WSM Reference Guide - WatchGuard Technologies

Alarm LogsTraffic AlarmsDefaultNameESP-Replay-ErrorMessage Format Example Message Caused Byalarm_name detected. ESP replayerror, policy_id=policy_id_number,local_ip=local_IP_address,peer_ip=peer_IP_address, spi=spi,sa_id=ID_of_SA,interface=interface_number, thefirst (x) bytes are list_of_first xnumber of bytes.ESP-Replay-Error detected. ESPreplay error, policy_id=2,local_ip=10.10.10.10,peer_ip=192.168.228.226,spi=12345678, sa_id=1000,interface=1, the first 80 bytes areA0 B1 C2.........These alarms aretriggered by the trafficevent“ESP_REPLAY_ERROR”.AH-Replay-Erroralarm_name detected. AH replayerror, policy_id=policy_id_number,local_ip=local_IP_address,peer_ip=peer_IP_address, spi=spi,sa_id=ID_of_SA,interface=interface_number, thefirst (x) bytes are list_of_first xnumber of bytes.AH-Replay-Error detected. AHreplay error, policy_id=2,local_ip=10.10.10.10,peer_ip=192.168.228.226,spi=12345678, sa_id=1000,interface=1, the first 80 bytes areA0 B1 C2.........These alarms aretriggered by the trafficevent“AP_REPLAY_ERROR”.Invalid-SPIalarm_name detected. Invalid SPI%d(0x%x) detected on interfaceinterface_number, the first (x) bytesare list_of_first x number of bytes.Invalid-SPI detected. Invliad SPI12345678 (0xBC614E) detected oninterface 1, the first 80 bytes are A0B1 C2........These alarms aretriggered by the trafficevent “INVALID_SPI”.Other-Policy-Erroralarm_name detected. Policy errordetected on interfaceinterface_number, the first (x) bytesare list_of_first x number of bytes.Other-Policy-Error detected. Policyerror detected on interface 1, thefirst 80 bytes are A0 B1 C2............These alarms aretriggered by the trafficevent“OTHER_AUTH_ERROR”.Probe AlarmsDefaultNameAny ProbeAlarmMessage Format Example Message Caused ByOperator [Probe probe_name:probe_value (value)alarm_cond_op_name threshold(threshold)]NOTE: The content of this alarmmessage is based on the event thattriggered the alarm. See theexamples below.These alarms aretriggered by countervalues.Link-Down[Probe Link Status: 0.00 (value)becomes 0.00 (threshold)] OR[Probe Link Status: 1.00 (value)becomes 0.00 (threshold)] OR[Probe Link Status: 0.00 (value)becomes 0.00 (threshold)]These alarms aretriggered by interfacecounters..40 WatchGuard System Manager