Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 0 subscribers
  • Views 6940 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DataControl.txt - what is logged and what not

QC

While replying top BopBop's post I found out that verbose logging does only log at least partially matched rules. Now we can assume that all rules are considered but some don't match for one reason or the other (if you think about it there's lots of work going on under the bonnet).

The problem I see is that you have no indication why some don't match and the more rules you have the more problematic it gets. I don't know the internals but I assume that the destination is checked first. The problem here is that you might miss a new destination (e.g. IE 9 or Firefox 4) as you don't get any information at all why the rules have not matched. Next are probably the exclusions and then type inclusions. Again you don't get any indication why a particular rule didn't match. Finally a content rule is not listed in the log if no expression matches. So I think the verbose log can help you to find out why a transfer has been blocked or only when there's at least a partial match in a content rule why it hasn't. Otherwise you're left in the dark.  

Or have I overlooked something?

Christian

:13067


This thread was automatically locked due to age.
Parents
  • 0

    Hi Christian,

    You are right. In the current implementation of the verbose log we only show matches where there has been at least a partial match. The main use case for the verbose log is to help test custom content control lists. I agree that we could provide more detail in the verbose log, however I wouldn't want to do this at the cost of any additional performance overhead. At the moment we only trigger content analysis if the file meets the other rule criteria such as being transferred onto a monitored storage destination or into a monitored application. In priority order what are the additional pieces of information you'd like to see in the verbose log?

    Thanks,

    John

    :13337
Reply
  • 0

    Hi Christian,

    You are right. In the current implementation of the verbose log we only show matches where there has been at least a partial match. The main use case for the verbose log is to help test custom content control lists. I agree that we could provide more detail in the verbose log, however I wouldn't want to do this at the cost of any additional performance overhead. At the moment we only trigger content analysis if the file meets the other rule criteria such as being transferred onto a monitored storage destination or into a monitored application. In priority order what are the additional pieces of information you'd like to see in the verbose log?

    Thanks,

    John

    :13337
Children
No Data
Unfiltered HTML