• SonicOS 7.0 Device Log
• About Device
  • Device Log Introduction
• Settings
  • Filtering the Base Setup View
  • Configuring the Logging and Alert Levels
    • Setting the Logging Level
    • Setting the Alert Level
  • About Other Top Row Buttons
    • Edit Attributes of All Categories
    • Reset All Event Counts
    • Save Template
    • Import Template
      • Default Template
      • Minimal Template
      • Analyzer/ViewPoint/GMS Template
      • Firewall Action Template
      • Custom Template
    • View Logs
  • About the Log Settings Base Setup Table
    • Category Column
    • Color Column
    • ID Column
    • Priority Column
    • GUI Column
    • Alert Column
    • Syslog Column
    • Internet Protocol Flow Information Export (IPFIX) Column
    • Email Column
    • Event Count Column
    • Edit and Reset Count Icons
  • Configuring Event Attributes Globally
  • Configuring Event Attributes Selectively
    • Configuring Event Attributes by Category
    • Configuring Event Attributes by Group
    • Configuring Event Attributes by Event
    • About Filename Logging
• Syslog
  • About Event Profiles
  • About Syslog Server Profiling
  • Using a GMS/Analytics Server for Syslog
  • Syslog Settings
  • Syslog Servers
    • Adding a Syslog Server
    • Editing a Syslog Server
    • Enabling Syslog Servers
    • Disabling Syslog Server
    • Deleting Syslog Servers
• Automation
  • Email Settings
  • Mail Server Settings
  • FTP Log Automation
• Name Resolution
• Reports
  • Data Collection
  • View Data
  • Backup Logs Information
• AWS
  • Enabling AWS Logs
• SonicWall Support
  • About This Document

Syslog Settings

The Device > Log > Syslog page enables you to configure the various settings you want when you send the log to a Syslog server. You can choose the Syslog facility and the Syslog format.

If you are using SonicWall’s Global Management System (GMS) to manage your firewall, the Syslog Format is set to Default and the Syslog ID is set to firewall. Therefore, these fields are grayed-out and cannot be modified. All other fields, however, can still be customized as needed.

To configure Syslog settings on your firewall:

1. Navigate to Device > Log > Syslog page.
2. During adding a Syslog sever, If you selected Enhanced Syslog as Syslog Formats, under the Enhanced Syslog Fields Settings, click the Configure icon. The Enhanced Syslog Fields Settings pop-up dialog displays.
3. Select the Enhanced Syslog options to log. By default, all options are selected; the Host and Event ID options are dimmed as they cannot be changed. To:
   • Select all options, click Enable All.
   • Deselect all options, click Disable All.
   • Select only some options, either:
     • Click Disable All, then select only those options to log.
     • Deselect only those options to not log.
4. Click Save.
5. During adding a Syslog sever, If you selected ArcSight as Syslog Formats, under the ARCSight CEF Fields Settings, click the Configure icon. ArcSight CEF Fields Settings pop-up dialog displays.
6. Select the ArcSight options to log. By default, all options are selected; the Host and Event ID options are dimmed as they cannot be changed. To:
   • Select all options, click Enable All.
   • Deselect all options, click Disable All.
   • Select only some options, either:
     • Click Disable All, then select only those options to log.
     • Deselect only those options to not log.
7. Click Save.
8. Select the Enable NDPP Enforcement for Syslog Server.
9. Select the Display Syslog Timestamp in UTC.
10. Click Accept.