Logging Template
Use this template to configure local and remote logging parameters.
Each requires that you specify the minimum severity level of event to log.
-
Set up local logging in the Log Configuration and Log Facilities Configuration sections.
-
Set up remote logging by using the Remote Log Receivers section.
Minimum Severity Levels
In decreasing order of severity, the levels are as follows.
Severity Level | Description |
---|---|
EMERGENCY | System is unusable. |
ALERT | Includes all alarms the appliance generates: CRITICAL, MAJOR, MINOR, and WARNING. |
CRITICAL | Critical event. |
ERROR | An error. This is a non-urgent failure. |
WARNING | A warning condition. Indicates an error will occur if action is not taken. |
NOTICE | A normal, but significant, condition. No immediate action required. |
INFORMATIONAL | Informational. Used by Silver Peak for debugging. |
DEBUG | Used by Support for debugging. |
NONE | If you select NONE, no events are logged. |
-
The bolded part of the name is what displays in the log files.
-
If you select NOTICE (the default), the log records any event with a severity of NOTICE, WARNING, ERROR, CRITICAL, ALERT, and EMERGENCY.
-
These are purely related to event logging levels, not alarm severities, even though some naming conventions overlap. Events and alarms have different sources. Alarms, after they clear, list as the ALERT level in the Event Log.
-
In the Log Facilities Configuration section, assign each message/event type (System / Audit / Firewall / IDS/IPS) to a syslog facility level (local0 to local7).
Configure Remote Logging
You can configure the appliance to forward all events, at and above a specified severity, to a remote syslog server.
A syslog server is independently configured for the minimum severity level that it will accept. Without reconfiguring, it might not accept as low a severity level as you are forwarding to it.
To configure remote logging:
-
Under Remote Log Receivers, click Add.
-
For each remote syslog server that you add to receive the events, complete the following fields with the appropriate information.
Field Description Remote Receiver The remote receiver’s IP address. Port The port number of the remote syslog server. Valid values range from 2 through 65535. Protocol Select the protocol you want to apply: UDP, TCP, or TCP SSL. Minimum Severity Select the minimum severity level of messages you want to log: None, Emergency, Alert, Critical, Error, Warning, Notice, Info, or Debug. Facility Select all, local1, local2, local3, local4, local5, local6, or local7. Client Certificate If you selected TCP SSL protocol, do one of the following: Click Add to upload the certificate and key files. Then, complete the fields as explained below. Click View to view the client certificate. Click Don’t Apply if you do not want to apply the client certificate. Verify Click this cell to display a checkbox, and then select the checkbox to verify the server certificate.
Add a Client Certificate
To add a client certificate:
-
In the Client Certificate column, click Add.
The Add Remote Receiver SSL Certificate dialog box opens.
-
Complete the following fields.
Field Description PFX Certificate File To use a PFX certificate file, select this check box. Certificate File Click Choose File. Locate and select the certificate file, and then click Open. Private Key File Click Choose File. Locate and select the private key file, and then click Open. If you selected PFX Certificate File, this field is disabled. Import Password Enter the import password for the certificate. Passphrase Enter the passphrase for the certificate. -
Click Add.