SonicOS Log Event Reference Guide

Transcription

1 COMPREHENSIVE INTERNET SECURITY S o n i c WALL Internet Security Ap p l i a n c e s SonicOS Log Event Reference Guide

2 Using the SonicOS Log Event Reference Guide This reference guide lists and describes SonicOS log event messages. Reference a log event message by using the alphabetical index of log event messages. This document contains the following sections: SonicOS Log Event s Overview on page 1 Configuring SonicOS Log > View on page 4 Referencing the SonicOS Log > View Field Display on page 7 Index of Log Event s on page 9 Index of Syslog Tag Field Description on page 63 SonicOS Log Event s Overview During the operation of a SonicWALL security appliance, SonicOS software sends log event messages to the Log > View page in the SonicWALL management interface. In Figure 1, the Log > View page is displayed. Figure 1 SonicOS Enhanced Log > View page Note: Event logging automatically begins when the SonicWALL security appliance is powered on and configured. SonicOS supports a traffic log containing entries with multiple fields. Log event messages provide operational informational and debugging information to help you diagnose problems with communication lines, internal hardware, or your firmware configuration. For the SonicOS CLI console display, use the show log command to display log events. Refer to the SonicOS CLI Reference Guide located on the SonicWALL Web site: < SONICOS LOG EVENT REFERENCE GUIDE 1

3 Note: Not all log event messages indicate operational issues with your SonicWALL security appliance. SonicOS Log Entries Each log entry contains the date and time of the event and a brief message describing the event. The SonicWALL manages log events in the following manner: TCP, UDP, or ICMP packets When IP packets are by the SonicWALL security appliance, TCP, UDP and ICMP messages are displayed. The messages include the source and destination IP addresses of the packet. The TCP or UDP port number or the ICMP code follows the IP address. Log event messages usually include the name of the service in quotation marks. Web, FTP, Gopher, or Newsgroup blocked When a computer attempts to connect to the blocked site or newsgroup, a log event is displayed. Blocked is defined as a Web site, connection, or event that is denied access from the SonicWALL security appliance. The computer s IP address, Ethernet address, the name of the blocked Web site, and the Content Filter List Code is displayed. Code definitions for the 12 Content Filter List categories are shown below. 1. Violence 7. Cult 2. Intimate Apparel/Swimsuit 8. Drugs/Illegal Drugs 3. Nudism 9. Criminal Skills/Illegal Skills 4. Adult/Mature Content/ Pornography 10. Sex Education 5. Weapons 11. Gambling 6. Hate/Racism 12. Alcohol & Tobacco ActiveX, Java, Cookie or Code Archive blocked When ActiveX, Java or Web cookies are blocked, messages with the source and destination IP addresses of the connection attempt is displayed. Ping of Death, IP Spoof, and SYN Flood Attacks The IP address of the machine under attack and the source of the attack is displayed. In most attacks, the source address shown is fake and does not reflect the real source of the attack. SonicOS Log View Settings The Log View Settings section of the Log > View page provides you the filtering controls to filter log event messages based on your configured log filter logic. It also contains the following log management buttons: Refresh Renews the Log View table with current log event messages. Clear Log Empties the entries in the Log View table. Log s log event messages to your configured SMTP server or list of addresses. Export Log Exports the log into a plain.txt or.csv file format. 2 SONICOS LOG EVENT REFERENCE GUIDE

4 SonicOS Log View Display Format The Log > View page displays log event messages in following format for alert notification: Time Displays the hour and minute the event occurred. Priority Displays the level urgency for the event. Category Displays the event type. Displays a description of the event. Source Displays the source IP address of incoming IP packet. Displays the destination IP address of incoming IP packet. Note Displays displays additional information specific to a particular event occurrence. Rule Displays the source and destination zones for the access rule. This field provides a link to the access rule defined in the Firewall > Rules page. The display fields for a log event message provides you with data to verify your configurations, trouble-shoot your security appliance, and track IP traffic. SONICOS LOG EVENT REFERENCE GUIDE 3

5 Configuring SonicOS Log > View The Log > View page in the Web-based SonicWALL management interface allows you to export log reports, log reports, and monitor real-time Syslog data. As soon as you power on your SonicWALL security appliance, SonicOS software sends Syslog data to your log. In the SonicWALL management interface, you can navigate through the subcategories of the Log setting for reporting and customizing log reports. In Figure 2, the Log > View page is displayed. Figure 2 SonicOS Enhanced Log > View page 4 SONICOS LOG EVENT REFERENCE GUIDE

6 Setting the Log Filter Logic By default, the SonicOS filter logic is set to Priority && Category && Source &&. The double ampersand symbols (&&) indicate the boolean expression and. The default SonicOS filter logic displays all log events. In Figure 3, the Log > View > Log View Settings page is displayed. Figure 3 SonicOS Log View Settings Log Event Filters Default filter logic value Group filters Apply filters Default filter logic Export logs Reset filters Applying Custom Log Event Filters This section provides examples on using the Log View Settings to filter log event messages displayed in the Log View page. Configuration Example: Filtering Log Event s by Priority Value To set the log filter logic to display only log event messages with a priority level of Emergency: 1. Select Emergency from the filter-priority Value pull-down menu. 2. Click on the Apply Filters button. Configuration Example: Filtering Log Event s by Category Value To set the log filter logic to display only log event messages with a category event type of Attacks: 1. Select Attacks from the filter-category Value pull-down menu. 2. Click on the Apply Filters button. SONICOS LOG EVENT REFERENCE GUIDE 5

7 Configuration Example: Filtering Log Event s by Source Value To set the log filter logic to display only log event messages associated to a source IP address: 1. Enter the source IP address or select an interface from the filter-source Value pull-down menu. 2. Click on the Apply Filters button. Configuration Example: Filtering Log Event s by Value To set the log filter logic to display only log event messages associated to a destination IP address: 1. Enter the destination IP address or select an interface from the filter-source Value pull-down menu. 2. Click on the Apply Filters button. Using Group Filters Note: Use Group filters to change the default SonicOS filter logic (Priority && Category && Source && ) from double ampersand symbols (&&) to double pipe symbols ( ) to indicate the boolean expression or. When using group filters, select two or more Group Filters checkboxes. If you select only one Group Filter checkbox, the filter logic will remain the same. Selecting only the Priority-Group Filter checkbox provides you with the following filter logic: (Priority) && Category && Source && Configuration Example: Using the Priority Group Filter and Category Group Filter To set the log filter logic to display log event messages with a priority level of Emergency or a category event type of Attack: 1. Select the Priority group filter checkbox. 2. Select the Category group filter checkbox. 3. Select Emergency from the filter-priority Value pull-down menu. 4. Select Attacks from the filter-category Value pull-down menu. Figure 4 illustrates the SonicOS filter logic updated as follows: (Priority Category) && Source && Figure 4 SonicOS Log Group Filters A filter logic using the boolean expression is less restrictive than the default filter logic using the boolean expression &&. With the boolean expression, log event messages are displayed if they match either filter values. With the boolean expression &&, log event messages are displayed if they match both filter values. 6 SONICOS LOG EVENT REFERENCE GUIDE

8 Exporting the Logs to a File This section provides instructions to export your log to a file. To export the log to a file: 1. Click on the Export Log button. You will be prompted to select a export file format type as illustrated in Figure 5. Figure 5 SonicOS Export Log Note: 2. Select a file format: Plain text format used in log and alert Saves the log file as plain text, which can be used for alert s. Comma-Separated Value (CSV) format Saves the log file for importing into Microsoft Excel or other presentation development application. 3. Click on the Export button. 4. Save the exported log file to a location on your personal computer s hard drive. You can export a log to a file with applied filter settings. Referencing the SonicOS Log > View Field Display SonicOS 2.5 Enhanced and Standard releases and greater provide the SonicOS Log > View field display as illustrated in Figure 6. Figure 6 SonicOS Log > View Field Display Time and Date Stamp Category Source IP Address Log Event Notes Priority Descrition IP Rule SONICOS LOG EVENT REFERENCE GUIDE 7

9 Referencing the SonicWALL Firmware Log > View Log Field Display SonicWALL Firmware release and greater provide the SonicWALL Firmware Log > View Log field display as illustrated in Figure 7. Figure 7 SonicWALL Firmware Log > View Log Field Display Time and Date Stamp Source IP Address Additional Information Event IP Address Rule Number (If Applicable) 8 SONICOS LOG EVENT REFERENCE GUIDE

10 Index of Log Event s This section contains a list of log event messages for all SonicWALL Firmware and SonicOS Software Releases, ordered alphabetically. Use your web browser s Find function to search for a command. Log Event Symbols Key Log Event Symbol Description Context %s Ethernet Port Down Represents a character string. [WAN LAN DMZ] Ethernet Port Down The cache is full; %u open connections; some will be Represents a numerical string. The cache is full; [40,000] open connections; some will be TCP IP Layered-Data Packet Processing and SonicOS Log Event Handling In specific cases of multi-layer packet processing, a TCP connection initially logged as "open," will be rejected by a deeper layer of packet processing. In these cases, the connection request has not been forwarded by the SonicWALL security appliance, and the initial Connection Open SonicOS log event message should be ignored in favor of the TCP Connection Dropped log event message. Each log event message described in the following table provides the following log event details: SonicOS Category Displays the SonicOS Software category event type. Legacy Category Displays the SonicWALL Firmware Software category event type. Priority Level Displays the level of urgency of the log event message. Log ID Number Displays the ID number of the log event message. SNMP Trap Type Displays the SNMP Trap ID number of the log event message. Log Event SonicOS Category Legacy Category Priority Level Log ID Number SNMP Trap Type Log Event Type #Web site hit Traffic Connection Traffic Information Standard HTTP Traffic Report %s VPN IKE User Activity Information Standard %s ARS --- Information Standard %s ARS --- Notice Standard %s ARS --- Debug Standard SONICOS LOG EVENT REFERENCE GUIDE 9

11 %s Ethernet Port Down %s Ethernet Port Up %s-payload processing error Firewall Event System Error Error Standard Firewall Event System Error Warning Standard VPN IKE Debug Error Standard SonicWALL Registration Update Needed: Restore your existing security service subscriptions by clicking here. Security s Maintenance Warning Simple b Management Wireless b Management Information Simple A prior version of preferences was loaded because the most recent preferences file was inaccessible A SonicOS Standard to Enhanced Upgrade was performed Firewall Event System Error Warning Simple Firewall Event Maintenance Information Simple attempt from host out of compliance with GSC policy attempt from host without Anti-Virus agent installed attempt from host without GSC installed Security s Security s Security s Maintenance Information Standard Maintenance Information Standard Maintenance Information Standard rule added Firewall Rule User Activity Information Simple Rule rule deleted Firewall Rule User Activity Information Simple Rule 10 SONICOS LOG EVENT REFERENCE GUIDE

12 rule modified Firewall Rule User Activity Information Simple Rule to proxy server denied ActiveX access denied ActiveX or Java archive access denied Blocked Sites Notice Standard Note Blocked Blocked Code Notice Standard Note Blocked Blocked Code Notice Standard Note Blocked AD agent %s is not responding Add an attack message Adding Dynamic Entry for Bound MAC Address Adding L2TP IP pool Address object Failed Adding to multicast policylist, interface: %s Adding to Multicast policylist, VPN SPI: %s Administrator logged out Administrator logged out - inactivity timer expired Administrator login allowed Administrator login denied due to bad credentials MS AD --- Error Standard Firewall Event Attack Error Simple --- Information Standard Note ENET L2TP Server System Error Error Simple Multicast --- Debug Standard Multicast --- Debug Standard Authentication User Activity Information Standard Authentication User Activity Information Standard Authentication User Activity Information Standard Authentication Attack Alert Standard SONICOS LOG EVENT REFERENCE GUIDE 11

13 Administrator login denied from %s; logins disabled from this interface Adminstrator name changed All DDNS associations have been deleted All preference values have been set to factory default values Allowed LDAP server certificate with wrong host name Authentication Attack Alert Standard Authentication Maintenance Information Standard DDNS Maintenance Information Simple Firewall Event System Error Warning Simple RADIUS User Activity Warning Standard Note Anti-Spyware Alert: %s Anti-Spyware Prevention Alert: %s Anti-Spyware Expired Anti-Virus agent out-of-date on host Anti-Virus Licenses Exceeded Security s Security s Security s Attack Alert Standard Anti-Spy Attack Alert Standard Anti-Spy Maintenance Warning Simple Maintenance Information Standard Maintenance Information Standard Arp request packet received Arp request packet sent Arp response packet received Arp response packet sent --- Information Standard Note ENET --- Information Standard Note ENET --- Information Standard Note ENET --- Information Standard Note ENET ARP timeout Debug Debug Standard Association Flood from wlan station WLAN IDS WLAN IDS Alert Simple 12 SONICOS LOG EVENT REFERENCE GUIDE

14 Authentication timeout during Remotely Triggered Dial-out session Authentication User Activity Information Simple Back Orifice attack Backup active Backup firewall being preempted by Primary Backup firewall has transitioned to Active Backup firewall has transitioned to Idle Backup going Active in preempt mode after reboot Backup missed heartbeats from Primary Backup received error signal from Primary Backup received reboot signal from Primary Backup shut down because license is expired Backup will be shut down in %s minutes High Avaiability High Availability High Availability High Availability High Availability High Availability High Availability High Availability High Availability High Availability Attack Alert Standard System Error Information Simple System Error Error Simple Maintenance Information Simple Maintenance Information Simple System Error Error Simple System Error Error Simple System Error Error Simple System Error Error Simple System Error Error Simple System Error Error Standard Bad CRL format VPN PKI User Activity Alert Simple Blocked Quick Mode for Client using Default KeyId VPN Client System Error Error Standard SONICOS LOG EVENT REFERENCE GUIDE 13

15 BOOTP Client IP address on LAN conflicts with remote device IP, deleting IP address from remote table BOOTP reply relayed to local device BOOTP Request received from remote device BOOTP server response relayed to remote device BOOTP Maintenance Information Standard BOOTP Maintenance Information Standard BOOTP Debug Debug Standard BOOTP Debug Debug Standard Broadcast packet Debug Debug Standard Note Protocol Cannot connect to the CRL server Cannot Validate Issuer Path Certificate on Revoked list (CRL) VPN PKI User Activity Alert Simple VPN PKI User Activity Alert Simple VPN PKI User Activity Alert Simple CFL auto-download disabled, time problem detected Security s Maintenance Information Simple CLI administrator logged out CLI administrator login allowed CLI administrator login denied due to bad credentials Computed hash does not match hash received from peer Authentication User Activity Information Simple Authentication User Activity Information Simple Authentication User Activity Warning Simple VPN IKE User Activity Warning Standard 14 SONICOS LOG EVENT REFERENCE GUIDE

16 Connection Closed Note: In specific cases of multi-layer packet processing, a TCP connection initially logged as "open," will be rejected by a deeper layer of packet processing. In these cases, the connection request has not been forwarded by the SonicWALL security appliance, and the initial Connection Open SonicOS log event message should be ignored in favor of the TCP Connection Dropped log event message. Traffic Connection Traffic Information Standard Traffic Report Connection Opened Note: In specific cases of multi-layer packet processing, a TCP connection initially logged as "open," will be rejected by a deeper layer of packet processing. In these cases, the connection request has not been forwarded by the SonicWALL security appliance, and the initial Connection Open SonicOS log event message should be ignored in favor of the TCP Connection Dropped log event message. Traffic Connection Information Standard Note Protocol Connection timed out VPN PKI User Activity Alert Simple Cookie removed Blocked Code Notice Standard CRL has expired VPN PKI User Activity Alert Simple CRL loaded from VPN PKI User Activity Information Simple CRL missing - Issuer requires CRL checking CRL validation failure for Root Certificate Crypto DES test failed Crypto DH test failed VPN PKI User Activity Alert Simple VPN PKI User Activity Alert Simple Crypto Test Maintenance Error Simple Crypto Test Maintenance Error Simple SONICOS LOG EVENT REFERENCE GUIDE 15

17 Crypto Hardware 3Des test failed Crypto Hardware 3DES with SHA test failed Crypto Hardware AES test failed Crypto hardware DES test failed Crypto Haredware DES with SHA test failed Crypto Hmac-MD5 fest failed Crypto Hmac-Sha1 test failed Crypto MD5 test failed Crypto RSA test failed Crypto Sha1 test failed DDNS association %s disabled DDNS association %s enabled DDNS association %s added DDNS association %s deactivated DDNS association %s deleted DDNS Association %s put on line Crypto Test Maintenance Error Simple Crypto Test Maintenance Error Simple Crypto Test Maintenance Error Standard Crypto Test Maintenance Error Simple Crypto Test Maintenance Error Simple Crypto Test Maintenance Error Simple Crypto Test Maintenance Error Simple Crypto Test Maintenance Error Simple Crypto Test Maintenance Error Simple Crypto Test Maintenance Error Simple DDNS Maintenance Information Simple DDNS Maintenance Information Simple DDNS Maintenance Information Simple DDNS Maintenance Information Simple DDNS Maintenance Information Simple DDNS Maintenance Information Simple 16 SONICOS LOG EVENT REFERENCE GUIDE

18 DDNS association %s taken Offline locally DDNS Failure: Provider %s DDNS Failure: Provider %s DDNS Failure: Provider %s DDNS Update success for domain %s DDNS Warning: Provider %s Deleting from Multicast policy list, interface : %s Deleting from Multicast policy list, VPN SPI : %s DDNS Maintenance Information Simple DDNS System Error Error Simple DDNS System Error Error Simple DDNS System Error Error Simple DDNS Maintenance Information Standard DDNS System Error Warning Simple Multicast --- Debug Standard Multicast --- Debug Standard Deleting IPSec SA VPN IKE User Activity Information Standard Note SPI DHCP client enabled but not ready DHCP Client did not get DHCP ACK DHCP Client failed to verify and lease has expired. Go to INIT state. DHCP Client got a new IP address lease. DHCP Client got ACK from server DHCP Client got NACK DHCP Client Maintenance Information Simple DHCP Client Maintenance Information Standard DHCP Client Maintenance Information Standard DHCP Client Maintenance Information Standard DHCP Client Maintenance Information Standard DHCP Client Maintenance Information Standard SONICOS LOG EVENT REFERENCE GUIDE 17

19 DHCP Client is declining address offered by the server. DHCP Client sending REQUEST and going to REBIND state DHCP Client sending REQUEST and going to RENEW state DHCP DISCOVER received from remote device DHCP lease. Lease from Central Gateway conflicts with Relay IP DHCP lease. Lease from Central Gateway conflicts with Remote Management IP DHCP lease relayed to local device DHCP lease relayed to remote device DHCP lease to LAN device conflicts with remote device, deleting remote IP entry DHCP NAK received from server DHCP OFFER received from server DHCP Client Maintenance Information Standard DHCP Client Maintenance Information Standard DHCP Client Maintenance Information Standard DHCP Relay Debug Information Standard DHCP Relay Maintenance Warning Standard DHCP Relay Maintenance Warning Standard DHCP Relay Maintenance Information Standard DHCP Relay Debug Information Standard DHCP Relay Maintenance Information Standard DHCP Relay Debug Information Standard DHCP Relay Debug Information Standard 18 SONICOS LOG EVENT REFERENCE GUIDE

20 DHCP Ranges altered automatically due to change in network settings for interface %s DHCP RELEASE received from remote device DHCP RELEASE relayed to Central Gateway DHCP REQUEST received from remote device DHCP Server not available. Did not get any DHCP OFFER. Firewall Event --- Information Standard DHCP Relay Debug Information Standard DHCP Relay Maintenance Information Standard DHCP Relay Debug Information Standard DHCP Client Maintenance Information Standard Diagnostic Code A Diagnostic Code B Diagnostic Code C Diagnostic Code D Diagnostic Code D Firewall Hardware Firewall Hardware Firewall Hardware Firewall Hardware Firewall Hardware System Error Error Simple Note System Error Error Simple Note System Error Error Simple Note System Error Error Standard Note Code System Error Error Simple Note Diagnostic Code E VPN IPSec System Error Error Standard Note Code Diagnostic Code F Diagnostic Code G Diagnostic Code H Diagnostic Code I Firewall Hardware Firewall Hardware Firewall Hardware Firewall Hardware System Error Error Simple Note System Error Error Simple Note System Error Error Simple Note System Error Error Simple Note Disconnecting L2TP Tunnel due to traffic timeout L2TP Client Maintenance Information Simple SONICOS LOG EVENT REFERENCE GUIDE 19

21 Disconnecting PPPoE due to traffic timeout Disconnecting PPTP Tunnel due to traffic timeout PPPoE Maintenance Information Simple PPTP Maintenance Information Simple Discovered HA Backup Firewall DNS packet allowed Drop Wlan traffic from non SonicPoint devcies High Availability Maintenance Information Simple Debug Information Standard Policy Attack Error Standard Dynamic IPSec client connected VPN IPSec User Activity Information Standard EIGRP packet fragment Error initializing Hardware acceleration for VPN Error Rebooting HA Peer Firewall Error setting the IP address of the backup, please manually set to backup LAN IP Error Synchronizing HA Peer Firewall Firewall Hardware High Availability High Availability High Availability Debug Notice Standard Note Attack Error Standard Maintenance Error Simple System Error Error Simple System Error Error Simple System Error Error Simple Exceeded Max multicast address limit Failed payload validation Failed payload verification after decryption. Possible preshared key mismatch. Multicast --- Warning Standard VPN IKE User Activity Warning Standard VPN IKE User Activity Warning Standard 20 SONICOS LOG EVENT REFERENCE GUIDE

22 Failed to find certificate Failed to get CRL from Failed to Process CRL from Failed to resolve name Failed to synchronize Relay IP Table Failure to add data channel VPN PKI User Activity Alert Simple VPN PKI User Activity Alert Simple VPN PKI User Activity Alert Simple Maintenance Information Simple DHCP Relay System Error Warning Standard Unused Debug Debug Standard Failure to reach Interface %s probe High Availability System Error Error Standard Fan Failure Firewall Hardware System Environment Alert Simple Forbidden attachment deleted Forbidden attachment disabled Attack Error Standard Attack Alert Standard Found Rogue Point Found Rogue Point WLAN IDS WLAN IDS Alert Simple WLAN IDS WLAN IDS Alert Simple Fragmented packet TCP UDP ICMP Notice Standard Note Protocol Fraudulent Microsoft certificate found; access denied FTP: Data connection from non default port FTP: PASV response bounce attack. Attack Error Standard Attack Alert Standard Attack Alert Standard Note SONICOS LOG EVENT REFERENCE GUIDE 21

23 FTP: PASV response spoof attack. FTP: PORT bounce attack. Gateway Anti-Virus Alert: %s Gateway Anti-Virus expired Security s Security s Attack Error Standard Attack Alert Standard Note Attack Alert Standard Maintenance Warning Simple Global VPN Client connection is not allowed. Appliance is not registered. Global VPN Client License Exceeded: Connection denied. Global VPN Client version cannot enforce personal firewall. Minimum Version required is 2.1. Got DHCP OFFER. Selecting. VPN Client System Error Information Standard VPN Client System Error Information Standard VPN Client User Activity Information Standard DHCP Client Maintenance Information Standard GSC policy out-of-date on host Security s Maintenance Information Standard Guest account '%s' created Guest account '%s' deleted Guest account '%s' disabled Guest account '%s' pruned Guest account '%s' re-enabled Authentication User Activity Information Standard Authentication User Activity Information Standard Authentication User Activity Information Standard Authentication User Activity Information Standard Authentication User Activity Information Standard 22 SONICOS LOG EVENT REFERENCE GUIDE

24 Guest account '%s' re-generated Guest login denied. Guest '%s' is already logged in. Please try again later. H.323/H.225 Connect Authentication User Activity Information Standard Authentication User Activity Information Standard VoIP VoIP Debug Standard Note H.323/H.225 Setup VoIP VoIP Debug Standard Note H.323/H.245 Address H.323/H.245 End Session H.323/RAS Admission Confirm H.323/RAS Admission Reject H.323/RAS Admission Request H.323/RAS Bandwidth Reject H.323/RAS Disengage Confirm H.323/RAS Disengage Reject H.323/RAS Gatekeeper Reject H.323/RAS Location Confirm H.323/RAS Location Reject H.323/RAS Registration Reject H.323/RAS Unknown Response VoIP VoIP Debug Standard Note VoIP VoIP Debug Standard Note VoIP VoIP Debug Standard Note VoIP VoIP Debug Standard Note VoIP VoIP Debug Standard Note VoIP VoIP Debug Standard Note VoIP VoIP Debug Standard Note VoIP VoIP Debug Standard Note VoIP VoIP Debug Standard Note VoIP VoIP Debug Standard Note VoIP VoIP Debug Standard Note VoIP VoIP Debug Standard Note VoIP VoIP Debug Standard Note SONICOS LOG EVENT REFERENCE GUIDE 23

25 H.323/RAS Unregistration Reject VoIP VoIP Debug Standard Note HA packet processing error High Availability Maintenance Information Simple Hardware Failover settings were not upgraded Header verification failed HTTP management port has changed HTTPS management port has changed Firewall Event Maintenance Information Simple VPN IKE User Activity Warning Standard Firewall Event Maintenance Information Simple Note Firewall Event Maintenance Information Simple Note ICMP checksum error ICMP packet allowed ICMP packet ICMP packet ICMP packet from LAN allowed UDP Notice Standard Debug Information Standard Policy ICMP Notice Standard Policy ICMP Notice Standard ICMP Debug Information Standard ICMP ICMP packet from LAN LAN ICMP LAN TCP Notice Standard ICMP If not already enabled, enabling NTP is recommended Firewall Hardware System Error Warning Simple IGMP packet, wrong checksum received on interface %s IGMP Leave group message Received on interface %s Multicast --- Notice Standard Multicast --- Information Standard 24 SONICOS LOG EVENT REFERENCE GUIDE

26 IGMP packet, decoding error IGMP Packet Not handled. Packet type : %s IGMP querier Router detected on interface %s IGMP querier Router detected on VPN tunnel, SPI %S IGMP state table entry time out,deleting interface : %s for multicast address : %s IGMP state table entry time out,deleting VPN SPI :%s for Multicast address : %s IGMP V2 client joined multicast Group : %s IGMP V2 Membership report received from interface %s IGMP V3 client joined multicast Group : %s IGMP V3 Membership report received from interface %s IGMP V3 packet, unsupported Record type : %s Multicast --- Notice Standard Multicast --- Notice Standard Multicast --- Debug Standard Multicast --- Debug Standard Multicast --- Debug Standard Multicast --- Debug Standard Multicast --- Information Standard Multicast --- Debug Standard Multicast --- Information Standard Multicast --- Debug Standard Multicast --- Notice Standard SONICOS LOG EVENT REFERENCE GUIDE 25

27 IGMP V3 reord type : %s not Handled IKE ID mismatch %s IKE Initiator drop: Packet dest address does not match selected local interface address IKE Initiator: Accepting IPSec proposal (Phase 2) IKE Initiator: Accepting peer lifetime (Phase 1) IKE Initiator: Aggressive Mode complete (Phase 1) IKE Initiator: Main Mode complete (Phase 1) IKE Initiator: Received notify. NO_PROPOSAL_ CHOSEN IKE Initiator: Start Aggressive Mode negotiation (Phase 1) IKE Initiator: Start Main Mode negotiation (Phase 1) IKE Initiator: Start Quick Mode (Phase 2) IKE Initiator: Using secondary gateway to negotiate Multicast --- Debug Standard VPN IKE Debug Debug Standard VPN IKE User Activity Information Standard VPN IKE User Activity Information Standard Note VPN IKE User Activity Information Standard VPN IKE User Activity Information Standard VPN IKE User Activity Information Standard VPN IKE User Activity Warning Standard VPN IKE User Activity Information Standard VPN IKE User Activity Information Standard VPN IKE User Activity Information Standard VPN IKE User Activity Information Standard 26 SONICOS LOG EVENT REFERENCE GUIDE

28 IKE negotiation aborted due to timeout IKE negotiation complete. Adding IPSec SA. (Phase 2) IKE Responder drop: Packet dest address does not match selected local interface address IKE Responder: %s policy does not allow static IP for Virtual Adapter. IKE Responder: Accepting IPSec proposal (Phase 2) IKE Responder: Aggressive Mode complete (Phase 1) IKE Responder: AH Perfect Forward Secrecy mismatch IKE Responder: Algorithms and/or keys do not match IKE Responder: Default LAN gateway is not set but peer is proposing to use this SA as a default route IKE Responder: Default LAN gateway is set but peer is not proposing to use this SA as a default route VPN IKE User Activity Information Standard VPN IKE User Activity Information Standard VPN IKE User Activity Information Standard VPN Client System Error Error Standard VPN IKE User Activity Information Standard Note VPN IKE User Activity Information Standard VPN IKE User Activity Warning Standard VPN IKE User Activity Warning Standard VPN IKE Attack Error Standard Note VPN IKE User Activity Warning Standard Note SONICOS LOG EVENT REFERENCE GUIDE 27

29 IKE Responder: ESP Perfect Forward Secrecy mismatch IKE Responder: IKE proposal does not match (Phase 1) IKE Responder: IP Address already exists in the DHCP relay table. Client traffic not allowed. IKE Responder: IPSec proposal does not match (Phase 2) IKE Responder: Main Mode complete (Phase 1) IKE Responder: Mode %d - not transport mode. Xauth is required but not supported by peer. IKE Responder: Mode %d - not tunnel mode IKE Responder: No match for proposed remote network address IKE Responder: No matching Phase 1 ID found for proposed remote network IKE Responder: Proposed local network is but SA has no LAN Default Gateway VPN IKE User Activity Warning Standard VPN IKE User Activity Warning Standard VPN Client System Error Error Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Information Standard VPN IKE Debug Warning Standard Number VPN IKE User Activity Warning Standard Number VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note 28 SONICOS LOG EVENT REFERENCE GUIDE

30 IKE Responder: Proposed remote network is but not DHCP relay nor default route IKE Responder: Received Aggressive Mode request (Phase 1) IKE Responder: Received Main Mode request (Phase 1) IKE Responder: Received Quick Mode Request (Phase 2) IKE Responder: Tunnel terminates inside firewall but proposed local network is not inside firewall IKE Responder: Tunnel terminates on DMZ but proposed local network is on LAN IKE Responder: Tunnel terminates on LAN but proposed local network is on DMZ IKE Responder: Tunnel terminates outside firewall but proposed local network is not NAT public address IKE Responder: Tunnel terminates outside firewall but proposed remote network is not NAT public address VPN IKE User Activity Warning Standard VPN IKE User Activity Information Standard VPN IKE User Activity Information Standard VPN IKE User Activity Information Standard VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note SONICOS LOG EVENT REFERENCE GUIDE 29

31 IKE SA lifetime expired. VPN IKE User Activity Information Standard Illegal IPSec SPI VPN IPSec User Activity Information Standard Imported VPN SA is invalid - disabled Inbound connection from RBL-listed SMTP server Incoming call received for Remotely Triggered Dial-out session Incompatible IPSec Security Association Incorrect authentication received for Remotely Triggered Dial-out Firewall Event Maintenance Warning Standard Note RBL --- Notice Standard Authentication User Activity Information Simple VPN IPSec User Activity Information Standard Authentication User Activity Information Simple Ini Killer attack Attack Alert Standard Interface %s Link Is Down Interface %s Link Is Up Interface IP Assignment : Binding and initializing %s Interface IP Assignment changed: Shutting down %s Interface statistics report Firewall Event System Error Error Standard Firewall Event System Error Warning Standard Firewall Event Maintenance Information Standard Firewall Event Maintenance Information Standard GMS --- Information Simple Interface Statistics 30 SONICOS LOG EVENT REFERENCE GUIDE

32 Invalid TCP flags on an incomplete connection --- Notice Standard Note Invalid VLAN packet --- Alert Standard Note IP Header checksum error TCP UDP Notice Standard IP spoof detected on packet to Central Gateway, packet DHCP Relay Attack Error Standard Note ENET IP spoof Attack Alert Standard Note ENET IP type %s packet LAN UDP LAN TCP Notice Standard IPS Alert: %s IPS Alert: %s IPS Prevention Alert: %s IPS Prevention Alert: %s Attack Alert Standard IDP Attack Alert Standard Attack Alert Standard IDP Attack Alert Standard IPSec (AH) packet VPN IPSec TCP UDP ICMP Notice Standard Note IPSec (AH) packet ; waiting for pending IPSec connection VPN IPSec Debug Debug Standard IPSec (ESP) packet VPN IPSec TCP UDP ICMP Notice Standard Note IPSec (ESP) packet ; waiting for pending IPSec connection VPN IPSec Debug Debug Standard SONICOS LOG EVENT REFERENCE GUIDE 31

33 IPSec Authentication Failed VPN IPSec Attack Error Standard IPSec connection interrupt Debug Debug Standard IPSec Decryption Failed VPN IPSec Attack Error Standard IPSec packet TCP UDP ICMP Notice Standard IPSec packet ; waiting for pending IPSec connection Debug Debug Standard IPSec packet from an illegal host IPSec packet from or to an illegal host IPSEC Replay Detected VPN IPSec Maintenance Information Standard VPN IPSec Attack Error Standard VPN IPSec Attack Alert Standard Note IPSecTunnel status changed VPN VPN Tunnel Status Information Simple ISDN Driver Firmware successfully updated Firewall Event Maintenance Information Simple Issuer match failed VPN PKI User Activity Alert Simple Java access denied Blocked Code Notice Standard Note Blocked L2TP enabled but not ready L2TP Max Retransmission Exceeded L2TP PPP Authentication Failed Unused Maintenance Information Simple L2TP Client Maintenance Information Simple L2TP Client Maintenance Information Simple L2TP PPP Down L2TP Client Maintenance Information Simple L2TP PPP link down L2TP Client Maintenance Information Simple 32 SONICOS LOG EVENT REFERENCE GUIDE

34 L2TP PPP Negotiation Started L2TP PPP Session Up L2TP Server : Deleting the L2TP active Session L2TP Server : Deleting the Tunnel L2TP Server : L2TP Session Established. L2TP Server : L2TP Tunnel Established. L2TP Server : Retransmission Timeout, Deleting the Tunnel L2TP Server : User Name authentication Failure locally. L2TP Server: Local Authentication Failure L2TP Server: Local Authentication Success. L2TP Server: Radius Authentication Success L2TP Server: Radius reports Authentication Failure L2TP Server: Radius server not assigned IP address L2TP Client Maintenance Information Simple L2TP Client Maintenance Information Simple L2TP Server Maintenance Information Standard L2TP Server Maintenance Information Standard L2TP Server Maintenance Information Standard L2TP Server Maintenance Information Standard L2TP Server Maintenance Information Standard L2TP Server Maintenance Information Standard L2TP Server Maintenance Information Standard L2TP Server Maintenance Information Standard L2TP Server Maintenance Information Standard L2TP Server Maintenance Information Standard L2TP Server Maintenance Information Standard SONICOS LOG EVENT REFERENCE GUIDE 33

35 L2TP Server: Call Disconnect from Remote. L2TP Server: Tunnel Disconnect from Remote. L2TP Session Disconnect from Remote L2TP Session Established L2TP Session Negotiation Started L2TP Tunnel Disconnect from Remote L2TP Tunnel Established L2TP Tunnel Negotiation Started LAN Subnet configurations were not upgraded. L2TP Server Maintenance Information Standard L2TP Server Maintenance Information Standard L2TP Client Maintenance Information Simple L2TP Client Maintenance Information Simple L2TP Client Maintenance Information Simple L2TP Client Maintenance Information Simple L2TP Client Maintenance Information Simple L2TP Client Maintenance Information Simple Firewall Event Maintenance Information Simple Land attack Attack Alert Standard License exceeded: Connection because too many IP addresses are in use on your LAN Firewall Event System Error Error Standard License of HA pair doesn't match High Availability System Error Error Simple Local user login allowed Local user login denied due to bad credentials Locked-out user logins allowed - lockout period expired Authentication User Activity Information Standard Authentication User Activity Information Standard Authentication User Activity Information Standard Note 34 SONICOS LOG EVENT REFERENCE GUIDE

36 Locked-out user logins allowed by administrator Authentication User Activity Information Standard Note Log Cleared Firewall Logging Maintenance Information Simple Log Debug Firewall Event Debug Error Simple Log successfully sent via Firewall Logging Maintenance Information Simple Login screen timed out MAC address collides with Static ARP Entry with Bound MAC address; packet Authentication User Activity Information Standard --- Notice Standard Note ENET Machine %s removed from SYN flood blacklist Malformed or unhandled IP packet Maximum events per second threshold exceeded Firewall Logging --- Alert Standard Attack Alert Standard System Error Critical Simple Maximum sequential failed dial attempts (10) to a single dial-up number: %s PPP Dial-up Attack Error Standard Maximum syslog data per second threshold exceeded Firewall Logging System Error Critical Simple Multicast application %s not supported Multicast packet, Invalid src IP received on interface : %s Multicast --- Information Standard Multicast --- Alert Standard SONICOS LOG EVENT REFERENCE GUIDE 35

37 Multicast packet, wrong MAC address receieved on interface : %s Multicast TCP packet Multicast UDP packet, no state entry Multicast UDP packet, RTCP stateful failed Multicast UDP packet, RTP stateful failed NAT device may not support IPSec AH passthrough NAT Discovery : No NAT/NAPT device detected between IPSec Security gateways NAT Discovery : Local IPSec Security Gateway behind a NAT/ NAPT Device NAT Discovery : Peer IPSec Security Gateway behind a NAT/ NAPT Device NAT Discovery : Peer IPSec Security Gateway doesn't support VPN NAT Traversal NAT translated packet exceeds size limit, packet Multicast --- Alert Standard Multicast --- Notice Standard Multicast --- Notice Standard Multicast --- Warning Standard Multicast --- Warning Standard VPN IPSec Maintenance Information Simple VPN IKE User Activity Information Standard VPN IKE User Activity Information Standard VPN IKE User Activity Information Standard VPN IKE User Activity Information Standard Debug Debug Standard 36 SONICOS LOG EVENT REFERENCE GUIDE

38 Net Spy attack Attack Alert Standard NetBIOS settings were not upgraded. Use >IP Helper to configure NetBIOS support Firewall Event Maintenance Information Simple NetBus attack Attack Alert Standard for interface %s overlaps with another interface. Modem Mode Disabled: re-enabling NAT Modem Mode Enabled: turning off NAT Firewall Event Maintenance Information Standard PPP Dial-up Maintenance Information Simple PPP Dial-up Maintenance Information Simple New URL List loaded Newsgroup access allowed Newsgroup access denied Security s Maintenance Information Simple Blocked Sites Notice Standard Note Blocked Blocked Sites Notice Standard Note Blocked No Certificate for VPN PKI User Activity Alert Simple No new URL List available Security s Maintenance Information Simple No response from ISP Disconnecting PPPoE. No response from PPTP server to call requests No response from PPTP server to control connection requests PPPoE Maintenance Information Simple PPTP Maintenance Information Simple PPTP Maintenance Information Simple SONICOS LOG EVENT REFERENCE GUIDE 37

39 No response from server to Echo Requests, disconnecting PPTP Tunnel No valid DNS server specified for RBL lookups Not all configurations may have been completely upgraded Not enough memory to hold the CRL Obtained Relay IP Table from Remote Gateway OCSP Failed to Resolve Domain Name. OCSP Internal error handling received response. OCSP received response error. OCSP received response. OCSP Resolved Domain Name. OCSP send request message failed. OCSP sending request. Outbound connection to RBL-listed SMTP server PPTP Maintenance Information Simple RBL --- Error Simple Firewall Event Maintenance Information Simple VPN PKI User Activity Warning Simple DHCP Relay Maintenance Information Standard VPN PKI User Activity Error Standard Note VPN PKI User Activity Error Standard Note VPN PKI User Activity Error Standard Note VPN PKI User Activity Information Standard Note VPN PKI User Activity Information Standard Note VPN PKI User Activity Error Standard Note VPN PKI User Activity Information Standard Note RBL --- Notice Standard Out-of-order command packet Debug Debug Standard 38 SONICOS LOG EVENT REFERENCE GUIDE

40 Packet by wlan guest check Packet by wlan vpn traversal check Wireless TCP UDP ICMP Wireless TCP UDP ICMP Warning Standard Warning Standard Packet. No firewall rule associated with VPN policy. VPN System Error Alert Standard Note Ping of death Attack Alert Standard PKI Failure: CA certificates store exceeded. Cannot verify this Local Certificate PKI Failure: Cannot alloc memory PKI Failure: Certificate's ID does not match this SonicWall PKI Failure: Duplicate local certificate PKI Failure: Duplicate local certificate name PKI Failure: Import failed PKI Failure: Improper file format. Please select PKCS#12 (*.p12) file PKI Failure: Incorrect admin password PKI Failure: Internal error PKI Failure: Loaded but could not verify certificate VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple SONICOS LOG EVENT REFERENCE GUIDE 39

41 PKI Failure: Loaded the certificate but could not verify it's chain PKI Failure: No CA certificates yet loaded PKI Failure: Output buffer too small PKI Failure: public-private key mismatch PKI Failure: Reached the limit for local certs, cant load any more PKI Failure: Temporary memory shortage, try again PKI Failure: The certificate chain has no root PKI Failure: The certificate chain is circular PKI Failure: The certificate chain is incomplete PKI Failure: The certificate or a certificate in the chain has a bad signature PKI Failure: The certificate or a certificate in the chain has a validity period in the future PKI Failure: The certificate or a certificate in the chain has expired VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple VPN PKI Maintenance Error Simple 40 SONICOS LOG EVENT REFERENCE GUIDE

42 PKI Failure: The certificate or a certificate in the chain is corrupt Please connect interface %s to another network to function properly Please manually check all system configurations for correctness of Upgrade VPN PKI Maintenance Error Simple Firewall Event Maintenance Information Standard Firewall Event Maintenance Information Simple Port configured to receive IPSEC ONLY. Drop packet received in the clear. TCP UDP ICMP Warning Standard Possible port scan Possible SYN flood attack detected Possible SYN flood detected on WAN IF %s - switching to connection-proxy mode Possible SYN Flood on IF %s Possible SYN Flood on IF %s continues Possible SYN Flood on IF %s has ceased Attack Alert Standard Note Attack Warning Standard --- Alert Standard --- Alert Standard --- Warning Standard --- Alert Standard PPP Dial-Up: Connect request canceled PPP Dial-Up: Connected at %s bps - starting PPP PPP Dial-up User Activity Information Simple PPP Dial-up User Activity Information Standard SONICOS LOG EVENT REFERENCE GUIDE 41