Filter Antivirus Logs
- Click 'More' on the 'CAV' home screen
- Click 'View Logs' in the 'More' interface
- Click ‘Antivirus Events’ in ‘Logs Per Module' option
- The 'Antivirus logs' can be viewed by selecting 'Antivirus Events' from the drop-down of the log viewer interface.
- You have 4 categories of filter that you can add. Each of these categories can be further refined by selecting or deselecting filter parameters, or by typing a search term in the field provided.
You can add and configure any
number of filters in the 'Advanced Filter' dialog.
Following are the options available in the 'Advanced Filter' drop-down:
i. Action:
- Lets you filter logs by the action taken by CAV on the threat.
- Selecting the 'Action' option displays a drop down field and a set of specific filter parameters that can be selected or deselected.
-
Select 'Equal' or 'Not Equal' option from the drop down. 'Not Equal' will invert your selected choice.
-
Now select the checkboxes of the specific filter parameters to refine your search. The parameter available are:
- Quarantine: Displays events where the user chose to quarantine a file
- Remove: Displays events where the user chose to delete an item
- Ignore: Displays events where the user chose to ignore an item
- Detect: Displays events for detection of a malware
- Ask: Displays events when user was asked by alert concerning some Antivirus event
- Restore: Displays events of the applications that were quarantined and restored
For example, if you checked the 'Quarantine' box then selected 'Not Equal', you would see only those Events where the Quarantine Action was not selected at the virus notification alert.ii. Status:
- Lets you filter logs by the success or failure of the action taken by CAV.
- Selecting the 'Status' option displays a drop-down field and a set of specific filter parameters that can be selected or deselected.
-
Select 'Equal' or 'Not Equal' option from the drop-down field. 'Not Equal' will invert your selected choice.
-
Now select the checkboxes of the specific filter parameters to refine your search. The parameter available are:
iii. Location:
- Success: Displays Events that successfully executed (for example, the malware was successfully quarantined)
- Failure: Displays Events that failed to execute (for example, the database malware was not disinfected)
-
Lets you filter logs by location of the threat
- Selecting the 'Location' option displays a drop-down field and text entry field.
-
Select 'Contains' or 'Does Not Contain' option from the drop-down field.
-
Enter the text or word that needs to be filtered.
For example, if you select 'Contains' option from the drop-down and enter the phrase 'var/folders/' in the text field, then all events containing the entry /var/folders/' in the Location field will be displayed. If you select 'Does Not Contain' option from the drop-down field and enter the phrase 'var/folders/' in the text field, then all events that do not have the entry 'var/folders/' will be displayed.
iv. Malware Name:
- Lets you filter logs by the threat name
- Selecting the 'Malware Name' option displays a drop-down field and text entry field.
-
Select 'Contains' or 'Does Not Contain' option from the drop-down field.
-
Enter the text in the name of the malware that needs to be filtered.
For example, if you choose 'Contains' option from the drop-down and enter the phrase 'malware@#3' in the text field, then all events containing the entry malware@#3 in the Malware Name field will be displayed. If you choose 'Does Not Contain' option from the drop-down and enter the phrase 'malware@#3' in the text field, then all events that do not have the entry 'malware@#3' in the 'Malware Name' field will be displayed.
- You can add more filter types in the 'Advanced Filter' pane by clicking the button at the top right of the filter pane.
- You can also remove a filter type by clicking the button at the top right of the filter pane.
- The filters to be applied to the
Antivirus log viewer. Only those entries selected based on your set
filter criteria will be displayed in the log viewer.