WatchGuard Firebox System 4.6 User Guide

Customizing logging and notification by service or optionPopup WindowTriggers a pop-up window display on the Event Processor when the event occurs.Custom ProgramTriggers a custom program when the event occurs. WatchGuard allows only onenotification type per event. A custom batch file or program enables you to triggermultiple types of notification. Type the full path to the program in theaccompanying field, or use Browse to locate and select the program.Setting Launch Interval and Repeat CountThere are two parameters that work in conjunction with the Event Processor RepeatInterval to control notification timing:Launch IntervalThe minimum time (in minutes) between separate launches of a notifier. Set thisparameter to prevent the launch of several notifiers in response to similar eventsthat take place in a short amount of time.Repeat CountThe threshold for how often a notifier can repeat before the Firebox activates thespecial repeat notifier. The repeat notifier creates a log entry that the notifier inquestion is repeating. Notification repeats only after this number of events occurs.For an example of how launch interval and repeat count interact, see the NetworkSecurity Handbook.Setting logging and notification for a serviceFor each service added to the Services Arena, you can control logging and notificationof the following events:• Incoming packets that are allowed• Incoming packets that are denied• Outgoing packets that are allowed• Outgoing packets that are deniedFrom Policy Manager:1 Double-click a service in the Services Arena.The Properties dialog box appears.2 Click Logging.The Logging and Notification dialog box appears. The options for each service are identical; themain difference is based on whether the service in question is for incoming, outgoing, orbidirectional communication.3 Modify logging and notification properties according to your security policypreferences. Click OK.Setting logging and notification for default packet-handlingoptionsWhen this option is enabled, you can control logging and notification properties forthe following default packet-handling options:User Guide 77