SonicOS 5.9 / / 6.2 Log Events Reference Guide with Enhanced Logging

Transcription

1 SonicOS 5.9 / / 6.2 Log Events Reference Guide with Enhanced Logging 1

2 Notes, Cautions, and Warnings NOTE: A NOTE indicates important information that helps you make better use of your system. CAUTION: A CAUTION indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING indicates a potential for property damage, personal injury, or death Dell Inc. Trademarks: Dell, the DELL logo, SonicWALL, SonicWALL GMS, SonicWALL Analyzer, Reassembly-Free Deep Packet Inspection, Dynamic Security for the Global Network, SonicWALL Clean VPN, SonicWALL Clean Wireless, SonicWALL Comprehensive Gateway Security Suite, SonicWALL Mobile Connect, and all other SonicWALL product and service names and slogans are trademarks of Dell Inc P/N Rev. A

3 Overview This reference guide lists and describes SonicOS log event messages for SonicOS 5.9, 6.0.5, and 6.2. Reference a log event message by using the alphabetical index from the Log Event Message Index table of this document. This document contains the following sections: Log > Monitor on page 1 Log > Settings on page 1 Index of Log Event Messages on page 2 Log > Syslog on page 169 Index of Syslog Tag Field Descriptions on page 170 Table of Values on page 178 Log > Monitor The Dell SonicWALL security appliance maintains an Event log for tracking potential security threats. This log can be viewed by navigating to the Dashboard > Log Monitor or Log > Log Monitor page, or it can be automatically sent to an address for convenience and archiving. The log is displayed in a table and can be sorted by column. For more information on configuring the Log Monitor page, refer to the SonicOS Administrator s Guide. Log > Settings The Log > Settings page allows you to categorize and customize the logging functions on your Dell SonicWALL security appliance for troubleshooting and diagnostics. For more information on configuring and managing the Log > Settings page, refer to the SonicOS Administrator s Guide. SonicOS 5.9 / / 6.2 Log Events Reference Guide 1

4 Index of Log Event Messages The following table is the Log Event Message Index, which is a list of log event messages for the SonicOS 5.9, 6.0.5, and 6.2 firmware. Each log event message described in the following table provides the following log event details: Log Event Message ID Number Displays the ID number of the log event message. Firmware Version Displays the SonicOS firmware version the log event message appears on. Legacy Category Displays the category event type. This is the same category as Table 1: Legacy Category on page 178. SonicOS Category Displays the SonicOS category type. This is the same category as Table 2: Expanded Categories on page 179. Priority Level Displays the level of urgency of the log event message. For additional information, you can also reference Table 3: Priority Level on page 182. SNMP Trap Type Displays the SNMP Trap ID number of the log event message. Log Event Messages Displays the name of the event message. ID Firmware Version Legacy Category Category Priority Level Maintenance Firewall Event ALERT Maintenance Firewall Event ALERT SNMP Trap Type Message Network Security Appliance activated Network Security Appliance activated Maintenance Firewall Event ALERT Network Security Appliance activated Maintenance Firewall Logging INFO Log Cleared Maintenance Firewall Logging INFO Log Cleared Maintenance Firewall Logging INFO Log Cleared Maintenance Firewall Logging INFO Log successfully sent via E mail Maintenance Firewall Logging INFO Log successfully sent via E mail Maintenance Firewall Logging INFO Log successfully sent via E mail System Error Security Services ERROR System Error Security Services ERROR System Error Security Services ERROR System Error Firewall Logging WARNING System Error Firewall Logging WARNING 604 Problem loading the URL List; check Filter settings Problem loading the URL List; check Filter settings Problem loading the URL List; check Filter settings Problem sending log E mail; check log settings Problem sending log E mail; check log settings 2

5 System Error Firewall Logging WARNING 604 Problem sending log E mail; check log settings Blocked Sites Network Access ERROR 701 Web site access denied Blocked Sites Network Access ERROR 701 Web site access denied Blocked Sites Network Access ERROR 701 Web site access denied Blocked Sites Network Access NOTICE 702 Newsgroup access denied Blocked Sites Network Access NOTICE 702 Newsgroup access denied Blocked Sites Network Access NOTICE 702 Newsgroup access denied Blocked Sites Network Access NOTICE 703 Web site access allowed Blocked Sites Network Access NOTICE 703 Web site access allowed Blocked Sites Network Access NOTICE 703 Web site access allowed Blocked Sites Network Access NOTICE 704 Newsgroup access allowed Blocked Sites Network Access NOTICE 704 Newsgroup access allowed Blocked Sites Network Access NOTICE 704 Newsgroup access allowed Blocked Code Network Access NOTICE ActiveX access denied Blocked Code Network Access NOTICE ActiveX access denied Blocked Code Network Access NOTICE ActiveX access denied Blocked Code Network Access NOTICE Java access denied Blocked Code Network Access NOTICE Java access denied Blocked Code Network Access NOTICE Java access denied Blocked Code Network Access NOTICE Blocked Code Network Access NOTICE ActiveX or Java archive access denied ActiveX or Java archive access denied Blocked Code Network Access NOTICE ActiveX or Java archive access denied Blocked Code Network Access NOTICE Cookie removed Blocked Code Network Access NOTICE Cookie removed Blocked Code Network Access NOTICE Cookie removed Attack Attack Attack Attack ALERT 501 Ping of death dropped ALERT 501 Ping of death dropped ALERT 501 Ping of death dropped ALERT 502 IP spoof dropped SonicOS 5.9 / / 6.2 Log Events Reference Guide 3

6 Attack Attack User Activity User Activity User Activity Attack Attack Attack Attack Attack Attack User Activity User Activity User Activity Attack Attack ALERT 502 IP spoof dropped ALERT 502 IP spoof dropped WARNING 503 WARNING 503 WARNING 503 User logged out user disconnect detected User logged out user disconnect detected User logged out user disconnect detected Possible SYN flood attack detected Possible SYN flood attack detected Possible SYN flood attack detected ALERT 505 Land attack dropped ALERT 505 Land attack dropped ALERT 505 Land attack dropped TCP UDP ICMP Network NOTICE Fragmented packet dropped TCP UDP ICMP Network NOTICE Fragmented packet dropped TCP UDP ICMP Network NOTICE Fragmented packet dropped Administrator login allowed Administrator login allowed Administrator login allowed Access ALERT 560 Access ALERT 560 Administrator login denied due to bad credentials Administrator login denied due to bad credentials 4

7 Attack User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity Attack Attack Access ALERT 560 Administrator login denied due to bad credentials User login from an internal zone allowed User login from an internal zone allowed User login from an internal zone allowed User login denied due to bad credentials User login denied due to bad credentials User login denied due to bad credentials User login denied due to bad credentials User login denied due to bad credentials User login denied due to bad credentials Pending login timed out Pending login timed out Pending login timed out Access ALERT Access ALERT 506 Administrator login denied from %s; logins disabled from this interface Administrator login denied from %s; logins disabled from this interface Administrator login denied Attack Access ALERT 506 from %s; logins disabled from this interface TCP Network Access NOTICE TCP connection dropped TCP Network Access NOTICE TCP connection dropped TCP Network Access NOTICE TCP connection dropped UDP Network Access NOTICE UDP packet dropped SonicOS 5.9 / / 6.2 Log Events Reference Guide 5

8 UDP Network Access NOTICE UDP packet dropped UDP Network Access NOTICE UDP packet dropped ICMP Network Access NOTICE ICMP Network Access NOTICE ICMP packet dropped due to Policy ICMP packet dropped due to Policy ICMP Network Access NOTICE ICMP packet dropped due to Policy Debug Network Access NOTICE Unknown protocol dropped Debug Network Access NOTICE Unknown protocol dropped Debug Network Access NOTICE Unknown protocol dropped Debug Network Access DEBUG IPsec connection interrupt Debug Network Access DEBUG IPsec connection interrupt Debug Network Access DEBUG IPsec connection interrupt Debug Network DEBUG ARP Timeout Debug Network DEBUG ARP Timeout Debug Network DEBUG ARP Timeout Debug Network Access DEBUG Broadcast packet dropped Debug Network Access DEBUG Broadcast packet dropped Debug Network Access DEBUG Broadcast packet dropped Debug Network Access DEBUG Debug Network Access DEBUG Out of order command packet dropped Out of order command packet dropped Debug Network Access DEBUG Out of order command packet dropped Debug Unused DEBUG Failure to add data channel Debug Unused DEBUG Failure to add data channel Debug Unused DEBUG Failure to add data channel System Error Firewall Event ERROR System Error Firewall Event ERROR System Error Firewall Event ERROR 607 The cache is full; %u open connections; some will be dropped The cache is full; %u open connections; some will be dropped The cache is full; %u open connections; some will be dropped 6

9 System Error Firewall Event ERROR System Error Firewall Event ERROR 608 License exceeded: Connection dropped because too many IP addresses are in use on your LAN License exceeded: Connection dropped because too many IP addresses are in use on your LAN System Error Firewall Event ERROR 608 License exceeded: Connection dropped because too many IP addresses are in use on your LAN Blocked Sites Network Access NOTICE 705 Access to proxy server denied Blocked Sites Network Access NOTICE 705 Access to proxy server denied Blocked Sites Network Access NOTICE 705 Access to proxy server denied System Error VPN IPsec ERROR 609 Diagnostic Code E System Error VPN IPsec ERROR 609 Diagnostic Code E System Error VPN IPsec ERROR 609 Diagnostic Code E Debug Network DEBUG Debug Network DEBUG Received fragmented packet or fragmentation needed Received fragmented packet or fragmentation needed Debug Network DEBUG Received fragmented packet or fragmentation needed User Activity VPN IPsec INFO Illegal IPsec SPI User Activity VPN IPsec INFO Illegal IPsec SPI User Activity VPN IPsec INFO Illegal IPsec SPI Attack VPN IPsec ERROR 508 IPsec Authentication Failed Attack VPN IPsec ERROR 508 IPsec Authentication Failed Attack VPN IPsec ERROR 508 IPsec Authentication Failed Attack VPN IPsec ERROR 509 IPsec Decryption Failed Attack VPN IPsec ERROR 509 IPsec Decryption Failed Attack VPN IPsec ERROR 509 IPsec Decryption Failed User Activity VPN IPsec INFO User Activity VPN IPsec INFO User Activity VPN IPsec INFO Incompatible IPsec Security Association Incompatible IPsec Security Association Incompatible IPsec Security Association SonicOS 5.9 / / 6.2 Log Events Reference Guide 7

10 Attack VPN IPsec ERROR Attack VPN IPsec ERROR Attack VPN IPsec ERROR Attack Attack Attack Attack Attack Attack Attack Attack ALERT 520 ALERT 520 ALERT 520 IPsec packet from or to an illegal host IPsec packet from or to an illegal host IPsec packet from or to an illegal host Smurf Amplification attack dropped Smurf Amplification attack dropped Smurf Amplification attack dropped ALERT 521 Possible port scan detected ALERT 521 Possible port scan detected ALERT 521 Possible port scan detected ALERT 522 Probable port scan detected ALERT 522 Probable port scan detected Attack ALERT 522 Probable port scan detected Maintenance Network INFO Failed to resolve name Maintenance Network INFO Failed to resolve name Maintenance Network INFO Failed to resolve name User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING 523 IKE Responder: Accepting IPsec proposal (Phase 2) IKE Responder: Accepting IPsec proposal (Phase 2) IKE Responder: Accepting IPsec proposal (Phase 2) IKE Responder: IPsec proposal does not match (Phase 2) IKE Responder: IPsec proposal does not match (Phase 2) IKE Responder: IPsec proposal does not match (Phase 2) 8

11 User Activity VPN IKE INFO User Activity VPN IKE INFO IKE negotiation complete. Adding IPsec SA. (Phase 2) IKE negotiation complete. Adding IPsec SA. (Phase 2) User Activity VPN IKE INFO IKE negotiation complete. Adding IPsec SA. (Phase 2) System Error Firewall Hardware ERROR 611 Diagnostic Code A System Error Firewall Hardware ERROR 611 Diagnostic Code A System Error Firewall Hardware ERROR 611 Diagnostic Code A System Error Firewall Hardware ERROR 612 Diagnostic Code B System Error Firewall Hardware ERROR 612 Diagnostic Code B System Error Firewall Hardware ERROR 612 Diagnostic Code B System Error Firewall Hardware ERROR 613 Diagnostic Code C System Error Firewall Hardware ERROR 613 Diagnostic Code C System Error Firewall Hardware ERROR 613 Diagnostic Code C Maintenance GMS INFO Status Maintenance GMS INFO Status Maintenance GMS INFO Status Connection Traffic Network Traffic INFO Web site hit Connection Traffic Network Traffic INFO Web site hit Connection Traffic Network Traffic INFO Web site hit Connection Network Traffic INFO Connection Opened Connection Network Traffic INFO Connection Opened Connection Network Traffic INFO Connection Opened Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Retransmitting DHCP DIS COVER. Retransmitting DHCP DIS COVER. Retransmitting DHCP DIS COVER. Retransmitting DHCP Request (Requesting). Retransmitting DHCP Request (Requesting). SonicOS 5.9 / / 6.2 Log Events Reference Guide 9

12 Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Retransmitting DHCP Request (Requesting). Retransmitting DHCP Request (Renewing). Retransmitting DHCP Request (Renewing). Retransmitting DHCP Request (Renewing). Retransmitting DHCP Request (Rebinding). Retransmitting DHCP Request (Rebinding). Retransmitting DHCP Request (Rebinding). Retransmitting DHCP Request (Rebooting). Retransmitting DHCP Request (Rebooting). Retransmitting DHCP Request (Rebooting). Retransmitting DHCP Request (Verifying). Retransmitting DHCP Request (Verifying) Maintenance DHCP Client INFO Retransmitting DHCP Request (Verifying) Maintenance DHCP Client INFO Sending DHCP DISCOVER Maintenance DHCP Client INFO Sending DHCP DISCOVER Maintenance DHCP Client INFO Sending DHCP DISCOVER Maintenance DHCP Client INFO Maintenance DHCP Client INFO DHCP Server not available. Did not get any DHCP OFFER. DHCP Server not available. Did not get any DHCP OFFER Maintenance DHCP Client INFO DHCP Server not available. Did not get any DHCP OFFER Maintenance DHCP Client INFO Got DHCP OFFER. Selecting Maintenance DHCP Client INFO Got DHCP OFFER. Selecting Maintenance DHCP Client INFO Got DHCP OFFER. Selecting Maintenance DHCP Client INFO Sending DHCP Request. 10

13 Maintenance DHCP Client INFO Sending DHCP Request Maintenance DHCP Client INFO Sending DHCP Request Maintenance DHCP Client INFO Maintenance DHCP Client INFO DHCP Client did not get DHCP ACK. DHCP Client did not get DHCP ACK Maintenance DHCP Client INFO DHCP Client did not get DHCP ACK Maintenance DHCP Client INFO DHCP Client got NACK Maintenance DHCP Client INFO DHCP Client got NACK Maintenance DHCP Client INFO DHCP Client got NACK Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO DHCP Client got ACK from server. DHCP Client got ACK from server. DHCP Client got ACK from server. DHCP Client is declining address offered by the server. DHCP Client is declining address offered by the server. DHCP Client is declining address offered by the server. DHCP Client sending Request and going to REBIND state. DHCP Client sending Request and going to REBIND state. DHCP Client sending Request and going to REBIND state. DHCP Client sending Request and going to RENEW state. DHCP Client sending Request and going to RENEW state. DHCP Client sending Request and going to RENEW state. Sending DHCP Request (Renewing). Sending DHCP Request (Renewing). SonicOS 5.9 / / 6.2 Log Events Reference Guide 11

14 Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Sending DHCP Request (Renewing). Sending DHCP Request (Rebinding). Sending DHCP Request (Rebinding). Sending DHCP Request (Rebinding). Sending DHCP Request (Rebooting). Sending DHCP Request (Rebooting). Sending DHCP Request (Rebooting). Sending DHCP Request (Verifying). Sending DHCP Request (Verifying). Sending DHCP Request (Verifying). DHCP Client failed to verify and lease has expired. Go to INIT state. DHCP Client failed to verify and lease has expired. Go to INIT state. DHCP Client failed to verify and lease has expired. Go to INIT state. DHCP Client got a new IP address lease. DHCP Client got a new IP address lease Maintenance DHCP Client INFO DHCP Client got a new IP address lease Maintenance DHCP Client INFO Sending DHCP RELEASE Maintenance DHCP Client INFO Sending DHCP RELEASE Maintenance DHCP Client INFO Sending DHCP RELEASE. 12

15 Maintenance Security Services INFO Maintenance Security Services INFO Maintenance Security Services INFO Maintenance Security Services INFO Maintenance Security Services INFO Access attempt from host without Anti Virus agent installed Access attempt from host without Anti Virus agent installed Access attempt from host without Anti Virus agent installed Anti Virus agent out of date on host Anti Virus agent out of date on host Maintenance Security Services INFO Anti Virus agent out of date on host Maintenance Security Services WARNING 524 Received AV Alert: %s Maintenance Security Services WARNING 524 Received AV Alert: %s Maintenance Security Services WARNING 524 Received AV Alert: %s Maintenance PPPoE INFO Starting PPPoE discovery Maintenance PPPoE INFO Starting PPPoE discovery Maintenance PPPoE INFO Starting PPPoE discovery Maintenance PPPoE INFO PPPoE LCP Link Up Maintenance PPPoE INFO PPPoE LCP Link Up Maintenance PPPoE INFO PPPoE LCP Link Up Maintenance PPPoE INFO PPPoE LCP Link Down Maintenance PPPoE INFO PPPoE LCP Link Down Maintenance PPPoE INFO PPPoE LCP Link Down Maintenance PPPoE INFO PPPoE terminated Maintenance PPPoE INFO PPPoE terminated Maintenance PPPoE INFO PPPoE terminated Maintenance PPPoE INFO PPPoE Network Connected Maintenance PPPoE INFO PPPoE Network Connected Maintenance PPPoE INFO PPPoE Network Connected Maintenance PPPoE INFO PPPoE Network Disconnected Maintenance PPPoE INFO PPPoE Network Disconnected Maintenance PPPoE INFO PPPoE Network Disconnected Maintenance PPPoE INFO Maintenance PPPoE INFO PPPoE discovery process complete PPPoE discovery process complete SonicOS 5.9 / / 6.2 Log Events Reference Guide 13

16 Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO PPPoE discovery process complete PPPoE starting CHAP Authentication PPPoE starting CHAP Authentication Maintenance PPPoE INFO PPPoE starting CHAP Authentication System Error Firewall Event WARNING 636 Wan IP Changed System Error Firewall Event WARNING 636 Wan IP Changed System Error Firewall Event WARNING 636 Wan IP Changed User Activity VPN Client INFO User Activity VPN Client INFO User Activity VPN Client INFO User Activity VPN Client ERROR User Activity VPN Client ERROR User Activity VPN Client ERROR User Activity VPN Client INFO User Activity VPN Client INFO XAUTH Succeeded with VPN client XAUTH Succeeded with VPN client XAUTH Succeeded with VPN client XAUTH Failed with VPN client, Authentication failure XAUTH Failed with VPN client, Authentication failure XAUTH Failed with VPN client, Authentication failure XAUTH Failed with VPN client, Cannot Contact RADIUS Server XAUTH Failed with VPN client, Cannot Contact RADIUS Server User Activity VPN Client INFO XAUTH Failed with VPN client, Cannot Contact RADIUS Server Debug Firewall Event ERROR Log Debug Debug Firewall Event ERROR Log Debug Debug Firewall Event ERROR Log Debug Attack Firewall Event ERROR 525 Add an attack message Attack Firewall Event ERROR 525 Add an attack message Attack Firewall Event ERROR 525 Add an attack message Maintenance High Availability ALERT Maintenance High Availability ALERT Primary firewall has transitioned to Active Primary firewall has transitioned to Active 14

17 Maintenance High Availability ALERT Maintenance High Availability ALERT Maintenance High Availability ALERT Maintenance High Availability ALERT System Error High Availability ALERT System Error High Availability ALERT System Error High Availability ALERT Maintenance High Availability ALERT Maintenance High Availability ALERT Maintenance High Availability ALERT System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR 617 Primary firewall has transitioned to Active Secondary firewall has transitioned to Active Secondary firewall has transitioned to Active Secondary firewall has transitioned to Active Primary firewall has transitioned to Standby Primary firewall has transitioned to Standby Primary firewall has transitioned to Standby Secondary firewall has transitioned to Standby Secondary firewall has transitioned to Standby Secondary firewall has transitioned to Standby Primary missed heartbeats from Secondary Primary missed heartbeats from Secondary Primary missed heartbeats from Secondary Secondary missed heartbeats from Primary Secondary missed heartbeats from Primary Secondary missed heartbeats from Primary Primary received error signal from Secondary Primary received error signal from Secondary Primary received error signal from Secondary SonicOS 5.9 / / 6.2 Log Events Reference Guide 15

18 System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR 620 Secondary received error signal from Primary Secondary received error signal from Primary Secondary received error signal from Primary Primary firewall preempting Secondary Primary firewall preempting Secondary System Error High Availability ERROR 620 Primary firewall preempting Secondary Maintenance High Availability INFO HA Peer Firewall Synchronized Maintenance High Availability INFO HA Peer Firewall Synchronized Maintenance High Availability INFO HA Peer Firewall Synchronized System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR Maintenance Security Services WARNING Maintenance Security Services WARNING 526 Error synchronizing HA peer firewall (%s) Error synchronizing HA peer firewall (%s) Error synchronizing HA peer firewall (%s) Received AV Alert: Your Network Anti Virus subscription has expired. %s Received AV Alert: Your Network Anti Virus subscription has expired. %s Maintenance Security Services WARNING 526 Received AV Alert: Your Network Anti Virus subscription has expired. %s Maintenance High Availability INFO HA packet processing error Maintenance High Availability INFO HA packet processing error Maintenance High Availability INFO HA packet processing error System Error Firewall Hardware ERROR 621 Diagnostic Code F System Error Firewall Hardware ERROR 621 Diagnostic Code F System Error Firewall Hardware ERROR 621 Diagnostic Code F Attack ALERT 527 Forbidden E Mail attachment disabled 16

19 Attack Attack ALERT 527 ALERT Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO System Error High Availability ERROR System Error High Availability ERROR 622 Forbidden E Mail attachment disabled Forbidden E Mail attachment disabled Disconnecting PPPoE due to traffic Timeout Disconnecting PPPoE due to traffic Timeout Disconnecting PPPoE due to traffic Timeout No response from ISP Disconnecting PPPoE. No response from ISP Disconnecting PPPoE. No response from ISP Disconnecting PPPoE. Secondary going Active in preempt mode after reboot Secondary going Active in preempt mode after reboot System Error High Availability ERROR 622 Secondary going Active in preempt mode after reboot User Activity VPN IKE DEBUG %s User Activity VPN IKE DEBUG %s User Activity VPN IKE DEBUG %s LAN TCP Network Access NOTICE LAN TCP Network Access NOTICE LAN TCP Network Access NOTICE TCP connection from LAN denied TCP connection from LAN denied TCP connection from LAN denied LAN UDP LAN TCP Network Access NOTICE UDP packet from LAN dropped LAN UDP LAN TCP Network Access NOTICE UDP packet from LAN dropped LAN UDP LAN TCP Network Access NOTICE UDP packet from LAN dropped LAN ICMP LAN TCP Network Access NOTICE ICMP packet from LAN dropped SonicOS 5.9 / / 6.2 Log Events Reference Guide 17

20 Attack Attack Attack Attack Attack Attack Attack Attack LAN ICMP LAN TCP Network Access NOTICE ICMP packet from LAN dropped LAN ICMP LAN TCP Network Access NOTICE ICMP packet from LAN dropped ALERT 528 Probable TCP FIN scan detected ALERT 528 Probable TCP FIN scan detected ALERT 528 Probable TCP FIN scan detected ALERT 529 ALERT 529 ALERT 529 ALERT 530 ALERT 530 Probable TCP XMAS scan detected Probable TCP XMAS scan detected Probable TCP XMAS scan detected Probable TCP NULL scan detected Probable TCP NULL scan detected Attack ALERT 530 Probable TCP NULL scan detected Attack VPN IPsec ALERT 531 IPsec Replay Detected Attack VPN IPsec ALERT 531 IPsec Replay Detected Attack VPN IPsec ALERT 531 IPsec Replay Detected Debug Network DEBUG TCP FIN packet dropped Debug Network DEBUG TCP FIN packet dropped Debug Network DEBUG TCP FIN packet dropped User Activity Network INFO User Activity Network INFO User Activity Network INFO System Error Security Services ERROR System Error Security Services ERROR 623 Received a path MTU ICMP message from router/gateway Received a path MTU ICMP message from router/gateway Received a path MTU ICMP message from router/gateway Problem loading the URL List; Appliance not registered. Problem loading the URL List; Appliance not registered. 18

21 System Error Security Services ERROR User Activity Network INFO User Activity Network INFO User Activity Network INFO System Error Security Services ERROR System Error Security Services ERROR System Error Security Services ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR User Activity User Activity User Activity User Activity User Activity User Activity Problem loading the URL List; Appliance not registered. Received a path MTU ICMP message from router/gateway Received a path MTU ICMP message from router/gateway Received a path MTU ICMP message from router/gateway The loaded content URL List has expired. The loaded content URL List has expired. The loaded content URL List has expired. Error setting the IP address of the Secondary, please manually set to Secondary LAN IP Error setting the IP address of the Secondary, please manually set to Secondary LAN IP Error setting the IP address of the Secondary, please manually set to Secondary LAN IP CLI administrator login allowed CLI administrator login allowed CLI administrator login allowed Access WARNING Access WARNING Access WARNING Maintenance L2TP Client INFO Maintenance L2TP Client INFO CLI administrator login denied due to bad credentials CLI administrator login denied due to bad credentials CLI administrator login denied due to bad credentials L2TP Tunnel Negotiation Started L2TP Tunnel Negotiation Started SonicOS 5.9 / / 6.2 Log Events Reference Guide 19

22 Maintenance L2TP Client INFO Maintenance L2TP Client INFO Maintenance L2TP Client INFO L2TP Tunnel Negotiation Started L2TP Session Negotiation Started L2TP Session Negotiation Started Maintenance L2TP Client INFO L2TP Session Negotiation Started Maintenance L2TP Client INFO L2TP Tunnel Established Maintenance L2TP Client INFO L2TP Tunnel Established Maintenance L2TP Client INFO L2TP Tunnel Established Maintenance L2TP Client INFO Maintenance L2TP Client INFO L2TP Tunnel Disconnect from Remote L2TP Tunnel Disconnect from Remote Maintenance L2TP Client INFO L2TP Tunnel Disconnect from Remote Maintenance L2TP Client INFO L2TP Session Established Maintenance L2TP Client INFO L2TP Session Established Maintenance L2TP Client INFO L2TP Session Established Maintenance L2TP Client INFO Maintenance L2TP Client INFO L2TP Session Disconnect from Remote L2TP Session Disconnect from Remote Maintenance L2TP Client INFO L2TP Session Disconnect from Remote Maintenance L2TP Client INFO L2TP PPP Negotiation Started Maintenance L2TP Client INFO L2TP PPP Negotiation Started Maintenance L2TP Client INFO L2TP PPP Negotiation Started Maintenance L2TP Client INFO L2TP PPP Session Up Maintenance L2TP Client INFO L2TP PPP Session Up Maintenance L2TP Client INFO L2TP PPP Session Up Maintenance L2TP Client INFO L2TP PPP Down Maintenance L2TP Client INFO L2TP PPP Down Maintenance L2TP Client INFO L2TP PPP Down Maintenance L2TP Client INFO L2TP PPP Authentication Failed Maintenance L2TP Client INFO L2TP PPP Authentication Failed Maintenance L2TP Client INFO L2TP PPP Authentication Failed 20

23 Maintenance L2TP Client INFO Maintenance L2TP Client INFO Disconnecting L2TP Tunnel due to traffic Timeout Disconnecting L2TP Tunnel due to traffic Timeout Maintenance L2TP Client INFO Disconnecting L2TP Tunnel due to traffic Timeout Maintenance L2TP Client INFO L2TP PPP link down Maintenance L2TP Client INFO L2TP PPP link down Maintenance L2TP Client INFO L2TP PPP link down Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO DHCP RELEASE relayed to Central Gateway DHCP RELEASE relayed to Central Gateway DHCP RELEASE relayed to Central Gateway DHCP lease relayed to local device DHCP lease relayed to local device DHCP lease relayed to local device DHCP RELEASE received from remote device DHCP RELEASE received from remote device DHCP RELEASE received from remote device DHCP lease relayed to remote device DHCP lease relayed to remote device DHCP lease relayed to remote device DHCP lease to LAN device conflicts with remote device, deleting remote IP entry DHCP lease to LAN device conflicts with remote device, deleting remote IP entry SonicOS 5.9 / / 6.2 Log Events Reference Guide 21

24 Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay WARNING Maintenance DHCP Relay WARNING Maintenance DHCP Relay WARNING Attack DHCP Relay ERROR Attack DHCP Relay ERROR Attack DHCP Relay ERROR Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO DHCP lease to LAN device conflicts with remote device, deleting remote IP entry WARNING: DHCP lease relayed from Central Gateway conflicts with IP in Static Devices list WARNING: DHCP lease relayed from Central Gateway conflicts with IP in Static Devices list WARNING: DHCP lease relayed from Central Gateway conflicts with IP in Static Devices list DHCP lease dropped. Lease from Central Gateway conflicts with Relay IP DHCP lease dropped. Lease from Central Gateway conflicts with Relay IP DHCP lease dropped. Lease from Central Gateway conflicts with Relay IP IP spoof detected on packet to Central Gateway, packet dropped IP spoof detected on packet to Central Gateway, packet dropped IP spoof detected on packet to Central Gateway, packet dropped Request for Relay IP Table from Central Gateway Request for Relay IP Table from Central Gateway Request for Relay IP Table from Central Gateway Requesting Relay IP Table from Remote Gateway Requesting Relay IP Table from Remote Gateway 22

25 Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO System Error DHCP Relay WARNING System Error DHCP Relay WARNING System Error DHCP Relay WARNING User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity Requesting Relay IP Table from Remote Gateway Sent Relay IP Table to Central Gateway Sent Relay IP Table to Central Gateway Sent Relay IP Table to Central Gateway Obtained Relay IP Table from Remote Gateway Obtained Relay IP Table from Remote Gateway Obtained Relay IP Table from Remote Gateway Failed to synchronize Relay IP Table Failed to synchronize Relay IP Table Failed to synchronize Relay IP Table VPN zone administrator login allowed VPN zone administrator login allowed VPN zone administrator login allowed WAN zone administrator login allowed WAN zone administrator login allowed WAN zone administrator login allowed VPN zone remote user login allowed VPN zone remote user login allowed VPN zone remote user login allowed SonicOS 5.9 / / 6.2 Log Events Reference Guide 23

26 User Activity User Activity User Activity User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO WAN zone remote user login allowed WAN zone remote user login allowed WAN zone remote user login allowed NAT Discovery : Peer IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Peer IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Peer IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Local IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Local IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Local IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : No NAT/NAPT device detected between IPsec Security gateways NAT Discovery : No NAT/NAPT device detected between IPsec Security gateways NAT Discovery : No NAT/NAPT device detected between IPsec Security gateways NAT Discovery : Peer IPsec Security Gateway doesn't support VPN NAT Traversal NAT Discovery : Peer IPsec Security Gateway doesn't support VPN NAT Traversal 24

27 User Activity VPN IKE INFO User Activity RADIUS INFO User Activity RADIUS INFO User Activity RADIUS INFO User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity User Activity NAT Discovery : Peer IPsec Security Gateway doesn't support VPN NAT Traversal User login denied RADIUS authentication failure User login denied RADIUS authentication failure User login denied RADIUS authentication failure User login denied RADIUS server Timeout User login denied RADIUS server Timeout User login denied RADIUS server Timeout User login denied RADIUS configuration error User login denied RADIUS configuration error User login denied RADIUS configuration error User login denied User has no privileges for login from that location User login denied User has no privileges for login from that location User login denied User has no User Activity privileges for login from that location Maintenance VPN IPsec INFO IPsec packet from an illegal host Maintenance VPN IPsec INFO IPsec packet from an illegal host Maintenance VPN IPsec INFO IPsec packet from an illegal host Attack Attack Attack ERROR 534 ERROR 534 ERROR 534 Forbidden E Mail attachment deleted Forbidden E Mail attachment deleted Forbidden E Mail attachment deleted SonicOS 5.9 / / 6.2 Log Events Reference Guide 25

28 User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING 539 IKE Responder: Mode %s not tunnel mode IKE Responder: Mode %d not tunnel mode IKE Responder: Mode %s not tunnel mode IKE Responder: No matching Phase 1 ID found for proposed remote network IKE Responder: No matching Phase 1 ID found for proposed remote network IKE Responder: No matching Phase 1 ID found for proposed remote network IKE Responder: Proposed remote network is but not DHCP relay nor default route IKE Responder: Proposed remote network is but not DHCP relay nor default route IKE Responder: Proposed remote network is but not DHCP relay nor default route IKE Responder: No match for proposed remote network address IKE Responder: No match for proposed remote network address IKE Responder: No match for proposed remote network address IKE Responder: Default LAN gateway is set but peer is not proposing to use this SA as a default route 26

29 User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING 542 IKE Responder: Default LAN gateway is set but peer is not proposing to use this SA as a default route IKE Responder: Default LAN gateway is set but peer is not proposing to use this SA as a default route IKE Responder: Tunnel terminates outside firewall but proposed local network is not NAT public address IKE Responder: Tunnel terminates outside firewall but proposed local network is not NAT public address IKE Responder: Tunnel terminates outside firewall but proposed local network is not NAT public address IKE Responder: Tunnel terminates inside firewall but proposed local network is not inside firewall IKE Responder: Tunnel terminates inside firewall but proposed local network is not inside firewall IKE Responder: Tunnel terminates inside firewall but proposed local network is not inside firewall IKE Responder: Tunnel terminates on DMZ but proposed local network is on LAN IKE Responder: Tunnel terminates on DMZ but proposed local network is on LAN IKE Responder: Tunnel terminates on DMZ but proposed local network is on LAN SonicOS 5.9 / / 6.2 Log Events Reference Guide 27

30 User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity User Activity User Activity User Activity User Activity User Activity IKE Responder: Tunnel terminates on LAN but proposed local network is on DMZ IKE Responder: Tunnel terminates on LAN but proposed local network is on DMZ IKE Responder: Tunnel terminates on LAN but proposed local network is on DMZ IKE Responder: AH Perfect Forward Secrecy mismatch IKE Responder: AH Perfect Forward Secrecy mismatch IKE Responder: AH Perfect Forward Secrecy mismatch IKE Responder: ESP Perfect Forward Secrecy mismatch IKE Responder: ESP Perfect Forward Secrecy mismatch IKE Responder: ESP Perfect Forward Secrecy mismatch IKE Responder: Algorithms and/ or keys do not match IKE Responder: Algorithms and/ or keys do not match IKE Responder: Algorithms and/ or keys do not match Administrator logged out Administrator logged out Administrator logged out Administrator logged out inactivity timer expired Administrator logged out inactivity timer expired Administrator logged out inactivity timer expired 28

31 User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User logged out %s User logged out User logged out %s Maintenance VPN IPsec INFO Maintenance VPN IPsec INFO Maintenance VPN IPsec INFO Attack Attack User logged out max session time exceeded User logged out max session time exceeded User logged out max session time exceeded User logged out inactivity timer expired User logged out inactivity timer expired User logged out inactivity timer expired NAT device may not support IPsec AH pass through NAT device may not support IPsec AH pass through NAT device may not support IPsec AH pass through ALERT 547 TCP Xmas Tree dropped ALERT 547 TCP Xmas Tree dropped Attack ALERT 547 TCP Xmas Tree dropped User Activity VPN PKI INFO Requesting CRL from User Activity VPN PKI INFO Requesting CRL from User Activity VPN PKI INFO Requesting CRL from User Activity VPN PKI INFO CRL loaded from User Activity VPN PKI INFO CRL loaded from User Activity VPN PKI INFO CRL loaded from User Activity VPN PKI ALERT Failed to get CRL from User Activity VPN PKI ALERT Failed to get CRL from User Activity VPN PKI ALERT Failed to get CRL from SonicOS 5.9 / / 6.2 Log Events Reference Guide 29

32 User Activity VPN PKI WARNING User Activity VPN PKI WARNING Not enough memory to hold the CRL Not enough memory to hold the CRL User Activity VPN PKI WARNING Not enough memory to hold the CRL User Activity VPN PKI ALERT Connection timed out User Activity VPN PKI ALERT Connection timed out User Activity VPN PKI ALERT Connection timed out User Activity VPN PKI ALERT User Activity VPN PKI ALERT Cannot connect to the CRL server Cannot connect to the CRL server User Activity VPN PKI ALERT Cannot connect to the CRL server User Activity VPN PKI ERROR Unknown reason User Activity VPN PKI ERROR Unknown reason User Activity VPN PKI ERROR Unknown reason User Activity VPN PKI ALERT Failed to Process CRL from User Activity VPN PKI ALERT Failed to Process CRL from User Activity VPN PKI ALERT Failed to Process CRL from User Activity VPN PKI ALERT Bad CRL format User Activity VPN PKI ALERT Bad CRL format User Activity VPN PKI ALERT Bad CRL format User Activity VPN PKI ALERT Issuer match failed User Activity VPN PKI ALERT Issuer match failed User Activity VPN PKI ALERT Issuer match failed User Activity VPN PKI ALERT Certificate on Revoked list(crl) User Activity VPN PKI ALERT Certificate on Revoked list(crl) User Activity VPN PKI ALERT Certificate on Revoked list(crl) User Activity VPN PKI ALERT No Certificate for User Activity VPN PKI ALERT No Certificate for User Activity VPN PKI ALERT No Certificate for User Activity PPP Dial Up INFO PPP Dial Up: Dialing: %s User Activity PPP Dial Up INFO PPP Dial Up: Dialing: %s User Activity PPP Dial Up INFO PPP Dial Up: Dialing: %s 30