HP X Unified Security Platform Series Bedienungsanleitung PDF herunterladen (Seite 118)

Chapter 5 Events: Logs, Traffic Streams, Reports

102 X Family LSM User’s Guide V 2.5.1

Firewall Block Log

The Firewall Block Log captures information about events that have triggered a firewall rule that blocks

matching traffic and has logging enabled.

A log entry is generated for each of the following events.

• Block web request event: occurs when the X family device blocks a web request due to web filtering

• Block event: occurs when a firewall rule with Block action is triggered.

To maintain a complete history of entries and provide a backup, you can configure the X family device

to send Firewall Block Log entries to a remote syslog server from the Notification Contacts page. For

details, see “

Notification Contacts” on page 52.

Each log entry is tab-delimited. The log fields are populated based on the type of event being logged. If

a field is not used, a tab is inserted to properly position the data in the next field.

A Firewall Block log entry contains the following fields:

Table 5–4: Firewall Block Field Descriptions

Column Description

Log ID A system-assigned Log ID number

Date/Time A date and time stamp in the format

YYYY-MM-DD HH:MM:SS

Severity Indicates the severity of the triggered filter. Possible values include: Critical,

Major, Minor, and Low

Firewall Rule The name of the firewall rule that was triggered. In the LSM, the firewall rule is

linked to allow you to edit/view the rule that triggered the event.

Protocol The name of the protocol that the action affects

Source Zone The security zone where the traffic originated

Dst Zone The security zone where traffic was sent

SourceIP: Port

Dest

The source address and port where the triggering traffic originates

Dest IP: Port The destination address and port of the triggering traffic

Category For web requests blocked by the Web Filter Service, this represents the filter

category triggered by the URL (examples: Gambling, Entertainment, or

Violence)

URL For web requests events only, the target URL. This field is populated regardless of

whether the request was filtered by the Web Filter Service

1 2 ... 113 114 115 116 117 118 119 120 121 122 123 ... 332 333

Keine Kommentare

HP X Unified Security Platform Series Bedienungsanleitung Seite 118