Quarantine (Tracking) Logs

What Are Quarantine (Tracking) Logs?

Quarantine (Tracking) Logs are the live content of the tracking stage of the Quarantine action assigned to a vService. The Quarantine action works in three stages: Tracking → Evaluation → Quarantine; this view reflects the first stage: it shows the metrics of the clients that are tracked according to the specified Tracking Key keys but not yet quarantined.

Each row represents a unique combination of the selected Tracking Key keys. Each selected key appears as a separate column in the table; next to them are the counters (HTTP Requests, HTTP Errors, Incoming Data, Outgoing Data, Total Connections, Current Connections) produced by that combination during the period (Tracking Time).

Thanks to this view, clients that could pose a potential threat can be monitored and analyzed before they are quarantined. Clients that have actually been quarantined by meeting the quarantine conditions are listed in the Quarantine (Quarantine) Logs view.

Monitoring

Before quarantine

Counters of tracked clients

Key-Based

Tracking Key

Configurable tracking keys

Counters

Requests · data · connections

Metrics that feed the threshold evaluation

Live

Instant table

Current content of the tracking table

HTTP + TCP

Two protocols

Different metrics by protocol

Manageable

Remove from Table

Tracking records can be cleared

Quarantine (Tracking) Logs are not a recorded history log; they are the current content of the tracking table. Records drop from the table when the Tracking Time defined in the action expires. The Last Event and Expiry Date information is kept separately for each record (row).

Supported vService Types

HTTP

L7 TCP

Network

How to Enable?

This view does not require a separate enabling; it becomes usable automatically when a Quarantine action is defined on the vService. The keys to be tracked (Tracking Key) and the tracking time (Tracking Time) are determined in the action's own configuration.

Appearance in the drop-down menu

This record source appears in the source list in the Logs & Tracking tab together with the action's name and tracking time, in the <action name> (TRACKING, <Tracking Time>) format (e.g. quarantine (TRACKING, 1m)).

Viewing

1. Left Monitor Panel is opened.
2. Load Balancer vServices is selected from the category tabs at the top left.
3. The vServices defined on TR7 are listed.
4. The vService to be monitored is clicked; the screen opens with the Dashboard tab that carries the vService's name.
5. On the screen that opens, the Logs & Tracking tab is clicked and the (TRACKING, …) entry of the related Quarantine action is selected.

Quarantine (Tracking) Logs Listing Screen

When the related tracking source is selected, the current content of the tracking table is listed as a table.

Quarantine (Tracking) Logs Listing Screen

The table contains a key column for each Tracking Key, and the counter columns accumulated by that combination. Below, the columns of a configuration with the default Source (Client) IP Address key are given:

Column	Description
Last Event	The date and time the key combination was last processed (last event).
Expiry Date	The date on which the record will drop from the tracking table (expire).
Source (Client) IP Address (key)	Tracking key; client IP address.
HTTP Requests	The number of HTTP requests received during the period.
HTTP Errors	The number of HTTP errors that occurred during the period.
Incoming Data (B)	The amount of data received during the tracking period. Although the label says bytes, the value is written converted to a readable unit.
Outgoing Data (B)	The amount of data sent during the tracking period. Although the label says bytes, the value is written converted to a readable unit.
Total Connections	The number of connections established during the tracking period. Despite its name, it is not a cumulative total.
Current Connections	The number of currently open connections. It is the only counter that does not depend on the period.

The following column is hidden by default and is added from the column selector:

Column	Description
Source	The name of the TR7 device that holds the record (in cluster setups). It is always present in the preview panel.

INFO

In the list, these columns appear with abbreviated headings: the key as ↓IP; the counters as ↓Request, ↓Request.error, ↓Data / ↑Data, ↓Connection, ↓Connection.current. In the preview panel, they are shown with their full names and their values together with the tracking period (e.g. 2 / 10 minute(s)).

A quarantined client does not drop from this table

When a client is quarantined, its tracking row is not deleted; it only stops being updated and continues to remain in the list until its own Tracking Time expires. For this reason, the same client can be listed for a while both in this view and in the Quarantine (Quarantine) Logs view.

INFO

The key columns vary according to the configured Tracking Key values; when more than one key is selected, each becomes a separate column. The counter columns vary by protocol: in L7 TCP vServices, the HTTP Requests and HTTP Errors columns are not present; only the data and connection counters are shown.

The items in the toolbar are arranged from left to right in the following order; the last two items (Page Information and Page Size) are located in the information strip below the table.

Columns

Which columns are shown in the table is selected. In the same panel, columns are reordered by dragging and alignment is selected per column; the row height is fitted to the page with the Fit rows to the page button, and the column layout is reset to default with the Reset button. The layout is stored per user.

Logs Type

Determines the source to be viewed. The (TRACKING, …) entry of the related Quarantine action is selected.

Filter

The Filter button is used to filter the list according to specific criteria. The filter criterion is the Tracking Key selected in the action (e.g. ↓IP in this configuration).

Export

The table is exported as Excel, CSV or PDF by clicking the Export button. In the window that opens, the Filename, Format and Data Source, together with the Columns to be exported, are determined; the remaining fields are displayed according to the format: CSV Separator for CSV, Excel Sheet Name for Excel, and Page Orientation and Page Size for PDF.

Refresh

The current content of the tracking table is fetched by clicking the Refresh button. Since the list is not refreshed automatically, the current state is obtained with this button. While fetching is in progress, the button stays inactive and shows a spinning icon.

Remove from Table

When one or more rows are selected and the Remove from Table button is clicked, the tracking records accumulated by the related keys are removed from the table. The operation asks for confirmation and cannot be undone; the button is inactive while no row is selected. Deletion touches only the tracking table: a client that is currently in quarantine is not released. The trash can in the header of the preview panel does the same job but does not ask for confirmation. The same operation is also available in the right-click menu.

Search

Used to search all information in the table.

RegExp Search

Used to search all information in the table with a regular expression (RegExp).

Column Based Search

Used to perform a column-based search on the information in the table.

Page Information

Contains information about the total number of fetched records and the range of records displayed in the list: Showing N-M of T records and the number of selected rows (N selected, or Nothing selected when there is no selection).

Page Size

The maximum number of records to be displayed on the page is selected. The default is 100; the options are 50, 100, 250 and All. The selection is not stored.

Right-Click Menu

When a row is right-clicked, a menu with a single operation opens. The operation applies only to the right-clicked record; a selection made in the list does not affect the menu.

Operation	What it does
Remove from Table	Removes the right-clicked record from the tracking table; like Remove from Table in the toolbar, it asks for Are you sure? confirmation. It is not displayed in the menu while the operation is in progress.

Preview of the Selected Log

When any row in the list is clicked, the preview panel of that record opens. The panel shows the key and the counters with their full names one below the other; the counter values other than Current Connections are given together with the tracking period (e.g. 2 / 10 minute(s)).

Preview of the Selected Log

Operations are performed on the record with the icon at the top right of the header:

Operation	What it does
Remove from Table	Removes the record from the tracking table; the counters accumulated by the key are reset. Unlike the toolbar and right-click paths, it deletes without asking for confirmation.

Information	Description
Source	The name of the TR7 device that holds the record (in cluster setups).
Last Event	The date and time the key combination was last processed.
Expiry Date	The date on which the record will drop from the tracking table.
Source (Client) IP Address	Tracking key; client IP address.
HTTP Requests	The number of HTTP requests received during the period.
HTTP Errors	The number of HTTP errors that occurred during the period.
Incoming Data (B)	The amount of received data.
Outgoing Data (B)	The amount of sent data.
Total Connections	The number of connections established during the tracking period. Despite its name, it is not a cumulative total.
Current Connections	The number of currently open connections. It is the only counter that does not depend on the period.