1,097:
|The timestamp
|The timestamp
|}
|}
<section end='ApplicationControlLogEvent' />
<section end='WebFilterEvent' />




== ShieldEvent ==
== ApplicationControlLogEvent ==
<section begin='ShieldEvent' />
<section begin='ApplicationControlLogEvent' />


These events are created by base system and update the [[Global_DB_schema#sessions|sessions]] table when the shield blocks a session.
These events are created by [[Application Control]] and update the [[Database_Schema#sessions|sessions]] table when application control identifies a session.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,020: Line 1,109:
! Type
! Type
! Description
! Description
|-
|application
|String
|The application
|-
|-
|blocked
|blocked
|boolean
|boolean
|True if blocked, false otherwise
|True if blocked, false otherwise
|-
|category
|String
|The category
|-
|-
|class
|class
Line 1,029: Line 1,126:
|The class name
|The class name
|-
|-
|sessionId
|confidence
|Long
|Integer
|The session ID
|The confidence (0-100)
|-
|detail
|String
|The details
|-
|-
|timeStamp
|flagged
|Timestamp
|boolean
|The timestamp
|True if flagged, false otherwise
|}
|-
<section end='ShieldEvent' />
|protochain
 
|String
 
|The protochain
== SslInspectorLogEvent ==
|-
<section begin='SslInspectorLogEvent' />
|ruleId
 
|Integer
These events are created by [[SSL Inspector]] and update the [[Global_DB_schema#sessions|sessions]] table when a session is processed by SSL Inspector.
|The rule ID
|-
|sessionEvent
|SessionEvent
|The session event
|-
|state
|Integer
|The state
|-
|timeStamp
|Timestamp
|The timestamp
|}
<section end='ApplicationControlLogEvent' />
 
 
== SslInspectorLogEvent ==
<section begin='SslInspectorLogEvent' />
 
These events are created by [[SSL Inspector]] and update the [[Database_Schema#sessions|sessions]] table when a session is processed by SSL Inspector.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,080: Line 1,201:
<section begin='SpamSmtpTarpitEvent' />
<section begin='SpamSmtpTarpitEvent' />


These events are created by [[Spam Blocker]] and inserted to the [[Global_DB_schema#smtp_tarpit_events|smtp_tarpit_events]] table when a session is tarpitted.
These events are created by [[Spam Blocker]] and inserted to the [[Database_Schema#smtp_tarpit_events|smtp_tarpit_events]] table when a session is tarpitted.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,121: Line 1,242:
<section begin='SpamLogEvent' />
<section begin='SpamLogEvent' />


These events are created by [[Spam Blocker]] and update the [[Global_DB_schema#mail_msgs|mail_msgs]] table when an email is scanned.
These events are created by [[Spam Blocker]] and update the [[Database_Schema#mail_msgs|mail_msgs]] table when an email is scanned.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,198: Line 1,319:
<section begin='SpamSmtpTarpitEvent' />
<section begin='SpamSmtpTarpitEvent' />


These events are created by [[Spam Blocker]] and inserted to the [[Global_DB_schema#smtp_tarpit_events|smtp_tarpit_events]] table when a session is tarpitted.
These events are created by [[Spam Blocker]] and inserted to the [[Database_Schema#smtp_tarpit_events|smtp_tarpit_events]] table when a session is tarpitted.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,239: Line 1,360:
<section begin='SpamLogEvent' />
<section begin='SpamLogEvent' />


These events are created by [[Spam Blocker]] and update the [[Global_DB_schema#mail_msgs|mail_msgs]] table when an email is scanned.
These events are created by [[Spam Blocker]] and update the [[Database_Schema#mail_msgs|mail_msgs]] table when an email is scanned.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,316: Line 1,437:
<section begin='CookieEvent' />
<section begin='CookieEvent' />


These events are created by [[Ad Blocker]] and update the [[Global_DB_schema#http_events|http_events]] table when a cookie is blocked.
These events are created by [[Ad Blocker]] and update the [[Database_Schema#http_events|http_events]] table when a cookie is blocked.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,349: Line 1,470:
<section begin='AdBlockerEvent' />
<section begin='AdBlockerEvent' />


These events are created by [[Ad Blocker]] and update the [[Global_DB_schema#http_events|http_events]] table when an ad is blocked.
These events are created by [[Ad Blocker]] and update the [[Database_Schema#http_events|http_events]] table when an ad is blocked.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,382: Line 1,503:
<section begin='IntrusionPreventionLogEvent' />
<section begin='IntrusionPreventionLogEvent' />


These events are created by [[Intrusion Prevention]] and inserted to the [[Global_DB_schema#intrusion_prevention_events|intrusion_prevention_events]] table when a rule matches.
These events are created by [[Intrusion Prevention]] and inserted to the [[Database_Schema#intrusion_prevention_events|intrusion_prevention_events]] table when a rule matches.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,496: Line 1,617:




== WebFilterQueryEvent ==
== WanFailoverTestEvent ==
<section begin='WebFilterQueryEvent' />
<section begin='WanFailoverTestEvent' />


These events are created by [[Web Filter]] and inserted to the [[Global_DB_schema#http_query_events|http_query_events]] table when web filter processes a search engine search.
These events are created by [[WAN Failover]] and inserted to the [[Database_Schema#wan_failover_test_events|wan_failover_test_events]] table when a test is run.
 
{| border="1" cellpadding="2" width="90%" align="center"
! Attribute Name
! Type
! Description
|-
|class
|Class
|The class name
|-
|contentLength
|long
|The content length
|-
|host
|String
|The host
|-
|method
|HttpMethod
|The method
|-
|nodeName
|String
|The name of the application
|-
|requestId
|Long
|The request ID
|-
|requestUri
|URI
|The request URI
|-
|sessionEvent
|SessionEvent
|The session event
|-
|term
|String
|The search term/phrase
|-
|timeStamp
|Timestamp
|The timestamp
|}
<section end='WebFilterQueryEvent' />
 
 
== WanFailoverTestEvent ==
<section begin='WanFailoverTestEvent' />
 
These events are created by [[WAN Failover]] and inserted to the [[Global_DB_schema#wan_failover_test_events|wan_failover_test_events]] table when a test is run.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,593: Line 1,661:
<section begin='WanFailoverEvent' />
<section begin='WanFailoverEvent' />


These events are created by [[WAN Failover]] and inserted to the [[Global_DB_schema#wan_failover_action_events|wan_failover_action_events]] table when WAN Failover takes an action.
These events are created by [[WAN Failover]] and inserted to the [[Database_Schema#wan_failover_action_events|wan_failover_action_events]] table when WAN Failover takes an action.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,630: Line 1,698:
<section begin='CaptivePortalUserEvent' />
<section begin='CaptivePortalUserEvent' />


These events are created by [[Captive Portal]] and inserted to the [[Global_DB_schema#captive_portal_user_events|captive_portal_user_events]] table when Captive Portal user takes an action.
These events are created by [[Captive Portal]] and inserted to the [[Database_Schema#captive_portal_user_events|captive_portal_user_events]] table when Captive Portal user takes an action.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,666: Line 1,734:
|-
|-
|policyId
|policyId
|Long
|Integer
|The policy ID
|The policy ID
|-
|-
Line 1,679: Line 1,747:
<section begin='CaptureRuleEvent' />
<section begin='CaptureRuleEvent' />


These events are created by [[Captive Portal]] and update the [[Global_DB_schema#sessions|sessions]] table when Captive Portal processes a session.
These events are created by [[Captive Portal]] and update the [[Database_Schema#sessions|sessions]] table when Captive Portal processes a session.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,712: Line 1,780:
<section begin='VirusSmtpEvent' />
<section begin='VirusSmtpEvent' />


These events are created by [[Virus Blocker]] and update the [[Global_DB_schema#mail_msgs|mail_msgs]] table when Virus Blocker scans an email.
These events are created by [[Virus Blocker]] and update the [[Database_Schema#mail_msgs|mail_msgs]] table when Virus Blocker scans an email.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,753: Line 1,821:
<section begin='VirusFtpEvent' />
<section begin='VirusFtpEvent' />


These events are created by [[Virus Blocker]] and update the [[Global_DB_schema#ftp_events|ftp_events]] table when Virus Blocker scans an FTP transfer.
These events are created by [[Virus Blocker]] and update the [[Database_Schema#ftp_events|ftp_events]] table when Virus Blocker scans an FTP transfer.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,794: Line 1,862:
<section begin='VirusHttpEvent' />
<section begin='VirusHttpEvent' />


These events are created by [[Virus Blocker]] and update the [[Global_DB_schema#http_events|http_events]] table when Virus Blocker scans an HTTP transfer.
These events are created by [[Virus Blocker]] and update the [[Database_Schema#http_events|http_events]] table when Virus Blocker scans an HTTP transfer.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,831: Line 1,899:
<section begin='OpenVpnEvent' />
<section begin='OpenVpnEvent' />


These events are created by [[OpenVPN]] and update the [[Global_DB_schema#openvpn_events|openvpn_events]] table when OpenVPN processes a client action.
These events are created by [[OpenVPN]] and update the [[Database_Schema#openvpn_events|openvpn_events]] table when OpenVPN processes a client action.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,868: Line 1,936:
<section begin='OpenVpnStatusEvent' />
<section begin='OpenVpnStatusEvent' />


These events are created by [[OpenVPN]] and update the [[Global_DB_schema#openvpn_stats|openvpn_stats]] table periodically.
These events are created by [[OpenVPN]] and update the [[Database_Schema#openvpn_stats|openvpn_stats]] table periodically.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,929: Line 1,997:
<section begin='SmtpMessageAddressEvent' />
<section begin='SmtpMessageAddressEvent' />


These events are created by SMTP subsystem and inserted to the [[Global_DB_schema#mail_addrs|mail_addrs]] table for each address on each email.
These events are created by SMTP subsystem and inserted to the [[Database_Schema#mail_addrs|mail_addrs]] table for each address on each email.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 1,966: Line 2,034:
<section begin='SmtpMessageEvent' />
<section begin='SmtpMessageEvent' />


These events are created by SMTP subsystem and inserted to the [[Global_DB_schema#mail_msgs|mail_msgs]] table for each email.
These events are created by SMTP subsystem and inserted to the [[Database_Schema#mail_msgs|mail_msgs]] table for each email.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"
Line 2,027: Line 2,095:
<section begin='LoginEvent' />
<section begin='LoginEvent' />


These events are created by [[Directory Connector]] and inserted to the [[Global_DB_schema#directory_connector_login_events|directory_connector_login_events]] table for each login.
These events are created by [[Directory Connector]] and inserted to the [[Database_Schema#directory_connector_login_events|directory_connector_login_events]] table for each login.


{| border="1" cellpadding="2" width="90%" align="center"
{| border="1" cellpadding="2" width="90%" align="center"

Revision as of 18:18, 26 December 2016

All event data is stored in the Database Schema in a relational database. As Untangle and applications process traffic they create Event objects that add and modify content in the database. Each event has it's own class/object with certain fields that modify the database in a certain way.

The list below shows the classes used in the event logging and the attributes of each event object. These can be used to add alerts in Reports or for other event handling within Untangle.

HostTableEvent

<section begin='HostTableEvent' />

These events are created by the base system and inserted to the host_table_updates table when the host table is modified.

Attribute Name Type Description
address InetAddress The address
class Class The class name
key String The key
timeStamp Timestamp The timestamp
value String The value

<section end='HostTableEvent' />


DeviceTableEvent

<section begin='DeviceTableEvent' />

These events are created by the base system and inserted to the device_table_updates table when the device list is modified.

Attribute Name Type Description
class Class The class name
device DeviceTableEntry The Device
key String The key
macAddress String The MAC address
timeStamp Timestamp The timestamp
value String The value

<section end='DeviceTableEvent' />


PenaltyBoxEvent

<section begin='PenaltyBoxEvent' />

These events are created by the Bandwidth Control and inserted to the penaltybox table.

Attribute Name Type Description
action int The action
address InetAddress The address
class Class The class name
entryTime Timestamp The entry time
exitTime Timestamp The exit time
timeStamp Timestamp The timestamp

<section end='PenaltyBoxEvent' />


SessionStatsEvent

<section begin='SessionStatsEvent' />

These events are created by the base system and update the sessions table when a session ends with the updated stats.

Attribute Name Type Description
c2pBytes long The number of bytes sent from the client to Untangle
class Class The class name
endTime long The end time/date
p2cBytes long The number of bytes sent to the client from Untangle
p2sBytes long The number of bytes sent to the server from Untangle
s2pBytes long The number of bytes sent from the server to Untangle
sessionId Long The session ID
timeStamp Timestamp The timestamp

<section end='SessionStatsEvent' />


SessionEvent

<section begin='SessionEvent' />

These events are created by the base system and update the sessions table each time a session is created.

Attribute Name Type Description
cClientAddr InetAddress The client-side (pre-NAT) client address
cClientPort Integer The client-side (pre-NAT) client port
cServerAddr InetAddress The client-side (pre-NAT) server address
cServerPort Integer The client-side (pre-NAT) server port
sClientAddr InetAddress The server-side (post-NAT) client address
sClientPort Integer The server-side (post-NAT) client port
sServerAddr InetAddress The server-side (post-NAT) server address
sServerPort Integer The server-side (post-NAT) server port
bypassed boolean True if bypassed, false otherwise
class Class The class name
clientCountry String The client country
clientIntf Integer The client interface ID
clientLatitude Double The client latitude
clientLongitude Double The client longitude
entitled boolean The entitled status
filterPrefix String The filter prefix if blocked by the filter rules
hostname String The hostname
icmpType Short The ICMP type
localAddr InetAddress The local host address
policyId Integer The policy ID
policyRuleId Integer The policy rule ID
protocol Short The protocol
protocolName String The protocol name
remoteAddr InetAddress The remote host address
serverCountry String The server country
serverIntf Integer The server interface ID
serverLatitude Double The server latitude
serverLongitude Double The server longitude
sessionId Long The session ID
timeStamp Timestamp The timestamp
username String The username

<section end='SessionEvent' />


SessionMinuteEvent

<section begin='SessionMinuteEvent' />

These events are created by the base system and update the session_minutes table each minute a session exists.

Attribute Name Type Description
c2sBytes long The number of bytes sent from the client to the server
class Class The class name
s2cBytes long The number of bytes sent from the server to the client
sessionId long The session ID
timeStamp Timestamp The timestamp

<section end='SessionMinuteEvent' />


SessionNatEvent

<section begin='SessionNatEvent' />

These events are created by the base system and update the sessions table each time a session is NATd with the post-NAT information.

Attribute Name Type Description
sClientAddr InetAddress The server-side (post-NAT) client address
sClientPort Integer The server-side (post-NAT) client port
sServerAddr InetAddress The server-side (post-NAT) server address
sServerPort Integer The server-side (post-NAT) server port
class Class The class name
serverIntf Integer The server interface ID
timeStamp Timestamp The timestamp

<section end='SessionNatEvent' />


QuotaEvent

<section begin='QuotaEvent' />

These events are created by the Bandwidth Control and inserted or update the quotas table when quotas are given or exceeded.

Attribute Name Type Description
action int The action (1=Quota Given, 2=Quota Exceeded)
address InetAddress The address
class Class The class name
quotaSize long The quota size
reason String The reason
timeStamp Timestamp The timestamp

<section end='QuotaEvent' />


SettingsChangesEvent

<section begin='SettingsChangesEvent' />

These events are created by the base system and inserted to the settings_changes table when settings are changed.

Attribute Name Type Description
class Class The class name
hostname String The hostname
settingsFile String The settings file
timeStamp Timestamp The timestamp
username String The username

<section end='SettingsChangesEvent' />


LogEvent

<section begin='LogEvent' />

These base class for all events.

Attribute Name Type Description
class Class The class name
timeStamp Timestamp The timestamp

<section end='LogEvent' />


InterfaceStatEvent

<section begin='InterfaceStatEvent' />

These events are created by the base system and inserted to the interface_stat_events table periodically with interface stats.

Attribute Name Type Description
class Class The class name
interfaceId int The interface ID
rxRate double The RX rate in byte/s
timeStamp Timestamp The timestamp
txRate double The TX rate in byte/s

<section end='InterfaceStatEvent' />


SystemStatEvent

<section begin='SystemStatEvent' />

These events are created by the base system and inserted to the server_events table periodically.

Attribute Name Type Description
activeHosts int The active host count
class Class The class name
cpuSystem float The system CPU utilization
cpuUser float The user CPU utilization
diskFree long The amount of disk free
diskFreePercent float The percentage of disk free
diskTotal long The total size of the disk
diskUsed long The amount of disk used
diskUsedPercent float The percentage of disk used
load1 float The 1-minute CPU load
load15 float The 15-minute CPU load
load5 float The 5-minute CPU load
memBuffers long The amount of memory used by buffers
memCache long The amount of memory used by cache
memFree long The amount of free memory
memFreePercent float The percentage of total memory that is free
memTotal long The total amount of memory
memUsed long The amount of used memory
memUsedPercent float The percentage of total memory that is used
swapFree long The amount of free swap
swapFreePercent float The percentage of total swap that is free
swapTotal long The total size of swap
swapUsed long The amount of used swap
swapUsedPercent float The percentage of total swap that is used
timeStamp Timestamp The timestamp

<section end='SystemStatEvent' />


TunnelStatusEvent

<section begin='TunnelStatusEvent' />

These events are created by IPsec VPN and inserted to the ipsec_tunnel_stats table periodically.

Attribute Name Type Description
class Class The class name
inBytes long The number of bytes received from this tunnel
outBytes long The number of bytes sent in this tunnel
timeStamp Timestamp The timestamp
tunnelName String The name of this tunnel

<section end='TunnelStatusEvent' />


VirtualUserEvent

<section begin='VirtualUserEvent' />

These events are created by IPsec VPN and inserted to the ipsec_user_events table when a user event occurs.

Attribute Name Type Description
class Class The class name
clientAddress InetAddress The client address
clientProtocol String The client protocol
clientUsername String The client username
elapsedTime String The elapsed time
eventId Long The event ID
netInterface String The net interface
netProcess String The net process
netRXbytes Long The number of RX (received) bytes
netTXbytes Long The number of TX (transmitted) bytes
timeStamp Timestamp The timestamp

<section end='VirtualUserEvent' />


AlertEvent

<section begin='AlertEvent' />

These events are created by Reports and inserted to the alerts table when an alert fires.

Attribute Name Type Description
cause LogEvent The cause
class Class The class name
description String The description
json JSONObject The JSON string
summaryText String The summary text
timeStamp Timestamp The timestamp

<section end='AlertEvent' />


ConfigurationBackupEvent

<section begin='ConfigurationBackupEvent' />

These events are created by Configuration Backup and inserted to the configuratio_backup_events table when a backup occurs.

Attribute Name Type Description
class Class The class name
destination String The destination
detail String The details
success boolean True if successful, false otherwise
timeStamp Timestamp The timestamp

<section end='ConfigurationBackupEvent' />


WebCacheEvent

<section begin='WebCacheEvent' />

These events are created by Web Cache and inserted to the web_cache_stats table periodically.

Attribute Name Type Description
bypassCount long The number of bypasses
class Class The class name
hitBytes long The number of bytes worth of hits
hitCount long The number of hits
missBytes long The number of bytes worth of misses
missCount long The number of misses
policyId Long The policy ID
systemCount long The number of system bypasses
timeStamp Timestamp The timestamp

<section end='WebCacheEvent' />


PrioritizeEvent

<section begin='PrioritizeEvent' />

These events are created by the Bandwidth Control and update the session table when a session is prioritized.

Attribute Name Type Description
class Class The class name
priority int The priority
ruleId int The rule ID
sessionEvent SessionEvent The session event
timeStamp Timestamp The timestamp

<section end='PrioritizeEvent' />


HttpResponseEvent

<section begin='HttpResponseEvent' />

These events are created by HTTP subsystem and update the http_events table when a web response happens.

Attribute Name Type Description
class Class The class name
contentLength long The content length
contentType String The content type
httpRequestEvent HttpRequestEvent The corresponding HTTP request event
requestLine RequestLine The request line
timeStamp Timestamp The timestamp

<section end='HttpResponseEvent' />


HttpRequestEvent

<section begin='HttpRequestEvent' />

These events are created by HTTP subsystem and inserted to the http_events table when a web request happens.

Attribute Name Type Description
class Class The class name
contentLength long The content length
domain String The domain
host String The host
method HttpMethod The HTTP method
referer String The referer
requestId Long The request ID
requestUri URI The request URI
sessionEvent SessionEvent The session event
timeStamp Timestamp The timestamp

<section end='HttpRequestEvent' />


ApplicationControlLiteEvent

<section begin='ApplicationControlLiteEvent' />

These events are created by Application Control Lite and update the sessions table when application control lite identifies a session.

Attribute Name Type Description
blocked boolean True if blocked, false otherwise
class Class The class name
protocol String The protocol
sessionId Long The session ID
timeStamp Timestamp The timestamp

<section end='ApplicationControlLiteEvent' />


FirewallEvent

<section begin='FirewallEvent' />

These events are created by Firewall and update the sessions table when a firewall rule matches a session.

Attribute Name Type Description
blocked boolean True if blocked, false otherwise
class Class The class name
flagged boolean True if flagged, false otherwise
ruleId long The rule ID
sessionId Long The session ID
timeStamp Timestamp The timestamp

<section end='FirewallEvent' />


WebFilterQueryEvent

<section begin='WebFilterQueryEvent' />

These events are created by Web Filter and inserted to the http_query_events table when web filter processes a search engine search.

Attribute Name Type Description
class Class The class name
contentLength long The content length
host String The host
method HttpMethod The method
nodeName String The name of the application
requestId Long The request ID
requestUri URI The request URI
sessionEvent SessionEvent The session event
term String The search term/phrase
timeStamp Timestamp The timestamp

<section end='WebFilterQueryEvent' />


WebFilterEvent

<section begin='WebFilterEvent' />

These events are created by Web Filter and update the http_events table when web filter processes a web request.

Attribute Name Type Description
blocked Boolean True if blocked, false otherwise
category String The category
class Class The class name
flagged Boolean True if flagged, false otherwise
nodeName String The name of the application
reason Reason The reason
timeStamp Timestamp The timestamp

<section end='WebFilterEvent' />


ApplicationControlLogEvent

<section begin='ApplicationControlLogEvent' />

These events are created by Application Control and update the sessions table when application control identifies a session.

Attribute Name Type Description
application String The application
blocked boolean True if blocked, false otherwise
category String The category
class Class The class name
confidence Integer The confidence (0-100)
detail String The details
flagged boolean True if flagged, false otherwise
protochain String The protochain
ruleId Integer The rule ID
sessionEvent SessionEvent The session event
state Integer The state
timeStamp Timestamp The timestamp

<section end='ApplicationControlLogEvent' />


SslInspectorLogEvent

<section begin='SslInspectorLogEvent' />

These events are created by SSL Inspector and update the sessions table when a session is processed by SSL Inspector.

Attribute Name Type Description
class Class The class name
detail String The details
ruleId Integer The rule ID
sessionEvent SessionEvent The session event
status String The status
timeStamp Timestamp The timestamp

<section end='SslInspectorLogEvent' />


SpamSmtpTarpitEvent

<section begin='SpamSmtpTarpitEvent' />

These events are created by Spam Blocker and inserted to the smtp_tarpit_events table when a session is tarpitted.

Attribute Name Type Description
iPAddr InetAddress The IP address
class Class The class name
hostname String The hostname
sessionEvent SessionEvent The session event
sessionId Long The session ID
timeStamp Timestamp The timestamp
vendorName String The application name

<section end='SpamSmtpTarpitEvent' />


SpamLogEvent

<section begin='SpamLogEvent' />

These events are created by Spam Blocker and update the mail_msgs table when an email is scanned.

Attribute Name Type Description
action SpamMessageAction The action
class Class The class name
clientAddr InetAddress The client address
clientPort int The client port
messageId Long The message ID
receiver String The receiver
score float The score
sender String The sender
serverAddr InetAddress The server address
serverPort int The server port
smtpMessageEvent SmtpMessageEvent The parent SMTP message event
isSpam boolean True if spam, false otherwise
subject String The subject
testsString String The tests string from the spam engine
timeStamp Timestamp The timestamp
vendorName String The application name

<section end='SpamLogEvent' />


SpamSmtpTarpitEvent

<section begin='SpamSmtpTarpitEvent' />

These events are created by Spam Blocker and inserted to the smtp_tarpit_events table when a session is tarpitted.

Attribute Name Type Description
iPAddr InetAddress The IP address
class Class The class name
hostname String The hostname
sessionEvent SessionEvent The session event
sessionId Long The session ID
timeStamp Timestamp The timestamp
vendorName String The application name

<section end='SpamSmtpTarpitEvent' />


SpamLogEvent

<section begin='SpamLogEvent' />

These events are created by Spam Blocker and update the mail_msgs table when an email is scanned.

Attribute Name Type Description
action SpamMessageAction The action
class Class The class name
clientAddr InetAddress The client address
clientPort int The client port
messageId Long The message ID
receiver String The receiver
score float The score
sender String The sender
serverAddr InetAddress The server address
serverPort int The server port
smtpMessageEvent SmtpMessageEvent The parent SMTP message event
isSpam boolean True if spam, false otherwise
subject String The subject
testsString String The tests string from the spam engine
timeStamp Timestamp The timestamp
vendorName String The application name

<section end='SpamLogEvent' />


CookieEvent

<section begin='CookieEvent' />

These events are created by Ad Blocker and update the http_events table when a cookie is blocked.

Attribute Name Type Description
class Class The class name
identification String The identification string
requestId Long The request ID
sessionEvent SessionEvent The session event
timeStamp Timestamp The timestamp

<section end='CookieEvent' />


AdBlockerEvent

<section begin='AdBlockerEvent' />

These events are created by Ad Blocker and update the http_events table when an ad is blocked.

Attribute Name Type Description
action Action The action
class Class The class name
reason String The reason
requestId Long The request ID
timeStamp Timestamp The timestamp

<section end='AdBlockerEvent' />


IntrusionPreventionLogEvent

<section begin='IntrusionPreventionLogEvent' />

These events are created by Intrusion Prevention and inserted to the intrusion_prevention_events table when a rule matches.

Attribute Name Type Description
blocked short 1 if blocked, 0 otherwise
category String The category
class Class The class name
classificationId long The classification ID
classtype String The classtype
dportIcode int The dportIcode
eventId long The event ID
eventMicrosecond long The event microsecond
eventSecond long The event second
eventType long The event type
generatorId long The generator ID
impact short The impact
impactFlag short The impact flag
ipDestination InetAddress The IP address destination
ipSource InetAddress The IP address source
mplsLabel long The mplsLabel
msg String The msg
padding int The padding
priorityId long The priority ID
protocol short The protocol
sensorId long The sensor ID
signatureId long The signature ID
signatureRevision long The signature revision
sportItype int The sportItype
timeStamp Timestamp The timestamp
vlanId int The VLAN Id

<section end='IntrusionPreventionLogEvent' />


WanFailoverTestEvent

<section begin='WanFailoverTestEvent' />

These events are created by WAN Failover and inserted to the wan_failover_test_events table when a test is run.

Attribute Name Type Description
class Class The class name
description String The description
interfaceId int The interface ID
name String The test name
osName String The O/S interface name
success Boolean True if successful, false otherwise
timeStamp Timestamp The timestamp

<section end='WanFailoverTestEvent' />


WanFailoverEvent

<section begin='WanFailoverEvent' />

These events are created by WAN Failover and inserted to the wan_failover_action_events table when WAN Failover takes an action.

Attribute Name Type Description
action WanFailoverEvent$Action The action
class Class The class name
interfaceId int The interface ID
name String The name
osName String The O/S interface name
timeStamp Timestamp The timestamp

<section end='WanFailoverEvent' />


CaptivePortalUserEvent

<section begin='CaptivePortalUserEvent' />

These events are created by Captive Portal and inserted to the captive_portal_user_events table when Captive Portal user takes an action.

Attribute Name Type Description
authenticationType CaptivePortalSettings$AuthenticationType The authentication type
authenticationTypeValue String The authentication type as a string
class Class The class name
clientAddr InetAddress The client address
event CaptivePortalUserEvent$EventType The event (LOGIN, FAILED, TIMEOUT, INACTIVE, USER_LOGOUT, ADMIN_LOGOUT)
eventValue String The event value as a string (LOGIN, FAILED, TIMEOUT, INACTIVE, USER_LOGOUT, ADMIN_LOGOUT)
loginName String The login name
policyId Integer The policy ID
timeStamp Timestamp The timestamp

<section end='CaptivePortalUserEvent' />


CaptureRuleEvent

<section begin='CaptureRuleEvent' />

These events are created by Captive Portal and update the sessions table when Captive Portal processes a session.

Attribute Name Type Description
captured boolean True if captured, false otherwise
class Class The class name
ruleId Integer The rule ID
sessionEvent SessionEvent The session event
timeStamp Timestamp The timestamp

<section end='CaptureRuleEvent' />


VirusSmtpEvent

<section begin='VirusSmtpEvent' />

These events are created by Virus Blocker and update the mail_msgs table when Virus Blocker scans an email.

Attribute Name Type Description
action String The action
class Class The class name
clean boolean True if clean, false otherwise
messageId Long The message ID
nodeName String The name of the application
timeStamp Timestamp The timestamp
virusName String The virus name, if not clean

<section end='VirusSmtpEvent' />


VirusFtpEvent

<section begin='VirusFtpEvent' />

These events are created by Virus Blocker and update the ftp_events table when Virus Blocker scans an FTP transfer.

Attribute Name Type Description
class Class The class name
clean boolean True if clean, false otherwise
nodeName String The name of the application
sessionEvent SessionEvent The session event
timeStamp Timestamp The timestamp
uri String The URI
virusName String The virus name, if not clean

<section end='VirusFtpEvent' />


VirusHttpEvent

<section begin='VirusHttpEvent' />

These events are created by Virus Blocker and update the http_events table when Virus Blocker scans an HTTP transfer.

Attribute Name Type Description
class Class The class name
clean boolean True if clean, false otherwise
nodeName String The name of the application
requestId Long The request ID
timeStamp Timestamp The timestamp
virusName String The virus name, if not clean

<section end='VirusHttpEvent' />


OpenVpnEvent

<section begin='OpenVpnEvent' />

These events are created by OpenVPN and update the openvpn_events table when OpenVPN processes a client action.

Attribute Name Type Description
address InetAddress The address
class Class The class name
clientName String The client name
poolAddress InetAddress The pool address
timeStamp Timestamp The timestamp
type OpenVpnEvent$EventType The type

<section end='OpenVpnEvent' />


OpenVpnStatusEvent

<section begin='OpenVpnStatusEvent' />

These events are created by OpenVPN and update the openvpn_stats table periodically.

Attribute Name Type Description
address InetAddress The address
bytesRxDelta long The delta number of RX (received) bytes from the previous event
bytesRxTotal long The total number of RX (received) bytes
bytesTxDelta long The delta number of TX (transmitted) bytes from the previous event
bytesTxTotal long The total number of TX (transmitted) bytes
class Class The class name
clientName String The client name
end Timestamp The end
poolAddress InetAddress The pool address
port int The port
start Timestamp The start
timeStamp Timestamp The timestamp

<section end='OpenVpnStatusEvent' />


SmtpMessageAddressEvent

<section begin='SmtpMessageAddressEvent' />

These events are created by SMTP subsystem and inserted to the mail_addrs table for each address on each email.

Attribute Name Type Description
addr String The address
class Class The class name
kind AddressKind The type for this address (F=From, T=To, C=CC, G=Envelope From, B=Envelope To, X=Unknown)
messageId Long The message ID
personal String personal
timeStamp Timestamp The timestamp

<section end='SmtpMessageAddressEvent' />


SmtpMessageEvent

<section begin='SmtpMessageEvent' />

These events are created by SMTP subsystem and inserted to the mail_msgs table for each email.

Attribute Name Type Description
addresses Set The addresses
class Class The class name
envelopeFromAddress String The envelop FROM address
envelopeToAddress String The envelope TO address
messageId Long The message ID
receiver String The receiver
sender String The sender
sessionEvent SessionEvent The session event
sessionId Long The session ID
subject String The subject
timeStamp Timestamp The timestamp
tmpFile File The /tmp file

<section end='SmtpMessageEvent' />


LoginEvent

<section begin='LoginEvent' />

These events are created by Directory Connector and inserted to the directory_connector_login_events table for each login.

Attribute Name Type Description
class Class The class name
clientAddr InetAddress The client address
domain String The domain
event String The event
loginName String The login name
timeStamp Timestamp The timestamp

<section end='LoginEvent' />