WatchGuard Firebox System 7.0 User Guide

Working with Log Files5 Stop and restart the WatchGuard Security EventProcessor: Right-click the WatchGuard Security EventProcessor in the Windows desktop tray. Select StopService. Right-click the icon again and select StartService.New log files will be created in the specified directory. You canalso move any existing log files from the old location to the newone to avoid confusion.Setting log encryption keysThe log connection (but not the log file) between the Fireboxand an event processor is encrypted for security purposes.Both the management station and the WatchGuardSecurity Event Processor must have the same encryptionkey. From the WSEP Status/Configuration user interface:1 Select File => Set Log Encryption Key.The Set Log Encryption Key dialog box appears.2 Enter the log encryption key in the first box. Enter thesame key in the box beneath it to confirm.Sending logs to a log host at anotherlocationBecause they are encrypted by the Firebox, you can sendlog files over the Internet to a log host at another office.You can even send this traffic over the Internet from theFirebox at one office to the log host behind a second Fireboxat a remote office. One application of this feature mightinvolve configuring the Firebox at a remote office to storeits logs on a log host behind the Firebox at the main office.To do this, you must configure the Firebox at the remoteoffice such that it knows where and how to send the logfiles. The main office Firebox must be configured to allowthe log messages through the firewall to the log host.On the main office Firebox:1 Open Policy Manager with the current configurationfile.User Guide 231