Syslog Settings

The Device > Log > Syslog page enables you to configure the various settings you want when you send the log to a Syslog server. You can choose the Syslog facility and the Syslog format.

If you are using SonicWall’s Global Management System (GMS) to manage your firewall, the Syslog Format is set to Default and the Syslog ID is set to firewall. Therefore, these fields are grayed-out and cannot be modified. All other fields, however, can still be customized as needed.

To configure Syslog settings on your firewall:

1. Navigate to Device > Log > Syslog page.

   

2. During adding a Syslog sever, If you selected Enhanced Syslog as Syslog Formats, under the Enhanced Syslog Fields Settings, click the Configure icon. The Enhanced Syslog Fields Settings pop-up dialog displays.
3. Select the Enhanced Syslog options to log. By default, all options are selected; the Host and Event ID options are dimmed as they cannot be changed. To:
   • Select all options, click Enable All.
   • Deselect all options, click Disable All.
   • Select only some options, either:
     • Click Disable All, then select only those options to log.
     • Deselect only those options to not log.
4. Click Save.
5. During adding a Syslog sever, If you selected ArcSight as Syslog Formats, under the ARCSight CEF Fields Settings, click the Configure icon. ArcSight CEF Fields Settings pop-up dialog displays.
6. Select the ArcSight options to log. By default, all options are selected; the Host and Event ID options are dimmed as they cannot be changed. To:
   • Select all options, click Enable All.
   • Deselect all options, click Disable All.
   • Select only some options, either:
     • Click Disable All, then select only those options to log.
     • Deselect only those options to not log.
7. Click Save.
8. Select the Enable NDPP Enforcement for Syslog Server.
9. Select the Display Syslog Timestamp in UTC.
10. Click Accept.