WatchGuard Firebox System 7.0 User Guide

Chapter 12: Setting Up Logging and NotificationLog file size and rollover frequencyYou can set the maximum size of the log file by number oflog entries or by time (such as daily, weekly, or monthly).When the log file reaches the maximum according to yoursettings, the log host creates a new file or overwrites theold file. Log rollover is the frequency at which log filesbegin overwriting.For example, suppose you have set your log file maximumto 100,000 entries. Operation of your Firebox begins on July21. By July 26, the log file has 100,000 entries. At this point,the log host starts writing July 27 log entries to a new fileand the other file becomes the old file.The ideal maximum log file size is highly individual: It willbe based on the storage space available, how many days oflog entries you want on hand at any time, and how long alog file is practical to keep, open, and view. How quickly afile hits its maximum size and is overwritten is also determinedby how many event types are logged and howmuch traffic the Firebox processes. For example, a smalloperation might not see 10,000 entries in two weeks,whereas a large one with many services enabled might easilylog 100,000 entries in a day.When considering your ideal maximum log file, considerhow often you plan to issue reports of the Firebox activity.WatchGuard Historical Reports uses a log file as its sourceto build reports. If you issue weekly reports to management,you would want a log file large enough to hold atypical eight or nine days’ worth of events. Watch your initiallog file configuration to see how many days’ events itcollects before turning over, and then adjust the size toyour reporting needs.Setting the interval for log rolloverYou can control when the WSEP application rolls overusing the Log Files tab in the WatchGuard Security EventProcessor. The WSEP application can be configured to roll212 WatchGuard Firebox System