• SonicOS 7.0 Device Log
• About Device
  • Device Log Introduction
• Settings
  • Filtering the Base Setup View
  • Configuring the Logging and Alert Levels
    • Setting the Logging Level
    • Setting the Alert Level
  • About Other Top Row Buttons
    • Edit Attributes of All Categories
    • Reset All Event Counts
    • Save Template
    • Import Template
      • Default Template
      • Minimal Template
      • Analyzer/ViewPoint/GMS Template
      • Firewall Action Template
      • Custom Template
    • View Logs
  • About the Log Settings Base Setup Table
    • Category Column
    • Color Column
    • ID Column
    • Priority Column
    • GUI Column
    • Alert Column
    • Syslog Column
    • Internet Protocol Flow Information Export (IPFIX) Column
    • Email Column
    • Event Count Column
    • Edit and Reset Count Icons
  • Configuring Event Attributes Globally
  • Configuring Event Attributes Selectively
    • Configuring Event Attributes by Category
    • Configuring Event Attributes by Group
    • Configuring Event Attributes by Event
    • About Filename Logging
• Syslog
  • About Event Profiles
  • About Syslog Server Profiling
  • Using a GMS/Analytics Server for Syslog
  • Syslog Settings
  • Syslog Servers
    • Adding a Syslog Server
    • Editing a Syslog Server
    • Enabling Syslog Servers
    • Disabling Syslog Server
    • Deleting Syslog Servers
• Automation
  • Email Settings
  • Mail Server Settings
  • FTP Log Automation
• Name Resolution
• Reports
  • Data Collection
  • View Data
  • Backup Logs Information
• AWS
  • Enabling AWS Logs
• SonicWall Support
  • About This Document

Using a GMS/Analytics Server for Syslog

GMS/Analytics can be enabled or disabled only on the Device > Log > Settings page (for enabling and configuring GMS/Analytics, see SonicWall SonicOS System Setup.

When using a GMS/Analytics server for Syslog, the following restrictions apply:

• The Event Profile must be 0.
• The Syslog Facility must be Local Use 0.
• The Syslog Format must be Default.
• The Syslog ID must be firewall.

When firewall is managed using GMS/Analytics, only the global settings can be configured from GMS/Analytics. So, if a global setting is changed, it affects all the servers. The settings for an individual server cannot be configured, as GMS/Analytics does not support those tags. When adding a new Syslog Server, therefore, only the hostname and port can be configured; all other fields contain default values.

When GMS/Analytics is enabled, the GMS/Analytics server is added to the Event Profile 0 group in the Syslog Servers table. It cannot be added to any other Profile groups. The events in the GMS/Analytics group in the Device > Log > Settings page have Profile 0 and cannot be changed. Other events can have a different Profile.