WSM Reference Guide - WatchGuard Technologies

CHAPTER 4
Log Messages
Understanding the log messages the Firebox sends to the log file is a critical function for a Firebox
administrator. The log messages give you important information about the flow of traffic through your
network. The log messages are also a key component in troubleshooting problems that occur in your
network.
This chapter explains the types of log messages the Firebox generates. It gives examples of traffic and
alarm log messages and a list of available event logs for Fireboxes using Fireware appliance software.
You can get access to the Fireware XML log DTD and schema using through the FAQs available at
www.watchguard.com/support.
Introduction to Logging
The WatchGuard Firebox X Core and Firebox X Peak send log messages to a WatchGuard log server. They
can also send log messages to a syslog server or keep logs locally on the Firebox. It is your decision to
send logs to any or all of these locations.
You can see log messages in real time using the WatchGuard System Manager Traffic Monitor. You can
also show the logs in the LogViewer. The log messages are kept in an XML file with a .wgl.xml extension
in the WatchGuard directory on the log server. If it becomes necessary, you can open this file using any
XML tool to see log messages.
The Firebox sends four types of log messages:
• Traffic logs
• Alarm logs
• Event logs
• Diagnostic logs
Traffic logs
The Firebox sends traffic logs as it applies packet filter and proxy rules to traffic passing through the Firebox.
Reference Guide 27