root/mirror/edenwall/nulog2/branches/2.0/doc/enduser/nulog2-doc-en.rst
| Revision 7776, 4.1 kB (checked in by eric, 2 years ago) |
|---|
NuLog2 : user documentation
This documentation presents Nulog2, a web interface for display and analysis of Netfilter firewall logs, with user authentication or not.
Nulog2 homepage
- The default homepage for Nulog2 shows various information using indicators (called fragments) :
Users with most rejected traffic
IP Addresses with most rejected connections
Most rejected TCP ports
Most rejected UDP ports
Nulog2 homepage
Every view can be customized. When moving the mouse over the title of a fragment, some new elements appear. The black triangle, on the left, is a menu. From this menu, one can change the graphical representation of data: a choice is offered between list (the default view), chart, or pie. The number of displayed elements can also be changed.
A fragment displayed as chart: most rejected ports
The CSV button is used to export data from the fragment using the "Comma separated variables" (CSV) format.
Left column
The left column of the page contains some summarized information, for example the immediate rate of rejected packets on the firewall, on 1 minute; 5 minutes, and 15 minutes scales.
Some other links are displayed :
Connection tracking
This link opens a page presenting all authenticated connections opened at the moment on the firewall.
Last packets list
This page shows the list of last logged packets by the firewall, without any filtering criteria.
Search
This link opens a search window, which allows to display all connections corresponding to search criteria chosen by the user. It is also a convenient method to search into older time ranges, including archived (rotated) firewall logs in SQL tables.
N Connected users
This page displays, if using an authenticating firewall (NuFW), the list of connected users. Each connection matches an active NuFW client.
User session history
This page displays the history of connected users, with their current state. Sessions actually closed are also displayed.
Login
Offers the possibility to log in to Nulog2. Nulog2 allows identified users to customize their display, by choosing the fragments, the display method etc. Nulog2 will remember customized settings for this user.
Reinitialize settings
Reinitialize Nulog2 homepage. The default display is restored for the current user, exactly like the first connection
Navigating and using search criteria
Starting from Nulog2 homepage, the user can browse the interface by clicking on the links displayed on every fragment. The search criteria will be combined each time a new one is chosen. For example, when clicking a TCP port number, the page will display a summary of information related to this TCP port. The user can, from this page, narrow his search by choosing a user name or an IP address. The next page will display the results for the search using both criteria.
This page show the connections sorted according to the user choice. Here, we see all connections initiated by the application "ssh", for a given destination. As we can see, user "lds" has sufficient permissions and is allowed, while user "debian" is rejected.
The user can, on any page, remove a search criteria, by clicking on the filtering criteria displayed at the top of the page on the line "Active filter".
Homepage customization
Users can add fragments to their homepage. One just need, on any page, to click on the heart symbol of the title of a fragment.
Additionally, the title of any fragment can be changed by clicking the pen symbol on the left of the fragment title.
It is also possible to change the position of a fragment using drag and drop: click on the title, keep the button pressed, and move the fragment to another location.
