Logging Tab

Administration > General Settings > Setup > Logging

The Logging tab summarizes the following configured logging parameters:

• Log Settings refers to local logging.

• Log Facilities Configuration refers to remote logging.

The logs keep track of alarms, events, and any other issues involving your appliances.

The following table provides more details.

To edit the logging configuration for one of the listed appliances, click the edit icon in the left column of the table. The Logging dialog box opens. For details, see Logging Dialog Box

Severity Levels

In order of decreasing severity, the levels are as follows:

These are related to event logging levels, not alarm severities, even though some naming conventions overlap. Events and alarms have different sources. Alarms, when they clear, list as the ALERT level in the Event Log.

Remote Logging

• You can configure the appliance to forward all events, at and above a specified severity, to a remote syslog server.

• A syslog server is independently configured for the minimum severity level that it will accept. Without reconfiguring, it might not accept as low a severity level as you are forwarding to it.

• Each message/event type (System / Audit / Firewall / Ids) is assigned to a syslog facility level (local0 to local7).

Logging Dialog Box

Use this dialog box to configure log settings and log facilities. You can also add remote log receivers.

WARNING: Appliance logging levels should only be set to “Notice” unless TAC asks you to set it differently. This applies to both the Minimum severity level field in the Log Settings area of this dialog box and the Minimum Severity field in the Remote Log Receivers area. Be aware that setting this level to “Debug” will generate logs for all modules that are turned on, which causes the packet processing engine to spend excessive time logging instead of forwarding packets.

Log Settings

Log Facilities Configuration

Select the log facilities you want the System, Audit, Firewall, and IDS/IPS Events logs to use. You can choose between Local0 and Local7 for each.

NOTE: The log facilities you select for System, Audit, Firewall, and IDS/IPS Events must be uniquely assigned; they cannot overlap. For example, System can be assigned to local2 and Audit to local3, but both cannot be assigned to local2.

Remote Log Receivers

Follow these instructions to add a remote receiver for an appliance syslog server that uses an end entity certificate.

NOTE: To use an end entity certificate, you must first create an end entity certificate for use. To do this, see End Entity Certificates Tab.

1. Navigate to Administration > General Settings > Setup > Logging.

2. Click the edit icon next to the appliance for which you want to configure a receiver.

   The Logging dialog box opens.

3. Under Remote Log Receivers, click Add and then configure the following information.

   Field	Description
   IP Address	Enter the IP address for the remote receiver.
   Port	Enter the port number of the remote syslog server. The default for TCP SSL is 6514.
   Protocol	Select TCP SSL.
   Minimum Severity	Select the minimum severity level of messages you want to log. (See the WARNING note above.) For details about severity levels, see Severity Levels. For Common Criteria mode, Debug should be used to ensure all logs are sent to the syslog receiver.
   Facility	Select all, local1, local2, local3, local4, local5, local6, or local7.

4. In the Client Certificate column, click Add.

   The Add Remote Receiver SSL Certificate dialog box opens.

5. Click Use End Entity Certificate and then select the end entity certificate from the End Entity Certificate drop-down menu.

6. Click the cell in the Verify column to display a check box, and then click the check box to verify the server certificate.

7. Click Add.

8. Click Save.

For information about remote log receivers, including how to add and configure a receiver, see Remote Log Receivers.

---