WSM Reference Guide - WatchGuard Technologies

CHAPTER 4Log MessagesUnderstanding the log messages the Firebox sends to the log file is a critical function for a Fireboxadministrator. The log messages give you important information about the flow of traffic through yournetwork. The log messages are also a key component in troubleshooting problems that occur in yournetwork.This chapter explains the types of log messages the Firebox generates. It gives examples of traffic andalarm log messages and a list of available event logs for Fireboxes using Fireware appliance software.You can get access to the Fireware XML log DTD and schema using through the FAQs available atwww.watchguard.com/support.Introduction to LoggingThe WatchGuard Firebox X Core and Firebox X Peak send log messages to a WatchGuard log server. Theycan also send log messages to a syslog server or keep logs locally on the Firebox. It is your decision tosend logs to any or all of these locations.You can see log messages in real time using the WatchGuard System Manager Traffic Monitor. You canalso show the logs in the LogViewer. The log messages are kept in an XML file with a .wgl.xml extensionin the WatchGuard directory on the log server. If it becomes necessary, you can open this file using anyXML tool to see log messages.The Firebox sends four types of log messages:• Traffic logs• Alarm logs• Event logs• Diagnostic logsTraffic logsThe Firebox sends traffic logs as it applies packet filter and proxy rules to traffic passing through the Firebox.Reference Guide 27