Monitoring of program operation

You can monitor the program by using widgets and dashboards. You can filter monitoring data by period and by cluster nodes.

The Dashboard section of the program web interface displays the following information:

1. System Health. A chart of errors encountered by the cluster. You can click Go to Nodes to go to the Nodes section and view details about the health of each cluster node.
2. Processed. This widget displays statistics of program actions applied to all processed email messages:
   • Attachments deleted.
   • Deleted.
   • Disinfected.
   • Quarantined.
   • Rejected.
   • Skipped.

   You can click Size or Count to toggle between total size or count of all processed messages respectively.

3. Detected. This widget displays the number of detected objects grouped by protection module:
   • Anti-Phishing.
   • Anti-Spam.
   • Anti-Virus.
   • Content Filtering.
   • Mail Sender Authentication.
   • Links scanning.
   • KATA.

     This is displayed only when KATA integration is configured.

   If a protection module detects multiple objects in a message, only one object is counted for that module in statistics. If multiple objects are detected in a message by different protection modules, one object is counted in statistics for each protection module.

   You can click the link in the upper-right corner of the information pane to go to the Events section and view related events containing detection information for a selected period.

4. Widgets that display the number of messages scanned by the given module and grouped by scan result:
   • Anti-Virus.
   • Anti-Spam.
   • Anti-Phishing.
   • Content Filtering.
   • Links scanning.
   • Mail Sender Authentication.

   Only the Anti-Virus widget is displayed by default. You can create a new widget layout or modify the current layout to add the widgets you need.

   All widgets with protection module statistics display the following scan statuses:

   • Detected means the message was found to contain an object that satisfies rule application criteria.
   • Not detected means the message was scanned and does not contain threats or other objects.
   • Document with macro means the message has an attachment, which contains a document with macros.

     Only applies to Anti-Virus.

   • Quarantined means the message was moved to Anti-Spam Quarantine.

     A Backup location where email messages are temporarily kept if the Anti-Spam module is unable to assign a final status after a scan.

     Only applies to Anti-Spam.

   • Not processed is a group of statuses that are assigned to the message if it was not scanned for one of the following reasons:
     • Encrypted means an object could not be scanned because it is encrypted.

       Only applies to Anti-Virus.

     • Error means an error occurred when scanning the message.
     • Bases error means the message could not be scanned because program databases were not loaded.
     • License restrictions means the message could not be scanned because of program licensing limitations (for example, the license key could have expired).
   • Disabled by settings is a group of statuses assigned to the message if it was not scanned in accordance with one of the following program settings configured by the administrator:
     • Allowlist means the message was delivered without scanning because the sender address is on the global allow list.
     • Denylist means the message was rejected without scanning because the sender address is on the global deny list.
     • Nesting level exceeded means the maximum archive nesting level configured in general protection settings was reached.

       Only applies to Anti-Virus.

     • Personal allowlist means the message was not scanned by the Anti-Spam module because the sender address is on the personal allow list of the recipient.

       Only applies to Anti-Spam.

     • Personal denylist means the sender address is on the personal deny list of the recipient. The action configured in personal list settings was applied to the message.

       Messages placed in Backup based on personal list settings are not counted. Such messages are accounted for in statistics for other statuses in accordance with the scan result.

     • Local policy means the message was sent from a relay IP.

       Only applies to Mail Sender Authentication.

     • Disabled in protection settings the module is turned off in general protection settings or in a message processing rule.
     • Already processed by another module means the message was not scanned by this module because the message was already scanned by a different protection module and a Reject or Delete message action was applied to the message (and a copy of the message was not put in Backup).
5. Last threats. Table with information about recent detected threats:
   • Time is the time when the threat was detected.
   • Threat name is the name of the threat detected in the object.
   • Result is the action performed with the object.

   All information currently available to the program is displayed. Time filtering criteria are not applied.

6. Messages. This widget displays the incoming and outgoing email traffic processed by the program.

   When counting outgoing messages, notifications sent by the program are counted, but messages with Deleted, Rejected, and Quarantined scan status are not counted.

   You can click Size or Count to toggle between total size or count of incoming and outgoing messages respectively.

7. Top rules applied. Table with information about rules that were most frequently applied when processing messages:
   • Rule name is the name of the applied rule set by the administrator.
   • Count is the trigger count for the rule.

   If the rule was deleted by the administrator, it is not displayed on this dashboard.

Not all dashboards are displayed by default. You can create a new layout and add the panes you need, and then switch between available layouts.

In this Help section Creating a new layout Modifying a layout Removing a layout Selecting a layout from the list Filtering monitoring data

Page top