SonicOS 7.1 Objects

Download PDF
Technical Documentation > SonicOS 7.1 Objects > Log and Alerts > Adding Log and Alerts Profiles

Adding Log and Alerts Profiles

To add a Log and Alert Profile

  1. Navigate to OBJECT | Profile Objects > Log and Alerts.

  2. Click the Add icon.

    By the default, General tab opens.

  3. Enter a Name for Log and Alerts Profile.

  4. Set the Frequency Filter Interval (secs) between reports.

    • The Frequency Interval (secs) controls how many seconds to countdown from before logging another occurrence of the same Event Message ID. The range of interval is 0 to 86400 seconds.
    • In general, most messages seen on Log Monitor are logged at one occurrence for every 60 seconds. Most Syslog messages are generated at one occurrence every 60 seconds. Most e-mail alerts are sent at one occurrence every 900 seconds.
    • To allow all occurrences with no filtering, a value of zero should be configured.

  5. Set the General options of the Log and Alerts Profile.

    Display Events in Log Monitor To display the log events in the Log Monitor.
    Send Events as E‐mail Alerts

    To send events as e-mail alerts.

    When this option is enabled, enter the e-mail address in the Send Alerts to E-Mail Address field to send the events.
    Report Events via Syslog

    To report events through Syslog.

    The Syslog Profile can be found in DEVICE | Log > Syslog > Syslog Servers tab.

    When this option is enabled, enter the Sylog Profile you would like to use.
    Report Events via IPFIX To report events by way of IPFIX.
  6. Click the Color box and set the specific color for Log Monitor display.

  7. Click the Events tab.

  8. Enable the Events options of the Log and Alerts Profile.

    Policy Matched

    When a security rule is matched, the log message id=1640 Policy Matched is originated from the rule lookup when a new flow is encountered.
    Report Begin

    When a connection associated with a rule is opened or started, this controls whether the log message id=98 Connection Opened is originated. If disabled, there will be no Connection Opened log message generated for the packets or flow associated with this log profile.
    Report End

    This controls whether the closing or ending of the connection is reported using log message ids (97 Syslog Website Accessed or 537 Connection Closed). These two messages (97, 537) are essentially the same except for extra Web Stream information included in (97) because it is generated for Web Stream types of connections that have non-zero traffic data. Non-Web Stream connections use (537). An exception for Web Stream connection that has zero traffic data will also use (537) since there will be no extra Web Stream information inspected.
  9. Click Save.
  10. Click Close to go back to Log and Alerts page.

Was This Article Helpful?

Help us to improve our support portal

Yes! Not Really

Techdocs Article Helpful form

  • Hidden
  • Hidden

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.
  • Hidden
  • Hidden