WatchGuard Firebox System 4.6 User Guide

Designating Event Processors for a Firebox3 Click OK.The Logging Setup dialog box closes and removes the Event Processor entry from theconfiguration file.If you move the Event Processor to a host on another networkand change the Event Processor’s host address on the Firebox,make sure to uninstall the Event Processor software from themachine that is no longer the Event Processor host.Reordering Event ProcessorsEvent Processor priority is determined by the order in which they appear in theLiveSecurity Event Processor(s) list. The host that is listed first receives log messages.Use the Up and Down buttons to change the order of the Event Processors. From theLogging Setup dialog box:• To move a host down, click the host name. Click Down.• To move a host up, click the host name. Click Up.Synchronizing Event ProcessorsSynchronizing Event Processors is the act of setting the clocks of all your EventProcessors to a single common time source. Synchronizing Event Processors keepslogs orderly and avoids time discrepancies in the log file if failovers occur.The Firebox sets its clock to the current Event Processor. If the Firebox and the EventProcessor time are different, the Firebox time drifts toward the new time, which oftenresults in a brief interruption in the log file. Rebooting the Firebox resets the Fireboxtime to that of the primary Event Processor. Therefore, you should set all EventProcessors’ clocks to a single source. In a local installation where all Event Processorsare on the same domain, set each Event Processor to the common domain controller.For Windows NT Event Processors1 Go to each Event Processor. Open an MS-DOS Command Prompt window. Typethe following command:net time /domain:domainName /setwhere domainName is the domain in which the Event Processors operate.The system returns a message naming the domain controller.2 Type Y.The time of the local host is set to that of the domain controller.Another way to set the Event Processor (and domain controller) clocks is to use anindependent source such as the atomic clock—based servers available on the Internet.One place to access this service is:http://www.bldrdoc.gov/timefreq72