WSM Reference Guide - WatchGuard Technologies

Event Logs
Gateway AntiVirus Service Alarms
Default
Name
AV
Message Format Example Message Caused By
alarm_name-”AV” alarm id,
timestamp, message, source IP,
destination IP, protocol, source
port, destination port, source
interface, destination interface,
virus name, sender, log_type=”al”
alarm_name="AV"
alarm_id="6001" time="Mon Aug 2
22:20:44 2004 (PST)" msg="SMTP
Filename" src_ip="192.168.1.102"
dst_ip="16.0.0.107" pr="tcp/smtp"
src_port="1384" dst_port="25"
src_intf="PPTP" dst_intf="1-
Trusted" virus="Eicar-Test-
Signature"
sender="phillip@sjcqa.com"
log_type="al"/
These alarms are caused
by events associated with
each AV rule of the SMTP
proxy action.
Intrusion Prevention Service Alarms
Default
Name
IPS
Message Format Example Message Caused By
alarm_name=”IPS”, alarm id,
timestamp, message, source IP,
destination IP, protocol, source
port, destination port, source
interface, destination interface, IPS
message, signature category,
signature ID, log_type=”al”
alarm_name="IPS"
alarm_id="3001" time="Wed Aug 4
00:58:33 2004 (PST)" msg="IPS"
src_ip="16.0.0.1"
dst_ip="16.0.1.107" pr="tcp/http"
src_port="4110" dst_port="80"
src_intf="1-Trusted" dst_intf="0-
External" ips_msg="WEB-ATTACKS
kill command attempt"
signature_cat="http-request"
signature_id="1335"
log_type="al"/
These alarms are caused
by different protocol
types.
Event Logs
Event logs are created because of Firebox user activity. Events that cause event logs include:
• Firebox start up/shut down
• Firebox and VPN authentication
• Process start up/shut down
• Problems with the Firebox hardware components
• Any task done by the Firebox administrator
On a Firebox using Fireware appliance software, there are seven product components, including 27 different
log modules, that create event and diagnostic log messages to send to the log server. The function
of each log module is shown in the table that follows.
Reference Guide 41