WatchGuard Technologies Firebox X Reviewing and Working with Log Files, Types of Log Messages

CHAPTER 5 Reviewing and Working with Log

Files

WatchGuard® System Manager includes strong and flexible log message tools. An important feature of a good network security policy is to log messages from your security systems, to examine those records fre- quently, and to keep them in an archive. You can use logs to monitor your network security, identify any security risks, and address them.

The WatchGuard Firebox X Core and Firebox X Peak send log messages to a shared log management sys- tem called the Log Server. They can also send log messages to a Syslog server or keep logs locally on the Firebox. It is your decision to send logs to any or all of these locations.

You can use Firebox System Manager to log messages in the Traffic Monitor tab. For more information, see the Configuration Guide. You can also examine log messages with LogViewer. The log messages are kept in an XML file with a .wgl.xml extension in the WatchGuard directory on the log server. You can open this file using any XML editing tool to see full log messages.

Types of Log Messages

The Firebox® sends four types of log messages. Log messages created with Fireware appliance software include the name of the log type in each log message. Log messages created with WFS appliance software give the same data, but do not include the log type category name in the body of the message.

•Traffic

•Alarm

•Event

•Diagnostic

Traffic log messages

The Firebox sends traffic log messages as it applies packet filter and proxy rules to traffic that goes through the Firebox.

User Guide 37