-
Products
-
SonicPlatform
SonicPlatform is the cybersecurity platform purpose-built for MSPs, making managing complex security environments among multiple tenants easy and streamlined.
Discover More
-
-
Solutions
-
Federal
Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn MoreFederalProtect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn More - Industries
- Use Cases
-
-
Partners
-
Partner Portal
Access to deal registration, MDF, sales and marketing tools, training and more
Learn MorePartner PortalAccess to deal registration, MDF, sales and marketing tools, training and more
Learn More - SonicWall Partners
- Partner Resources
-
-
Support
-
Support Portal
Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn MoreSupport PortalFind answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn More - Support
- Resources
- Capture Labs
-
- Company
- Contact Us
Various GMS Syslog file formats during Summarization
03/26/2020 
1,092 People found this article helpful
475,897 Views
Description
SGMS: Various Syslog file formats during Summarization
Resolution
This article helps us to understand the various file formats that the Syslog are converted in the process of the Summarization.
Once the GMS/Analyzer IP is configured on the SonicWall unit, the syslog traffic will start to flow on port UDP 514. These files will initially get stored on the hard drive at the path location specified. If the Analyzer on the C drive, then the syslog will initially be stored on C:/GMSVP/syslog
The message will get stored as a .log file.
This file size gets increased and when it reaches a limit of 10000 lines or is opened for more than three minutes, the this file is converted to .SRC and it is set ready for processing.
The format of the file as follows:
AgentID_YYYYMMDD_HHMMSS_to_YYYYMMDD_HHMMSS.SRC
Once the summarizer process is started, the Reports Summarizer groups the .SRC files and changes the format of the file to .UNP. Still this file remains in the Syslog sub folder.
The format of the file will be as follows:
AgentID_YYYYMMDD_HHMMSS_to_YYYYMMDD_HHMMSS.UNP
In the process of the summarization, the file format PRG is generated.
The .PRG files are created when the summarizer is grouping the data and preparing it for generating the reports.
After processing the data, the report data or the summary data is uploaded to the Reports Database.
Here the data which is only necessary for the reporting is uploaded.
The formats of the .PRG file is as follows
AgentID_YYYYMMDD_HHMMSS_to_YYYYMMDD_HHMMSS.PRG (this file extension exists for a very brief time frame and may not be seen)
If data is uploaded to the Reports Database successfully, the .PRG files are converted to .PRD.
Format: AgentID_YYYYMMDD_HHMMSS_to_YYYYMMDD_HHMMSS.PRD
These are the processed files which are zipped and are moved to the sub folder called archivedSyslogs. The path location of this folder will be [Installed Dir]:/GMSVP/Syslog/ArchivedSyslogs.
At the configured syslogArchiveInterval (config exists in the sgmsConfig.xml), the .PRD files are zipped and remain for more permanent storage in the \archivedSyslog folder.
If there were problems uploading the raw syslog data to the Reports Database, the .PRG files are converted to .PRE. These files are quarantined in the \badSyslogs folder.
Format: AgentID_YYYYMMDD_HHMMSS_to_YYYYMMDD_HHMMSS.PRE
Related Articles
- Threat name in NSM SaaS/NSM On-Prem/Analytics
- Using GMS 9.3 to upgrade firmware on a group of firewalls
- On-Prem Analytics release version and build number correspondence table
YES
NO