SonicOS 5.9 / / 6.2 Log Events Reference Guide with Enhanced Logging

Transcription

1 SonicOS 5.9 / / 6.2 Log Events Reference Guide with Enhanced Logging 1

2 Notes, Cautions, and Warnings NOTE: A NOTE indicates important information that helps you make better use of your system. CAUTION: A CAUTION indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING indicates a potential for property damage, personal injury, or death Dell Inc. Trademarks: Dell, the DELL logo, SonicWALL, SonicWALL GMS, SonicWALL Analyzer, Reassembly-Free Deep Packet Inspection, Dynamic Security for the Global Network, SonicWALL Clean VPN, SonicWALL Clean Wireless, SonicWALL Comprehensive Gateway Security Suite, SonicWALL Mobile Connect, and all other SonicWALL product and service names and slogans are trademarks of Dell Inc P/N Rev. A

3 Overview This reference guide lists and describes SonicOS log event messages for SonicOS 5.9, 6.0.5, and 6.2. Reference a log event message by using the alphabetical index from the Log Event Message Index table of this document. This document contains the following sections: Log > Monitor on page 1 Log > Settings on page 1 Index of Log Event Messages on page 2 Log > Syslog on page 169 Index of Syslog Tag Field Descriptions on page 170 Table of Values on page 178 Log > Monitor The Dell SonicWALL security appliance maintains an Event log for tracking potential security threats. This log can be viewed by navigating to the Dashboard > Log Monitor or Log > Log Monitor page, or it can be automatically sent to an address for convenience and archiving. The log is displayed in a table and can be sorted by column. For more information on configuring the Log Monitor page, refer to the SonicOS Administrator s Guide. Log > Settings The Log > Settings page allows you to categorize and customize the logging functions on your Dell SonicWALL security appliance for troubleshooting and diagnostics. For more information on configuring and managing the Log > Settings page, refer to the SonicOS Administrator s Guide. SonicOS 5.9 / / 6.2 Log Events Reference Guide 1

4 Index of Log Event Messages The following table is the Log Event Message Index, which is a list of log event messages for the SonicOS 5.9, 6.0.5, and 6.2 firmware. Each log event message described in the following table provides the following log event details: Log Event Message ID Number Displays the ID number of the log event message. Firmware Version Displays the SonicOS firmware version the log event message appears on. Legacy Category Displays the category event type. This is the same category as Table 1: Legacy Category on page 178. SonicOS Category Displays the SonicOS category type. This is the same category as Table 2: Expanded Categories on page 179. Priority Level Displays the level of urgency of the log event message. For additional information, you can also reference Table 3: Priority Level on page 182. SNMP Trap Type Displays the SNMP Trap ID number of the log event message. Log Event Messages Displays the name of the event message. ID Firmware Version Legacy Category Category Priority Level Maintenance Firewall Event ALERT Maintenance Firewall Event ALERT SNMP Trap Type Message Network Security Appliance activated Network Security Appliance activated Maintenance Firewall Event ALERT Network Security Appliance activated Maintenance Firewall Logging INFO Log Cleared Maintenance Firewall Logging INFO Log Cleared Maintenance Firewall Logging INFO Log Cleared Maintenance Firewall Logging INFO Log successfully sent via E mail Maintenance Firewall Logging INFO Log successfully sent via E mail Maintenance Firewall Logging INFO Log successfully sent via E mail System Error Security Services ERROR System Error Security Services ERROR System Error Security Services ERROR System Error Firewall Logging WARNING System Error Firewall Logging WARNING 604 Problem loading the URL List; check Filter settings Problem loading the URL List; check Filter settings Problem loading the URL List; check Filter settings Problem sending log E mail; check log settings Problem sending log E mail; check log settings 2

5 System Error Firewall Logging WARNING 604 Problem sending log E mail; check log settings Blocked Sites Network Access ERROR 701 Web site access denied Blocked Sites Network Access ERROR 701 Web site access denied Blocked Sites Network Access ERROR 701 Web site access denied Blocked Sites Network Access NOTICE 702 Newsgroup access denied Blocked Sites Network Access NOTICE 702 Newsgroup access denied Blocked Sites Network Access NOTICE 702 Newsgroup access denied Blocked Sites Network Access NOTICE 703 Web site access allowed Blocked Sites Network Access NOTICE 703 Web site access allowed Blocked Sites Network Access NOTICE 703 Web site access allowed Blocked Sites Network Access NOTICE 704 Newsgroup access allowed Blocked Sites Network Access NOTICE 704 Newsgroup access allowed Blocked Sites Network Access NOTICE 704 Newsgroup access allowed Blocked Code Network Access NOTICE ActiveX access denied Blocked Code Network Access NOTICE ActiveX access denied Blocked Code Network Access NOTICE ActiveX access denied Blocked Code Network Access NOTICE Java access denied Blocked Code Network Access NOTICE Java access denied Blocked Code Network Access NOTICE Java access denied Blocked Code Network Access NOTICE Blocked Code Network Access NOTICE ActiveX or Java archive access denied ActiveX or Java archive access denied Blocked Code Network Access NOTICE ActiveX or Java archive access denied Blocked Code Network Access NOTICE Cookie removed Blocked Code Network Access NOTICE Cookie removed Blocked Code Network Access NOTICE Cookie removed Attack Attack Attack Attack ALERT 501 Ping of death dropped ALERT 501 Ping of death dropped ALERT 501 Ping of death dropped ALERT 502 IP spoof dropped SonicOS 5.9 / / 6.2 Log Events Reference Guide 3

6 Attack Attack User Activity User Activity User Activity Attack Attack Attack Attack Attack Attack User Activity User Activity User Activity Attack Attack ALERT 502 IP spoof dropped ALERT 502 IP spoof dropped WARNING 503 WARNING 503 WARNING 503 User logged out user disconnect detected User logged out user disconnect detected User logged out user disconnect detected Possible SYN flood attack detected Possible SYN flood attack detected Possible SYN flood attack detected ALERT 505 Land attack dropped ALERT 505 Land attack dropped ALERT 505 Land attack dropped TCP UDP ICMP Network NOTICE Fragmented packet dropped TCP UDP ICMP Network NOTICE Fragmented packet dropped TCP UDP ICMP Network NOTICE Fragmented packet dropped Administrator login allowed Administrator login allowed Administrator login allowed Access ALERT 560 Access ALERT 560 Administrator login denied due to bad credentials Administrator login denied due to bad credentials 4

7 Attack User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity Attack Attack Access ALERT 560 Administrator login denied due to bad credentials User login from an internal zone allowed User login from an internal zone allowed User login from an internal zone allowed User login denied due to bad credentials User login denied due to bad credentials User login denied due to bad credentials User login denied due to bad credentials User login denied due to bad credentials User login denied due to bad credentials Pending login timed out Pending login timed out Pending login timed out Access ALERT Access ALERT 506 Administrator login denied from %s; logins disabled from this interface Administrator login denied from %s; logins disabled from this interface Administrator login denied Attack Access ALERT 506 from %s; logins disabled from this interface TCP Network Access NOTICE TCP connection dropped TCP Network Access NOTICE TCP connection dropped TCP Network Access NOTICE TCP connection dropped UDP Network Access NOTICE UDP packet dropped SonicOS 5.9 / / 6.2 Log Events Reference Guide 5

8 UDP Network Access NOTICE UDP packet dropped UDP Network Access NOTICE UDP packet dropped ICMP Network Access NOTICE ICMP Network Access NOTICE ICMP packet dropped due to Policy ICMP packet dropped due to Policy ICMP Network Access NOTICE ICMP packet dropped due to Policy Debug Network Access NOTICE Unknown protocol dropped Debug Network Access NOTICE Unknown protocol dropped Debug Network Access NOTICE Unknown protocol dropped Debug Network Access DEBUG IPsec connection interrupt Debug Network Access DEBUG IPsec connection interrupt Debug Network Access DEBUG IPsec connection interrupt Debug Network DEBUG ARP Timeout Debug Network DEBUG ARP Timeout Debug Network DEBUG ARP Timeout Debug Network Access DEBUG Broadcast packet dropped Debug Network Access DEBUG Broadcast packet dropped Debug Network Access DEBUG Broadcast packet dropped Debug Network Access DEBUG Debug Network Access DEBUG Out of order command packet dropped Out of order command packet dropped Debug Network Access DEBUG Out of order command packet dropped Debug Unused DEBUG Failure to add data channel Debug Unused DEBUG Failure to add data channel Debug Unused DEBUG Failure to add data channel System Error Firewall Event ERROR System Error Firewall Event ERROR System Error Firewall Event ERROR 607 The cache is full; %u open connections; some will be dropped The cache is full; %u open connections; some will be dropped The cache is full; %u open connections; some will be dropped 6

9 System Error Firewall Event ERROR System Error Firewall Event ERROR 608 License exceeded: Connection dropped because too many IP addresses are in use on your LAN License exceeded: Connection dropped because too many IP addresses are in use on your LAN System Error Firewall Event ERROR 608 License exceeded: Connection dropped because too many IP addresses are in use on your LAN Blocked Sites Network Access NOTICE 705 Access to proxy server denied Blocked Sites Network Access NOTICE 705 Access to proxy server denied Blocked Sites Network Access NOTICE 705 Access to proxy server denied System Error VPN IPsec ERROR 609 Diagnostic Code E System Error VPN IPsec ERROR 609 Diagnostic Code E System Error VPN IPsec ERROR 609 Diagnostic Code E Debug Network DEBUG Debug Network DEBUG Received fragmented packet or fragmentation needed Received fragmented packet or fragmentation needed Debug Network DEBUG Received fragmented packet or fragmentation needed User Activity VPN IPsec INFO Illegal IPsec SPI User Activity VPN IPsec INFO Illegal IPsec SPI User Activity VPN IPsec INFO Illegal IPsec SPI Attack VPN IPsec ERROR 508 IPsec Authentication Failed Attack VPN IPsec ERROR 508 IPsec Authentication Failed Attack VPN IPsec ERROR 508 IPsec Authentication Failed Attack VPN IPsec ERROR 509 IPsec Decryption Failed Attack VPN IPsec ERROR 509 IPsec Decryption Failed Attack VPN IPsec ERROR 509 IPsec Decryption Failed User Activity VPN IPsec INFO User Activity VPN IPsec INFO User Activity VPN IPsec INFO Incompatible IPsec Security Association Incompatible IPsec Security Association Incompatible IPsec Security Association SonicOS 5.9 / / 6.2 Log Events Reference Guide 7

10 Attack VPN IPsec ERROR Attack VPN IPsec ERROR Attack VPN IPsec ERROR Attack Attack Attack Attack Attack Attack Attack Attack ALERT 520 ALERT 520 ALERT 520 IPsec packet from or to an illegal host IPsec packet from or to an illegal host IPsec packet from or to an illegal host Smurf Amplification attack dropped Smurf Amplification attack dropped Smurf Amplification attack dropped ALERT 521 Possible port scan detected ALERT 521 Possible port scan detected ALERT 521 Possible port scan detected ALERT 522 Probable port scan detected ALERT 522 Probable port scan detected Attack ALERT 522 Probable port scan detected Maintenance Network INFO Failed to resolve name Maintenance Network INFO Failed to resolve name Maintenance Network INFO Failed to resolve name User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING 523 IKE Responder: Accepting IPsec proposal (Phase 2) IKE Responder: Accepting IPsec proposal (Phase 2) IKE Responder: Accepting IPsec proposal (Phase 2) IKE Responder: IPsec proposal does not match (Phase 2) IKE Responder: IPsec proposal does not match (Phase 2) IKE Responder: IPsec proposal does not match (Phase 2) 8

11 User Activity VPN IKE INFO User Activity VPN IKE INFO IKE negotiation complete. Adding IPsec SA. (Phase 2) IKE negotiation complete. Adding IPsec SA. (Phase 2) User Activity VPN IKE INFO IKE negotiation complete. Adding IPsec SA. (Phase 2) System Error Firewall Hardware ERROR 611 Diagnostic Code A System Error Firewall Hardware ERROR 611 Diagnostic Code A System Error Firewall Hardware ERROR 611 Diagnostic Code A System Error Firewall Hardware ERROR 612 Diagnostic Code B System Error Firewall Hardware ERROR 612 Diagnostic Code B System Error Firewall Hardware ERROR 612 Diagnostic Code B System Error Firewall Hardware ERROR 613 Diagnostic Code C System Error Firewall Hardware ERROR 613 Diagnostic Code C System Error Firewall Hardware ERROR 613 Diagnostic Code C Maintenance GMS INFO Status Maintenance GMS INFO Status Maintenance GMS INFO Status Connection Traffic Network Traffic INFO Web site hit Connection Traffic Network Traffic INFO Web site hit Connection Traffic Network Traffic INFO Web site hit Connection Network Traffic INFO Connection Opened Connection Network Traffic INFO Connection Opened Connection Network Traffic INFO Connection Opened Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Retransmitting DHCP DIS COVER. Retransmitting DHCP DIS COVER. Retransmitting DHCP DIS COVER. Retransmitting DHCP Request (Requesting). Retransmitting DHCP Request (Requesting). SonicOS 5.9 / / 6.2 Log Events Reference Guide 9

12 Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Retransmitting DHCP Request (Requesting). Retransmitting DHCP Request (Renewing). Retransmitting DHCP Request (Renewing). Retransmitting DHCP Request (Renewing). Retransmitting DHCP Request (Rebinding). Retransmitting DHCP Request (Rebinding). Retransmitting DHCP Request (Rebinding). Retransmitting DHCP Request (Rebooting). Retransmitting DHCP Request (Rebooting). Retransmitting DHCP Request (Rebooting). Retransmitting DHCP Request (Verifying). Retransmitting DHCP Request (Verifying) Maintenance DHCP Client INFO Retransmitting DHCP Request (Verifying) Maintenance DHCP Client INFO Sending DHCP DISCOVER Maintenance DHCP Client INFO Sending DHCP DISCOVER Maintenance DHCP Client INFO Sending DHCP DISCOVER Maintenance DHCP Client INFO Maintenance DHCP Client INFO DHCP Server not available. Did not get any DHCP OFFER. DHCP Server not available. Did not get any DHCP OFFER Maintenance DHCP Client INFO DHCP Server not available. Did not get any DHCP OFFER Maintenance DHCP Client INFO Got DHCP OFFER. Selecting Maintenance DHCP Client INFO Got DHCP OFFER. Selecting Maintenance DHCP Client INFO Got DHCP OFFER. Selecting Maintenance DHCP Client INFO Sending DHCP Request. 10

13 Maintenance DHCP Client INFO Sending DHCP Request Maintenance DHCP Client INFO Sending DHCP Request Maintenance DHCP Client INFO Maintenance DHCP Client INFO DHCP Client did not get DHCP ACK. DHCP Client did not get DHCP ACK Maintenance DHCP Client INFO DHCP Client did not get DHCP ACK Maintenance DHCP Client INFO DHCP Client got NACK Maintenance DHCP Client INFO DHCP Client got NACK Maintenance DHCP Client INFO DHCP Client got NACK Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO DHCP Client got ACK from server. DHCP Client got ACK from server. DHCP Client got ACK from server. DHCP Client is declining address offered by the server. DHCP Client is declining address offered by the server. DHCP Client is declining address offered by the server. DHCP Client sending Request and going to REBIND state. DHCP Client sending Request and going to REBIND state. DHCP Client sending Request and going to REBIND state. DHCP Client sending Request and going to RENEW state. DHCP Client sending Request and going to RENEW state. DHCP Client sending Request and going to RENEW state. Sending DHCP Request (Renewing). Sending DHCP Request (Renewing). SonicOS 5.9 / / 6.2 Log Events Reference Guide 11

14 Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Sending DHCP Request (Renewing). Sending DHCP Request (Rebinding). Sending DHCP Request (Rebinding). Sending DHCP Request (Rebinding). Sending DHCP Request (Rebooting). Sending DHCP Request (Rebooting). Sending DHCP Request (Rebooting). Sending DHCP Request (Verifying). Sending DHCP Request (Verifying). Sending DHCP Request (Verifying). DHCP Client failed to verify and lease has expired. Go to INIT state. DHCP Client failed to verify and lease has expired. Go to INIT state. DHCP Client failed to verify and lease has expired. Go to INIT state. DHCP Client got a new IP address lease. DHCP Client got a new IP address lease Maintenance DHCP Client INFO DHCP Client got a new IP address lease Maintenance DHCP Client INFO Sending DHCP RELEASE Maintenance DHCP Client INFO Sending DHCP RELEASE Maintenance DHCP Client INFO Sending DHCP RELEASE. 12

15 Maintenance Security Services INFO Maintenance Security Services INFO Maintenance Security Services INFO Maintenance Security Services INFO Maintenance Security Services INFO Access attempt from host without Anti Virus agent installed Access attempt from host without Anti Virus agent installed Access attempt from host without Anti Virus agent installed Anti Virus agent out of date on host Anti Virus agent out of date on host Maintenance Security Services INFO Anti Virus agent out of date on host Maintenance Security Services WARNING 524 Received AV Alert: %s Maintenance Security Services WARNING 524 Received AV Alert: %s Maintenance Security Services WARNING 524 Received AV Alert: %s Maintenance PPPoE INFO Starting PPPoE discovery Maintenance PPPoE INFO Starting PPPoE discovery Maintenance PPPoE INFO Starting PPPoE discovery Maintenance PPPoE INFO PPPoE LCP Link Up Maintenance PPPoE INFO PPPoE LCP Link Up Maintenance PPPoE INFO PPPoE LCP Link Up Maintenance PPPoE INFO PPPoE LCP Link Down Maintenance PPPoE INFO PPPoE LCP Link Down Maintenance PPPoE INFO PPPoE LCP Link Down Maintenance PPPoE INFO PPPoE terminated Maintenance PPPoE INFO PPPoE terminated Maintenance PPPoE INFO PPPoE terminated Maintenance PPPoE INFO PPPoE Network Connected Maintenance PPPoE INFO PPPoE Network Connected Maintenance PPPoE INFO PPPoE Network Connected Maintenance PPPoE INFO PPPoE Network Disconnected Maintenance PPPoE INFO PPPoE Network Disconnected Maintenance PPPoE INFO PPPoE Network Disconnected Maintenance PPPoE INFO Maintenance PPPoE INFO PPPoE discovery process complete PPPoE discovery process complete SonicOS 5.9 / / 6.2 Log Events Reference Guide 13

16 Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO PPPoE discovery process complete PPPoE starting CHAP Authentication PPPoE starting CHAP Authentication Maintenance PPPoE INFO PPPoE starting CHAP Authentication System Error Firewall Event WARNING 636 Wan IP Changed System Error Firewall Event WARNING 636 Wan IP Changed System Error Firewall Event WARNING 636 Wan IP Changed User Activity VPN Client INFO User Activity VPN Client INFO User Activity VPN Client INFO User Activity VPN Client ERROR User Activity VPN Client ERROR User Activity VPN Client ERROR User Activity VPN Client INFO User Activity VPN Client INFO XAUTH Succeeded with VPN client XAUTH Succeeded with VPN client XAUTH Succeeded with VPN client XAUTH Failed with VPN client, Authentication failure XAUTH Failed with VPN client, Authentication failure XAUTH Failed with VPN client, Authentication failure XAUTH Failed with VPN client, Cannot Contact RADIUS Server XAUTH Failed with VPN client, Cannot Contact RADIUS Server User Activity VPN Client INFO XAUTH Failed with VPN client, Cannot Contact RADIUS Server Debug Firewall Event ERROR Log Debug Debug Firewall Event ERROR Log Debug Debug Firewall Event ERROR Log Debug Attack Firewall Event ERROR 525 Add an attack message Attack Firewall Event ERROR 525 Add an attack message Attack Firewall Event ERROR 525 Add an attack message Maintenance High Availability ALERT Maintenance High Availability ALERT Primary firewall has transitioned to Active Primary firewall has transitioned to Active 14

17 Maintenance High Availability ALERT Maintenance High Availability ALERT Maintenance High Availability ALERT Maintenance High Availability ALERT System Error High Availability ALERT System Error High Availability ALERT System Error High Availability ALERT Maintenance High Availability ALERT Maintenance High Availability ALERT Maintenance High Availability ALERT System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR 617 Primary firewall has transitioned to Active Secondary firewall has transitioned to Active Secondary firewall has transitioned to Active Secondary firewall has transitioned to Active Primary firewall has transitioned to Standby Primary firewall has transitioned to Standby Primary firewall has transitioned to Standby Secondary firewall has transitioned to Standby Secondary firewall has transitioned to Standby Secondary firewall has transitioned to Standby Primary missed heartbeats from Secondary Primary missed heartbeats from Secondary Primary missed heartbeats from Secondary Secondary missed heartbeats from Primary Secondary missed heartbeats from Primary Secondary missed heartbeats from Primary Primary received error signal from Secondary Primary received error signal from Secondary Primary received error signal from Secondary SonicOS 5.9 / / 6.2 Log Events Reference Guide 15

18 System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR 620 Secondary received error signal from Primary Secondary received error signal from Primary Secondary received error signal from Primary Primary firewall preempting Secondary Primary firewall preempting Secondary System Error High Availability ERROR 620 Primary firewall preempting Secondary Maintenance High Availability INFO HA Peer Firewall Synchronized Maintenance High Availability INFO HA Peer Firewall Synchronized Maintenance High Availability INFO HA Peer Firewall Synchronized System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR Maintenance Security Services WARNING Maintenance Security Services WARNING 526 Error synchronizing HA peer firewall (%s) Error synchronizing HA peer firewall (%s) Error synchronizing HA peer firewall (%s) Received AV Alert: Your Network Anti Virus subscription has expired. %s Received AV Alert: Your Network Anti Virus subscription has expired. %s Maintenance Security Services WARNING 526 Received AV Alert: Your Network Anti Virus subscription has expired. %s Maintenance High Availability INFO HA packet processing error Maintenance High Availability INFO HA packet processing error Maintenance High Availability INFO HA packet processing error System Error Firewall Hardware ERROR 621 Diagnostic Code F System Error Firewall Hardware ERROR 621 Diagnostic Code F System Error Firewall Hardware ERROR 621 Diagnostic Code F Attack ALERT 527 Forbidden E Mail attachment disabled 16

19 Attack Attack ALERT 527 ALERT Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO System Error High Availability ERROR System Error High Availability ERROR 622 Forbidden E Mail attachment disabled Forbidden E Mail attachment disabled Disconnecting PPPoE due to traffic Timeout Disconnecting PPPoE due to traffic Timeout Disconnecting PPPoE due to traffic Timeout No response from ISP Disconnecting PPPoE. No response from ISP Disconnecting PPPoE. No response from ISP Disconnecting PPPoE. Secondary going Active in preempt mode after reboot Secondary going Active in preempt mode after reboot System Error High Availability ERROR 622 Secondary going Active in preempt mode after reboot User Activity VPN IKE DEBUG %s User Activity VPN IKE DEBUG %s User Activity VPN IKE DEBUG %s LAN TCP Network Access NOTICE LAN TCP Network Access NOTICE LAN TCP Network Access NOTICE TCP connection from LAN denied TCP connection from LAN denied TCP connection from LAN denied LAN UDP LAN TCP Network Access NOTICE UDP packet from LAN dropped LAN UDP LAN TCP Network Access NOTICE UDP packet from LAN dropped LAN UDP LAN TCP Network Access NOTICE UDP packet from LAN dropped LAN ICMP LAN TCP Network Access NOTICE ICMP packet from LAN dropped SonicOS 5.9 / / 6.2 Log Events Reference Guide 17

20 Attack Attack Attack Attack Attack Attack Attack Attack LAN ICMP LAN TCP Network Access NOTICE ICMP packet from LAN dropped LAN ICMP LAN TCP Network Access NOTICE ICMP packet from LAN dropped ALERT 528 Probable TCP FIN scan detected ALERT 528 Probable TCP FIN scan detected ALERT 528 Probable TCP FIN scan detected ALERT 529 ALERT 529 ALERT 529 ALERT 530 ALERT 530 Probable TCP XMAS scan detected Probable TCP XMAS scan detected Probable TCP XMAS scan detected Probable TCP NULL scan detected Probable TCP NULL scan detected Attack ALERT 530 Probable TCP NULL scan detected Attack VPN IPsec ALERT 531 IPsec Replay Detected Attack VPN IPsec ALERT 531 IPsec Replay Detected Attack VPN IPsec ALERT 531 IPsec Replay Detected Debug Network DEBUG TCP FIN packet dropped Debug Network DEBUG TCP FIN packet dropped Debug Network DEBUG TCP FIN packet dropped User Activity Network INFO User Activity Network INFO User Activity Network INFO System Error Security Services ERROR System Error Security Services ERROR 623 Received a path MTU ICMP message from router/gateway Received a path MTU ICMP message from router/gateway Received a path MTU ICMP message from router/gateway Problem loading the URL List; Appliance not registered. Problem loading the URL List; Appliance not registered. 18

21 System Error Security Services ERROR User Activity Network INFO User Activity Network INFO User Activity Network INFO System Error Security Services ERROR System Error Security Services ERROR System Error Security Services ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR User Activity User Activity User Activity User Activity User Activity User Activity Problem loading the URL List; Appliance not registered. Received a path MTU ICMP message from router/gateway Received a path MTU ICMP message from router/gateway Received a path MTU ICMP message from router/gateway The loaded content URL List has expired. The loaded content URL List has expired. The loaded content URL List has expired. Error setting the IP address of the Secondary, please manually set to Secondary LAN IP Error setting the IP address of the Secondary, please manually set to Secondary LAN IP Error setting the IP address of the Secondary, please manually set to Secondary LAN IP CLI administrator login allowed CLI administrator login allowed CLI administrator login allowed Access WARNING Access WARNING Access WARNING Maintenance L2TP Client INFO Maintenance L2TP Client INFO CLI administrator login denied due to bad credentials CLI administrator login denied due to bad credentials CLI administrator login denied due to bad credentials L2TP Tunnel Negotiation Started L2TP Tunnel Negotiation Started SonicOS 5.9 / / 6.2 Log Events Reference Guide 19

22 Maintenance L2TP Client INFO Maintenance L2TP Client INFO Maintenance L2TP Client INFO L2TP Tunnel Negotiation Started L2TP Session Negotiation Started L2TP Session Negotiation Started Maintenance L2TP Client INFO L2TP Session Negotiation Started Maintenance L2TP Client INFO L2TP Tunnel Established Maintenance L2TP Client INFO L2TP Tunnel Established Maintenance L2TP Client INFO L2TP Tunnel Established Maintenance L2TP Client INFO Maintenance L2TP Client INFO L2TP Tunnel Disconnect from Remote L2TP Tunnel Disconnect from Remote Maintenance L2TP Client INFO L2TP Tunnel Disconnect from Remote Maintenance L2TP Client INFO L2TP Session Established Maintenance L2TP Client INFO L2TP Session Established Maintenance L2TP Client INFO L2TP Session Established Maintenance L2TP Client INFO Maintenance L2TP Client INFO L2TP Session Disconnect from Remote L2TP Session Disconnect from Remote Maintenance L2TP Client INFO L2TP Session Disconnect from Remote Maintenance L2TP Client INFO L2TP PPP Negotiation Started Maintenance L2TP Client INFO L2TP PPP Negotiation Started Maintenance L2TP Client INFO L2TP PPP Negotiation Started Maintenance L2TP Client INFO L2TP PPP Session Up Maintenance L2TP Client INFO L2TP PPP Session Up Maintenance L2TP Client INFO L2TP PPP Session Up Maintenance L2TP Client INFO L2TP PPP Down Maintenance L2TP Client INFO L2TP PPP Down Maintenance L2TP Client INFO L2TP PPP Down Maintenance L2TP Client INFO L2TP PPP Authentication Failed Maintenance L2TP Client INFO L2TP PPP Authentication Failed Maintenance L2TP Client INFO L2TP PPP Authentication Failed 20

23 Maintenance L2TP Client INFO Maintenance L2TP Client INFO Disconnecting L2TP Tunnel due to traffic Timeout Disconnecting L2TP Tunnel due to traffic Timeout Maintenance L2TP Client INFO Disconnecting L2TP Tunnel due to traffic Timeout Maintenance L2TP Client INFO L2TP PPP link down Maintenance L2TP Client INFO L2TP PPP link down Maintenance L2TP Client INFO L2TP PPP link down Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO DHCP RELEASE relayed to Central Gateway DHCP RELEASE relayed to Central Gateway DHCP RELEASE relayed to Central Gateway DHCP lease relayed to local device DHCP lease relayed to local device DHCP lease relayed to local device DHCP RELEASE received from remote device DHCP RELEASE received from remote device DHCP RELEASE received from remote device DHCP lease relayed to remote device DHCP lease relayed to remote device DHCP lease relayed to remote device DHCP lease to LAN device conflicts with remote device, deleting remote IP entry DHCP lease to LAN device conflicts with remote device, deleting remote IP entry SonicOS 5.9 / / 6.2 Log Events Reference Guide 21

24 Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay WARNING Maintenance DHCP Relay WARNING Maintenance DHCP Relay WARNING Attack DHCP Relay ERROR Attack DHCP Relay ERROR Attack DHCP Relay ERROR Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO DHCP lease to LAN device conflicts with remote device, deleting remote IP entry WARNING: DHCP lease relayed from Central Gateway conflicts with IP in Static Devices list WARNING: DHCP lease relayed from Central Gateway conflicts with IP in Static Devices list WARNING: DHCP lease relayed from Central Gateway conflicts with IP in Static Devices list DHCP lease dropped. Lease from Central Gateway conflicts with Relay IP DHCP lease dropped. Lease from Central Gateway conflicts with Relay IP DHCP lease dropped. Lease from Central Gateway conflicts with Relay IP IP spoof detected on packet to Central Gateway, packet dropped IP spoof detected on packet to Central Gateway, packet dropped IP spoof detected on packet to Central Gateway, packet dropped Request for Relay IP Table from Central Gateway Request for Relay IP Table from Central Gateway Request for Relay IP Table from Central Gateway Requesting Relay IP Table from Remote Gateway Requesting Relay IP Table from Remote Gateway 22

25 Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO Maintenance DHCP Relay INFO System Error DHCP Relay WARNING System Error DHCP Relay WARNING System Error DHCP Relay WARNING User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity Requesting Relay IP Table from Remote Gateway Sent Relay IP Table to Central Gateway Sent Relay IP Table to Central Gateway Sent Relay IP Table to Central Gateway Obtained Relay IP Table from Remote Gateway Obtained Relay IP Table from Remote Gateway Obtained Relay IP Table from Remote Gateway Failed to synchronize Relay IP Table Failed to synchronize Relay IP Table Failed to synchronize Relay IP Table VPN zone administrator login allowed VPN zone administrator login allowed VPN zone administrator login allowed WAN zone administrator login allowed WAN zone administrator login allowed WAN zone administrator login allowed VPN zone remote user login allowed VPN zone remote user login allowed VPN zone remote user login allowed SonicOS 5.9 / / 6.2 Log Events Reference Guide 23

26 User Activity User Activity User Activity User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO WAN zone remote user login allowed WAN zone remote user login allowed WAN zone remote user login allowed NAT Discovery : Peer IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Peer IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Peer IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Local IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Local IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Local IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : No NAT/NAPT device detected between IPsec Security gateways NAT Discovery : No NAT/NAPT device detected between IPsec Security gateways NAT Discovery : No NAT/NAPT device detected between IPsec Security gateways NAT Discovery : Peer IPsec Security Gateway doesn't support VPN NAT Traversal NAT Discovery : Peer IPsec Security Gateway doesn't support VPN NAT Traversal 24

27 User Activity VPN IKE INFO User Activity RADIUS INFO User Activity RADIUS INFO User Activity RADIUS INFO User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity User Activity NAT Discovery : Peer IPsec Security Gateway doesn't support VPN NAT Traversal User login denied RADIUS authentication failure User login denied RADIUS authentication failure User login denied RADIUS authentication failure User login denied RADIUS server Timeout User login denied RADIUS server Timeout User login denied RADIUS server Timeout User login denied RADIUS configuration error User login denied RADIUS configuration error User login denied RADIUS configuration error User login denied User has no privileges for login from that location User login denied User has no privileges for login from that location User login denied User has no User Activity privileges for login from that location Maintenance VPN IPsec INFO IPsec packet from an illegal host Maintenance VPN IPsec INFO IPsec packet from an illegal host Maintenance VPN IPsec INFO IPsec packet from an illegal host Attack Attack Attack ERROR 534 ERROR 534 ERROR 534 Forbidden E Mail attachment deleted Forbidden E Mail attachment deleted Forbidden E Mail attachment deleted SonicOS 5.9 / / 6.2 Log Events Reference Guide 25

28 User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING 539 IKE Responder: Mode %s not tunnel mode IKE Responder: Mode %d not tunnel mode IKE Responder: Mode %s not tunnel mode IKE Responder: No matching Phase 1 ID found for proposed remote network IKE Responder: No matching Phase 1 ID found for proposed remote network IKE Responder: No matching Phase 1 ID found for proposed remote network IKE Responder: Proposed remote network is but not DHCP relay nor default route IKE Responder: Proposed remote network is but not DHCP relay nor default route IKE Responder: Proposed remote network is but not DHCP relay nor default route IKE Responder: No match for proposed remote network address IKE Responder: No match for proposed remote network address IKE Responder: No match for proposed remote network address IKE Responder: Default LAN gateway is set but peer is not proposing to use this SA as a default route 26

29 User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING 542 IKE Responder: Default LAN gateway is set but peer is not proposing to use this SA as a default route IKE Responder: Default LAN gateway is set but peer is not proposing to use this SA as a default route IKE Responder: Tunnel terminates outside firewall but proposed local network is not NAT public address IKE Responder: Tunnel terminates outside firewall but proposed local network is not NAT public address IKE Responder: Tunnel terminates outside firewall but proposed local network is not NAT public address IKE Responder: Tunnel terminates inside firewall but proposed local network is not inside firewall IKE Responder: Tunnel terminates inside firewall but proposed local network is not inside firewall IKE Responder: Tunnel terminates inside firewall but proposed local network is not inside firewall IKE Responder: Tunnel terminates on DMZ but proposed local network is on LAN IKE Responder: Tunnel terminates on DMZ but proposed local network is on LAN IKE Responder: Tunnel terminates on DMZ but proposed local network is on LAN SonicOS 5.9 / / 6.2 Log Events Reference Guide 27

30 User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity User Activity User Activity User Activity User Activity User Activity IKE Responder: Tunnel terminates on LAN but proposed local network is on DMZ IKE Responder: Tunnel terminates on LAN but proposed local network is on DMZ IKE Responder: Tunnel terminates on LAN but proposed local network is on DMZ IKE Responder: AH Perfect Forward Secrecy mismatch IKE Responder: AH Perfect Forward Secrecy mismatch IKE Responder: AH Perfect Forward Secrecy mismatch IKE Responder: ESP Perfect Forward Secrecy mismatch IKE Responder: ESP Perfect Forward Secrecy mismatch IKE Responder: ESP Perfect Forward Secrecy mismatch IKE Responder: Algorithms and/ or keys do not match IKE Responder: Algorithms and/ or keys do not match IKE Responder: Algorithms and/ or keys do not match Administrator logged out Administrator logged out Administrator logged out Administrator logged out inactivity timer expired Administrator logged out inactivity timer expired Administrator logged out inactivity timer expired 28

31 User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User logged out %s User logged out User logged out %s Maintenance VPN IPsec INFO Maintenance VPN IPsec INFO Maintenance VPN IPsec INFO Attack Attack User logged out max session time exceeded User logged out max session time exceeded User logged out max session time exceeded User logged out inactivity timer expired User logged out inactivity timer expired User logged out inactivity timer expired NAT device may not support IPsec AH pass through NAT device may not support IPsec AH pass through NAT device may not support IPsec AH pass through ALERT 547 TCP Xmas Tree dropped ALERT 547 TCP Xmas Tree dropped Attack ALERT 547 TCP Xmas Tree dropped User Activity VPN PKI INFO Requesting CRL from User Activity VPN PKI INFO Requesting CRL from User Activity VPN PKI INFO Requesting CRL from User Activity VPN PKI INFO CRL loaded from User Activity VPN PKI INFO CRL loaded from User Activity VPN PKI INFO CRL loaded from User Activity VPN PKI ALERT Failed to get CRL from User Activity VPN PKI ALERT Failed to get CRL from User Activity VPN PKI ALERT Failed to get CRL from SonicOS 5.9 / / 6.2 Log Events Reference Guide 29

32 User Activity VPN PKI WARNING User Activity VPN PKI WARNING Not enough memory to hold the CRL Not enough memory to hold the CRL User Activity VPN PKI WARNING Not enough memory to hold the CRL User Activity VPN PKI ALERT Connection timed out User Activity VPN PKI ALERT Connection timed out User Activity VPN PKI ALERT Connection timed out User Activity VPN PKI ALERT User Activity VPN PKI ALERT Cannot connect to the CRL server Cannot connect to the CRL server User Activity VPN PKI ALERT Cannot connect to the CRL server User Activity VPN PKI ERROR Unknown reason User Activity VPN PKI ERROR Unknown reason User Activity VPN PKI ERROR Unknown reason User Activity VPN PKI ALERT Failed to Process CRL from User Activity VPN PKI ALERT Failed to Process CRL from User Activity VPN PKI ALERT Failed to Process CRL from User Activity VPN PKI ALERT Bad CRL format User Activity VPN PKI ALERT Bad CRL format User Activity VPN PKI ALERT Bad CRL format User Activity VPN PKI ALERT Issuer match failed User Activity VPN PKI ALERT Issuer match failed User Activity VPN PKI ALERT Issuer match failed User Activity VPN PKI ALERT Certificate on Revoked list(crl) User Activity VPN PKI ALERT Certificate on Revoked list(crl) User Activity VPN PKI ALERT Certificate on Revoked list(crl) User Activity VPN PKI ALERT No Certificate for User Activity VPN PKI ALERT No Certificate for User Activity VPN PKI ALERT No Certificate for User Activity PPP Dial Up INFO PPP Dial Up: Dialing: %s User Activity PPP Dial Up INFO PPP Dial Up: Dialing: %s User Activity PPP Dial Up INFO PPP Dial Up: Dialing: %s 30

33 User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO PPP Dial Up: No dial tone detected check phone line connection PPP Dial Up: No dial tone detected check phone line connection PPP Dial Up: No dial tone detected check phone line connection PPP Dial Up: No link carrier detected check phone number PPP Dial Up: No link carrier detected check phone number PPP Dial Up: No link carrier detected check phone number PPP Dial Up: Dialed number is busy PPP Dial Up: Dialed number is busy PPP Dial Up: Dialed number is busy PPP Dial Up: Dialed number did not answer PPP Dial Up: Dialed number did not answer PPP Dial Up: Dialed number did not answer PPP Dial Up: Connected at %s bps starting PPP PPP Dial Up: Connected at %s bps starting PPP PPP Dial Up: Connected at %s bps starting PPP PPP Dial Up: Unknown dialing failure PPP Dial Up: Unknown dialing failure PPP Dial Up: Unknown dialing User Activity PPP Dial Up INFO failure User Activity PPP Dial Up INFO PPP Dial Up: Link carrier lost SonicOS 5.9 / / 6.2 Log Events Reference Guide 31

34 User Activity PPP Dial Up INFO PPP Dial Up: Link carrier lost User Activity PPP Dial Up INFO PPP Dial Up: Link carrier lost PPP INFO PPP: Authentication successful PPP INFO PPP: Authentication successful PPP INFO PPP: Authentication successful PPP INFO PPP INFO PPP INFO PPP INFO PPP INFO PPP INFO PPP INFO PPP INFO PPP INFO PPP INFO PPP INFO PPP INFO PPP INFO PPP INFO PPP INFO PPP: PAP Authentication failed check username / password PPP: PAP Authentication failed check username / password PPP: PAP Authentication failed check username / password PPP: CHAP authentication failed check username / password PPP: CHAP authentication failed check username / password PPP: CHAP authentication failed check username / password PPP: MS CHAP authentication failed check username / password PPP: MS CHAP authentication failed check username / password PPP: MS CHAP authentication failed check username / password PPP: Starting MS CHAP authentication PPP: Starting MS CHAP authentication PPP: Starting MS CHAP authentication PPP: Starting CHAP authentication PPP: Starting CHAP authentication PPP: Starting CHAP authentication 32

35 PPP INFO PPP INFO PPP INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO PPP: Starting PAP authentication PPP: Starting PAP authentication PPP: Starting PAP authentication PPP Dial Up: Idle time limit exceeded disconnecting PPP Dial Up: Idle time limit exceeded disconnecting PPP Dial Up: Idle time limit exceeded disconnecting PPP Dial Up: Received new IP address PPP Dial Up: Received new IP address PPP Dial Up: Received new IP address PPP Dial Up: PPP link established PPP Dial Up: PPP link established User Activity PPP Dial Up INFO PPP Dial Up: PPP link established User Activity PPP Dial Up INFO PPP Dial Up: PPP link down User Activity PPP Dial Up INFO PPP Dial Up: PPP link down User Activity PPP Dial Up INFO PPP Dial Up: PPP link down User Activity PPP Dial Up INFO PPP Dial Up: Shutting down link User Activity PPP Dial Up INFO PPP Dial Up: Shutting down link User Activity PPP Dial Up INFO PPP Dial Up: Shutting down link User Activity PPP Dial Up INFO PPP Dial Up: Initialization : %s User Activity PPP Dial Up INFO PPP Dial Up: Initialization : %s User Activity PPP Dial Up INFO PPP Dial Up: Initialization : %s User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO PPP Dial Up: Connect request canceled PPP Dial Up: Connect request canceled PPP Dial Up: Connect request canceled SonicOS 5.9 / / 6.2 Log Events Reference Guide 33

36 System Error WAN Failover WARNING System Error WAN Failover WARNING System Error WAN Failover WARNING Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO The network connection in use is %s The network connection in use is %s The network connection in use is %s L2TP Server : L2TP Tunnel Established. L2TP Server : L2TP Tunnel Established. L2TP Server : L2TP Tunnel Established. L2TP Server : L2TP Session Established. L2TP Server : L2TP Session Established. L2TP Server : L2TP Session Established. L2TP Server: RADIUS/LDAP reports Authentication Failure L2TP Server: RADIUS/LDAP reports Authentication Failure L2TP Server: RADIUS/LDAP reports Authentication Failure L2TP Server: Local Authentication Failure L2TP Server: Local Authentication Failure L2TP Server: Local Authentication Failure L2TP Server: Local Authentication Success. L2TP Server: Local Authentication Success. L2TP Server: Local Authentication Success. L2TP Server: RADIUS/LDAP Authentication Success 34

37 Maintenance L2TP Server INFO Maintenance L2TP Server INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO L2TP Server: RADIUS/LDAP Authentication Success L2TP Server: RADIUS/LDAP Authentication Success PPP Dial Up: Manual intervention needed. Check Primary Profile or Profile details PPP Dial Up: Manual intervention needed. Check Primary Profile or Profile details PPP Dial Up: Manual intervention needed. Check Primary Profile or Profile details PPP Dial Up: Trying to failover but Primary Profile is manual PPP Dial Up: Trying to failover but Primary Profile is manual User Activity PPP Dial Up INFO PPP Dial Up: Trying to failover but Primary Profile is manual System Error WAN Failover ALERT 637 Probing failure on %s System Error WAN Failover ALERT 637 Probing failure on %s System Error WAN Failover ALERT 637 Probing failure on %s User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO Maintenance Maintenance Maintenance Attack PPP Dial Up: Maximum connection time exceeded disconnecting PPP Dial Up: Maximum connection time exceeded disconnecting PPP Dial Up: Maximum connection time exceeded disconnecting Administrator name changed Administrator name changed Administrator name changed Access ERROR 561 User login failure rate exceeded logins from user IP address denied SonicOS 5.9 / / 6.2 Log Events Reference Guide 35

38 Attack Attack Access ERROR 561 Access ERROR Maintenance PPP Dial Up INFO Maintenance PPP Dial Up INFO Maintenance PPP Dial Up INFO Maintenance PPP Dial Up INFO Maintenance PPP Dial Up INFO Maintenance PPP Dial Up INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO User login failure rate exceeded logins from user IP address denied User login failure rate exceeded logins from user IP address denied PPP Dial Up: The profile in use disabled VPN networking. PPP Dial Up: The profile in use disabled VPN networking. PPP Dial Up: The profile in use disabled VPN networking. PPP Dial Up: VPN networking restored. PPP Dial Up: VPN networking restored. PPP Dial Up: VPN networking restored. L2TP Server: Tunnel Disconnect from Remote. L2TP Server: Tunnel Disconnect from Remote. L2TP Server: Tunnel Disconnect from Remote. L2TP Server : Deleting the Tunnel L2TP Server : Deleting the Tunnel L2TP Server : Deleting the Tunnel L2TP Server : Deleting the L2TP active Session L2TP Server : Deleting the L2TP active Session L2TP Server : Deleting the L2TP active Session L2TP Server : Retransmission Timeout, Deleting the Tunnel L2TP Server : Retransmission Timeout, Deleting the Tunnel 36

39 Maintenance L2TP Server INFO Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO Maintenance L2TP Server INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO TCP UDP ICMP Network Access WARNING TCP UDP ICMP Network Access WARNING L2TP Server : Retransmission Timeout, Deleting the Tunnel NAT translated packet exceeds size limit, packet dropped NAT translated packet exceeds size limit, packet dropped NAT translated packet exceeds size limit, packet dropped HTTP management port has changed HTTP management port has changed HTTP management port has changed HTTPS management port has changed HTTPS management port has changed HTTPS management port has changed L2TP Server : User Name authentication Failure locally. L2TP Server : User Name authentication Failure locally. L2TP Server : User Name authentication Failure locally. IKE Initiator: Start Quick Mode (Phase 2). IKE Initiator: Start Quick Mode (Phase 2). IKE Initiator: Start Quick Mode (Phase 2). Port configured to receive IPsec protocol ONLY; drop packet received in the clear Port configured to receive IPsec protocol ONLY; drop packet received in the clear SonicOS 5.9 / / 6.2 Log Events Reference Guide 37

40 TCP UDP ICMP Network Access WARNING Maintenance Firewall Event WARNING Maintenance Firewall Event WARNING Port configured to receive IPsec protocol ONLY; drop packet received in the clear Imported VPN SA is invalid disabled Imported VPN SA is invalid disabled Maintenance Firewall Event WARNING Imported VPN SA is invalid disabled User Activity VPN IKE INFO IKE SA lifetime expired User Activity VPN IKE INFO IKE SA lifetime expired User Activity VPN IKE INFO IKE SA lifetime expired User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO IKE Initiator: Start Main Mode negotiation (Phase 1) IKE Initiator: Start Main Mode negotiation (Phase 1) IKE Initiator: Start Main Mode negotiation (Phase 1) IKE Responder: Received Quick Mode Request (Phase 2) IKE Responder: Received Quick Mode Request (Phase 2) IKE Responder: Received Quick Mode Request (Phase 2) IKE Initiator: Main Mode complete (Phase 1) IKE Initiator: Main Mode complete (Phase 1) IKE Initiator: Main Mode complete (Phase 1) IKE Initiator: Aggressive Mode complete (Phase 1). IKE Initiator: Aggressive Mode complete (Phase 1). IKE Initiator: Aggressive Mode complete (Phase 1). IKE Responder: Received Main Mode Request (Phase 1) 38

41 User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO IKE Responder: Received Main Mode Request (Phase 1) IKE Responder: Received Main Mode Request (Phase 1) IKE Responder: Received Aggressive Mode Request (Phase 1) IKE Responder: Received Aggressive Mode Request (Phase 1) IKE Responder: Received Aggressive Mode Request (Phase 1) IKE Responder: Main Mode complete (Phase 1) IKE Responder: Main Mode complete (Phase 1) IKE Responder: Main Mode complete (Phase 1) IKE Initiator: Start Aggressive Mode negotiation (Phase 1) IKE Initiator: Start Aggressive Mode negotiation (Phase 1) User Activity VPN IKE INFO IKE Initiator: Start Aggressive Mode negotiation (Phase 1) Maintenance Crypto Test ERROR Crypto DES test failed Maintenance Crypto Test ERROR Crypto DES test failed Maintenance Crypto Test ERROR Crypto DES test failed Maintenance Crypto Test ERROR Crypto DH test failed Maintenance Crypto Test ERROR Crypto DH test failed Maintenance Crypto Test ERROR Crypto DH test failed Maintenance Crypto Test ERROR Crypto Hmac MD5 test failed Maintenance Crypto Test ERROR Crypto Hmac MD5 test failed Maintenance Crypto Test ERROR Crypto Hmac MD5 test failed Maintenance Crypto Test ERROR Crypto Hmac Sha1 test failed Maintenance Crypto Test ERROR Crypto Hmac Sha1 test failed Maintenance Crypto Test ERROR Crypto Hmac Sha1 test failed Maintenance Crypto Test ERROR Crypto RSA test failed Maintenance Crypto Test ERROR Crypto RSA test failed SonicOS 5.9 / / 6.2 Log Events Reference Guide 39

42 Maintenance Crypto Test ERROR Crypto RSA test failed Maintenance Crypto Test ERROR Crypto Sha1 test failed Maintenance Crypto Test ERROR Crypto Sha1 test failed Maintenance Crypto Test ERROR Crypto Sha1 test failed Maintenance Crypto Test ERROR Crypto hardware DES test failed Maintenance Crypto Test ERROR Crypto hardware DES test failed Maintenance Crypto Test ERROR Crypto hardware DES test failed Maintenance Crypto Test ERROR Maintenance Crypto Test ERROR Maintenance Crypto Test ERROR Maintenance Crypto Test ERROR Maintenance Crypto Test ERROR Maintenance Crypto Test ERROR Maintenance Crypto Test ERROR Maintenance Crypto Test ERROR Crypto hardware 3DES test failed Crypto hardware 3DES test failed Crypto hardware 3DES test failed Crypto hardware DES with SHA test failed Crypto hardware DES with SHA test failed Crypto hardware DES with SHA test failed Crypto Hardware 3DES with SHA test failed Crypto Hardware 3DES with SHA test failed Maintenance Crypto Test ERROR Crypto Hardware 3DES with SHA test failed User Activity VPN Client INFO VPN Client Policy Provisioning User Activity VPN Client INFO VPN Client Policy Provisioning User Activity VPN Client INFO VPN Client Policy Provisioning User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO IKE Initiator: Accepting IPsec proposal (Phase 2) IKE Initiator: Accepting IPsec proposal (Phase 2) IKE Initiator: Accepting IPsec proposal (Phase 2) IKE Responder: Aggressive Mode complete (Phase 1) IKE Responder: Aggressive Mode complete (Phase 1) 40

43 User Activity VPN IKE INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO IKE Responder: Aggressive Mode complete (Phase 1) PPTP Control Connection Negotiation Started PPTP Control Connection Negotiation Started PPTP Control Connection Negotiation Started PPTP Session Negotiation Started PPTP Session Negotiation Started PPTP Session Negotiation Started PPTP Control Connection Established PPTP Control Connection Established PPTP Control Connection Established PPTP Tunnel Disconnect from Remote PPTP Tunnel Disconnect from Remote Maintenance PPTP INFO PPTP Tunnel Disconnect from Remote Maintenance PPTP INFO PPTP Session Established Maintenance PPTP INFO PPTP Session Established Maintenance PPTP INFO PPTP Session Established Maintenance PPTP INFO Maintenance PPTP INFO PPTP Session Disconnect from Remote PPTP Session Disconnect from Remote Maintenance PPTP INFO PPTP Session Disconnect from Remote Maintenance PPTP INFO PPTP PPP Negotiation Started Maintenance PPTP INFO PPTP PPP Negotiation Started Maintenance PPTP INFO PPTP PPP Negotiation Started Maintenance PPTP INFO PPTP PPP Session Up SonicOS 5.9 / / 6.2 Log Events Reference Guide 41

44 Maintenance PPTP INFO PPTP PPP Session Up Maintenance PPTP INFO PPTP PPP Session Up Maintenance PPTP INFO PPTP PPP Down Maintenance PPTP INFO PPTP PPP Down Maintenance PPTP INFO PPTP PPP Down Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO PPTP Disconnect Initiated by the User PPTP Disconnect Initiated by the User PPTP Disconnect Initiated by the User Disconnecting PPTP Tunnel due to traffic Timeout Disconnecting PPTP Tunnel due to traffic Timeout Disconnecting PPTP Tunnel due to traffic Timeout PPTP Connect Initiated by the User PPTP Connect Initiated by the User PPTP Connect Initiated by the User PPTP starting CHAP Authentication PPTP starting CHAP Authentication PPTP starting CHAP Authentication PPTP starting PAP Authentication PPTP starting PAP Authentication PPTP starting PAP Authentication PPTP PAP Authentication success. PPTP PAP Authentication success. 42

45 Maintenance PPTP INFO PPTP PAP Authentication success Maintenance PPTP INFO PPTP PPP Link Up Maintenance PPTP INFO PPTP PPP Link Up Maintenance PPTP INFO PPTP PPP Link Up Maintenance PPTP INFO PPTP PPP Link down Maintenance PPTP INFO PPTP PPP Link down Maintenance PPTP INFO PPTP PPP Link down Maintenance PPTP INFO PPTP PPP Link Finished Maintenance PPTP INFO PPTP PPP Link Finished Maintenance PPTP INFO PPTP PPP Link Finished User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE WARNING User Activity VPN IKE WARNING Received notify. NO_PROPOSAL_CHOSEN Received notify. NO_PROPOSAL_CHOSEN Received notify. NO_PROPOSAL_CHOSEN IKE Responder: IKE proposal does not match (Phase 1) IKE Responder: IKE proposal does not match (Phase 1) IKE Responder: IKE proposal does not match (Phase 1) IKE negotiation aborted due to Timeout IKE negotiation aborted due to Timeout IKE negotiation aborted due to Timeout Failed payload verification after decryption; possible preshared key mismatch Failed payload verification after decryption; possible preshared key mismatch User Activity VPN IKE WARNING Failed payload verification after decryption; possible preshared key mismatch User Activity VPN IKE WARNING Failed payload validation SonicOS 5.9 / / 6.2 Log Events Reference Guide 43

46 User Activity VPN IKE WARNING Failed payload validation User Activity VPN IKE WARNING Failed payload validation User Activity VPN IKE WARNING User Activity VPN IKE WARNING Received packet retransmission. Drop duplicate packet Received packet retransmission. Drop duplicate packet User Activity VPN IKE WARNING Received packet retransmission. Drop duplicate packet Maintenance Security Services INFO Anti Virus Licenses Exceeded Maintenance Security Services INFO Anti Virus Licenses Exceeded Maintenance Security Services INFO Anti Virus Licenses Exceeded User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE INFO User Activity VPN IKE INFO Received notify: ISAKMP_AUTH_FAILED Received notify: ISAKMP_AUTH_FAILED Received notify: ISAKMP_AUTH_FAILED Computed hash does not match hash received from peer; preshared key mismatch Computed hash does not match hash received from peer; preshared key mismatch Computed hash does not match hash received from peer; preshared key mismatch Received notify: PAYLOAD_MALFORMED Received notify: PAYLOAD_MALFORMED Received notify: PAYLOAD_MALFORMED Received IPsec SA delete request Received IPsec SA delete request Received IPsec SA delete User Activity VPN IKE INFO request User Activity VPN IKE INFO Received IKE SA delete request 44

47 User Activity VPN IKE INFO Received IKE SA delete request User Activity VPN IKE INFO Received IKE SA delete request User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO Received notify: INVALID_COOKIES Received notify: INVALID_COOKIES Received notify: INVALID_COOKIES Received notify: RESPONDER_LIFETIME Received notify: RESPONDER_LIFETIME User Activity VPN IKE INFO Received notify: RESPONDER_LIFETIME User Activity VPN IKE INFO Received notify: INVALID_SPI User Activity VPN IKE INFO Received notify: INVALID_SPI User Activity VPN IKE INFO Received notify: INVALID_SPI Maintenance RIP INFO 8401 RIP disabled on interface %s Maintenance RIP INFO 8401 RIP disabled on interface %s Maintenance RIP INFO 8401 RIP disabled on interface %s Maintenance RIP INFO 8402 RIPv1 enabled on interface %s Maintenance RIP INFO 8402 RIPv1 enabled on interface %s Maintenance RIP INFO 8402 RIPv1 enabled on interface %s Maintenance RIP INFO 8403 RIPv2 enabled on interface %s Maintenance RIP INFO 8403 RIPv2 enabled on interface %s Maintenance RIP INFO 8403 RIPv2 enabled on interface %s Maintenance RIP INFO Maintenance RIP INFO 8404 RIPv2 compatibility (broadcast) mode enabled on interface %s RIPv2 compatibility (broadcast) mode enabled on interface %s Maintenance RIP INFO 8404 RIPv2 compatibility (broadcast) mode enabled on interface %s Maintenance RIP INFO 8405 RIP disabled on DMZ interface Maintenance RIP INFO 8405 RIP disabled on DMZ interface Maintenance RIP INFO 8405 RIP disabled on DMZ interface Maintenance RIP INFO 8406 RIPv1 enabled on DMZ interface Maintenance RIP INFO 8406 RIPv1 enabled on DMZ interface Maintenance RIP INFO 8406 RIPv1 enabled on DMZ interface SonicOS 5.9 / / 6.2 Log Events Reference Guide 45

48 Maintenance RIP INFO 8407 RIPv2 enabled on DMZ interface Maintenance RIP INFO 8407 RIPv2 enabled on DMZ interface Maintenance RIP INFO 8407 RIPv2 enabled on DMZ interface Maintenance RIP INFO Maintenance RIP INFO Maintenance RIP INFO Debug Debug Debug RIPv2 compatibility (broadcast) mode enabled on DMZ interface RIPv2 compatibility (broadcast) mode enabled on DMZ interface RIPv2 compatibility (broadcast) mode enabled on DMZ interface VPN Tunnel Status VPN INFO 801 IPsec Tunnel status changed VPN Tunnel Status VPN INFO 801 IPsec Tunnel status changed VPN Tunnel Status VPN INFO 801 IPsec Tunnel status changed WARNING WARNING WARNING Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Source routed IP packet dropped Source routed IP packet dropped Source routed IP packet dropped No response from server to Echo Requests, disconnecting PPTP Tunnel No response from server to Echo Requests, disconnecting PPTP Tunnel No response from server to Echo Requests, disconnecting PPTP Tunnel No response from PPTP server to control connection requests No response from PPTP server to control connection requests No response from PPTP server to control connection requests 46

49 Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO User Activity WAN Failover INFO User Activity WAN Failover INFO No response from PPTP server to call requests No response from PPTP server to call requests No response from PPTP server to call requests PPTP server rejected control connection PPTP server rejected control connection PPTP server rejected control connection PPTP server rejected the call request PPTP server rejected the call request PPTP server rejected the call request PPP Dial Up: Trying to failover but Alternate Profile is manual PPP Dial Up: Trying to failover but Alternate Profile is manual User Activity WAN Failover INFO PPP Dial Up: Trying to failover but Alternate Profile is manual System Error WAN Failover ALERT 652 WLB Failback initiated by %s System Error WAN Failover ALERT 652 WLB Failback initiated by %s System Error WAN Failover ALERT 652 WLB Failback initiated by %s System Error WAN Failover ALERT 638 Probing succeeded on %s System Error WAN Failover ALERT 638 Probing succeeded on %s System Error WAN Failover ALERT 638 Probing succeeded on %s Attack Attack Attack User Activity ERROR 550 E Mail fragment dropped ERROR 550 E Mail fragment dropped ERROR 550 E Mail fragment dropped Locked out user logins allowed lockout period expired SonicOS 5.9 / / 6.2 Log Events Reference Guide 47

50 User Activity User Activity User Activity User Activity Locked out user logins allowed lockout period expired Locked out user logins allowed lockout period expired Locked out user logins allowed by %s Locked out user logins allowed by administrator User Activity Locked out user logins allowed by %s User Activity Firewall Rule INFO Access rule added User Activity Firewall Rule INFO Access rule added User Activity Firewall Rule INFO Access rule added User Activity Firewall Rule INFO Access rule modified User Activity Firewall Rule INFO Access rule modified User Activity Firewall Rule INFO Access rule modified User Activity Firewall Rule INFO Access rule deleted User Activity Firewall Rule INFO Access rule deleted User Activity Firewall Rule INFO Access rule deleted User Activity Firewall Rule INFO User Activity Firewall Rule INFO User Activity Firewall Rule INFO Maintenance PPTP INFO Maintenance PPTP INFO Maintenance PPTP INFO User Activity VPN IKE INFO User Activity VPN IKE INFO Access rules restored to defaults Access rules restored to defaults Access rules restored to defaults PPTP Server is not responding, check if the server is UP and running. PPTP Server is not responding, check if the server is UP and running. PPTP Server is not responding, check if the server is UP and running. IKE Initiator: Accepting peer lifetime. (Phase 1) IKE Initiator: Accepting peer lifetime. (Phase 1) 48

51 User Activity VPN IKE INFO Attack Attack Attack ERROR 551 ERROR 551 ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR IKE Initiator: Accepting peer lifetime. (Phase 1) FTP: PASV response spoof attack dropped FTP: PASV response spoof attack dropped FTP: PASV response spoof attack dropped PKI Failure: Output buffer too small PKI Failure: Output buffer too small PKI Failure: Output buffer too small PKI Failure: Cannot alloc memory PKI Failure: Cannot alloc memory PKI Failure: Cannot alloc memory PKI Failure: Reached the limit for local certs, cant load any more PKI Failure: Reached the limit for local certs, cant load any more Maintenance VPN PKI ERROR PKI Failure: Reached the limit for local certs, cant load any more Maintenance VPN PKI ERROR PKI Failure: Import failed Maintenance VPN PKI ERROR PKI Failure: Import failed Maintenance VPN PKI ERROR PKI Failure: Import failed Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR PKI Failure: Incorrect admin password PKI Failure: Incorrect admin password PKI Failure: Incorrect admin password SonicOS 5.9 / / 6.2 Log Events Reference Guide 49

52 Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR PKI Failure: CA certificates store exceeded. Cannot verify this Local Certificate PKI Failure: CA certificates store exceeded. Cannot verify this Local Certificate PKI Failure: CA certificates store exceeded. Cannot verify this Local Certificate PKI Failure: Improper file format. Please select PKCS#12 (*.p12) file PKI Failure: Improper file format. Please select PKCS#12 (*.p12) file PKI Failure: Improper file format. Please select PKCS#12 (*.p12) file PKI Failure: Certificate's ID does not match this Network Security Appliance PKI Failure: Certificate's ID does not match this Network Security Appliance PKI Failure: Certificate's ID does not match this Network Security Appliance PKI Failure: public private key mismatch PKI Failure: public private key mismatch PKI Failure: public private key mismatch PKI Failure: Duplicate local certificate name PKI Failure: Duplicate local certificate name PKI Failure: Duplicate local certificate name 50

53 Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR PKI Failure: Duplicate local certificate PKI Failure: Duplicate local certificate PKI Failure: Duplicate local certificate PKI Failure: No CA certificates yet loaded PKI Failure: No CA certificates yet loaded Maintenance VPN PKI ERROR PKI Failure: No CA certificates yet loaded Maintenance VPN PKI ERROR PKI Failure: Internal error Maintenance VPN PKI ERROR PKI Failure: Internal error Maintenance VPN PKI ERROR PKI Failure: Internal error Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR PKI Failure: Temporary memory shortage, try again PKI Failure: Temporary memory shortage, try again PKI Failure: Temporary memory shortage, try again PKI Failure: The certificate chain is circular PKI Failure: The certificate chain is circular PKI Failure: The certificate chain is circular PKI Failure: The certificate chain is incomplete PKI Failure: The certificate chain is incomplete PKI Failure: The certificate chain is incomplete PKI Failure: The certificate chain has no root PKI Failure: The certificate chain has no root PKI Failure: The certificate chain has no root SonicOS 5.9 / / 6.2 Log Events Reference Guide 51

54 Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR PKI Failure: The certificate or a certificate in the chain has expired PKI Failure: The certificate or a certificate in the chain has expired PKI Failure: The certificate or a certificate in the chain has expired PKI Failure: The certificate or a certificate in the chain has a validity period in the future PKI Failure: The certificate or a certificate in the chain has a validity period in the future PKI Failure: The certificate or a certificate in the chain has a validity period in the future PKI Failure: The certificate or a certificate in the chain is corrupt PKI Failure: The certificate or a certificate in the chain is corrupt PKI Failure: The certificate or a certificate in the chain is corrupt PKI Failure: The certificate or a certificate in the chain has a bad signature PKI Failure: The certificate or a certificate in the chain has a bad signature PKI Failure: The certificate or a certificate in the chain has a bad signature PKI Failure: Loaded but could not verify certificate PKI Failure: Loaded but could not verify certificate 52

55 Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Maintenance VPN PKI ERROR Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Debug DHCP Relay INFO Maintenance PPP Dial Up INFO PKI Failure: Loaded but could not verify certificate PKI Failure: Loaded the certificate but could not verify its chain PKI Failure: Loaded the certificate but could not verify its chain PKI Failure: Loaded the certificate but could not verify its chain DHCP REQUEST received from remote device DHCP REQUEST received from remote device DHCP REQUEST received from remote device DHCP DISCOVER received from remote device DHCP DISCOVER received from remote device DHCP DISCOVER received from remote device DHCP OFFER received from server DHCP OFFER received from server DHCP OFFER received from server DHCP NACK received from server DHCP NACK received from server DHCP NACK received from server PPP Dial Up: No peer IP address from Dial Up ISP, local and remote IPs will be the same SonicOS 5.9 / / 6.2 Log Events Reference Guide 53

56 Maintenance PPP Dial Up INFO Maintenance PPP Dial Up INFO Maintenance Security Services WARNING Maintenance Security Services WARNING Maintenance Security Services WARNING User Activity VPN IPsec WARNING User Activity VPN IPsec WARNING User Activity VPN IPsec WARNING Maintenance DHCP Relay WARNING Maintenance DHCP Relay WARNING Maintenance DHCP Relay WARNING User Activity User Activity User Activity PPP Dial Up: No peer IP address from Dial Up ISP, local and remote IPs will be the same PPP Dial Up: No peer IP address from Dial Up ISP, local and remote IPs will be the same Received AV Alert: Your Network Anti Virus subscription will expire in 7 days. %s Received AV Alert: Your Network Anti Virus subscription will expire in 7 days. %s Received AV Alert: Your Network Anti Virus subscription will expire in 7 days. %s Received notify: INVALID_ID_INFO Received notify: INVALID_ID_INFO Received notify: INVALID_ID_INFO DHCP lease dropped. Lease from Central Gateway conflicts with Remote Management IP DHCP lease dropped. Lease from Central Gateway conflicts with Remote Management IP DHCP lease dropped. Lease from Central Gateway conflicts with Remote Management IP User login denied User has no privileges for guest service User login denied User has no privileges for guest service User login denied User has no privileges for guest service TCP UDP ICMP Network Access WARNING Packet dropped by guest check TCP UDP ICMP Network Access WARNING Packet dropped by guest check 54

57 TCP UDP ICMP Network Access WARNING Packet dropped by guest check Maintenance Security Services WARNING Maintenance Security Services WARNING Maintenance Security Services WARNING Maintenance Security Services WARNING Maintenance Security Services WARNING Maintenance Security Services WARNING Maintenance Security Services WARNING Maintenance Security Services WARNING Maintenance Security Services WARNING Maintenance Security Services WARNING Maintenance Security Services WARNING Maintenance Security Services WARNING Maintenance Firewall Event INFO Received CFS Alert: Your Content Filtering subscription will expire in 7 days. Received CFS Alert: Your Content Filtering subscription will expire in 7 days. Received CFS Alert: Your Content Filtering subscription will expire in 7 days. Received CFS Alert: Your Content Filtering subscription has expired. Received CFS Alert: Your Content Filtering subscription has expired. Received CFS Alert: Your Content Filtering subscription has expired. Received E Mail Filter Alert: Your E Mail Filtering subscription will expire in 7 days. Received E Mail Filter Alert: Your E Mail Filtering subscription will expire in 7 days. Received E Mail Filter Alert: Your E Mail Filtering subscription will expire in 7 days. Received E Mail Filter Alert: Your E Mail Filtering subscription has expired. Received E Mail Filter Alert: Your E Mail Filtering subscription has expired. Received E Mail Filter Alert: Your E Mail Filtering subscription has expired. ISDN Driver Firmware successfully updated SonicOS 5.9 / / 6.2 Log Events Reference Guide 55

58 Maintenance Firewall Event INFO Maintenance Firewall Event INFO System Error VPN Client INFO System Error VPN Client INFO System Error VPN Client INFO Maintenance Security Services WARNING Maintenance Security Services WARNING ISDN Driver Firmware successfully updated ISDN Driver Firmware successfully updated Global VPN Client License Exceeded: Connection denied. Global VPN Client License Exceeded: Connection denied. Global VPN Client License Exceeded: Connection denied. Registration Update Needed, Please restore your existing security service subscriptions. Registration Update Needed, Please restore your existing security service subscriptions Maintenance Security Services WARNING Registration Update Needed, Please restore your existing security service subscriptions Maintenance Firewall Event INFO WAN not ready Maintenance Firewall Event INFO WAN not ready Maintenance Firewall Event INFO WAN not ready System Error VPN Client ERROR System Error VPN Client ERROR System Error VPN Client ERROR Maintenance Maintenance Maintenance Maintenance Maintenance Blocked Quick Mode for Client using Default KeyId Blocked Quick Mode for Client using Default KeyId Blocked Quick Mode for Client using Default KeyId VPN disabled by administrator VPN disabled by administrator VPN disabled by administrator VPN enabled by administrator VPN enabled by administrator 56

59 Maintenance Maintenance Maintenance Maintenance Maintenance Maintenance Maintenance User Activity User Activity User Activity VPN enabled by administrator WLAN disabled by administrator WLAN disabled by administrator WLAN disabled by administrator WLAN enabled by administrator WLAN enabled by administrator WLAN enabled by administrator b Management Wireless INFO Management b Management Wireless INFO Management b Management Wireless INFO Management Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO CLI administrator logged out CLI administrator logged out CLI administrator logged out Debug Network Access ALERT Debug Network Access ALERT 554 Network Security Appliance initializing Network Security Appliance initializing Network Security Appliance initializing Malformed or unhandled IP packet dropped Malformed or unhandled IP packet dropped Malformed or unhandled IP Debug Network Access ALERT 554 packet dropped ICMP Network Access NOTICE ICMP packet dropped no match SonicOS 5.9 / / 6.2 Log Events Reference Guide 57

60 ICMP Network Access NOTICE ICMP packet dropped no match ICMP Network Access NOTICE ICMP packet dropped no match TCP Network Access NOTICE Web access Request dropped TCP Network Access NOTICE Web access Request dropped TCP Network Access NOTICE Web access Request dropped User Activity Network Access NOTICE User Activity Network Access NOTICE User Activity Network Access NOTICE Attack Attack Attack Attack Attack Attack ALERT 555 ALERT 555 ALERT 555 ALERT 556 ALERT 556 ALERT System Error VPN Client INFO System Error VPN Client INFO System Error VPN Client INFO Web management request allowed Web management request allowed Web management request allowed FTP: PORT bounce attack dropped. FTP: PORT bounce attack dropped. FTP: PORT bounce attack dropped. FTP: PASV response bounce attack dropped. FTP: PASV response bounce attack dropped. FTP: PASV response bounce attack dropped. Global VPN Client connection is not allowed. Appliance is not registered. Global VPN Client connection is not allowed. Appliance is not registered. Global VPN Client connection is not allowed. Appliance is not registered. TCP UDP ICMP VPN IPsec NOTICE IPsec (ESP) packet dropped TCP UDP ICMP VPN IPsec NOTICE IPsec (ESP) packet dropped TCP UDP ICMP VPN IPsec NOTICE IPsec (ESP) packet dropped 58

61 TCP UDP ICMP VPN IPsec NOTICE IPsec (AH) packet dropped TCP UDP ICMP VPN IPsec NOTICE IPsec (AH) packet dropped TCP UDP ICMP VPN IPsec NOTICE IPsec (AH) packet dropped Debug VPN IPsec DEBUG Debug VPN IPsec DEBUG Debug VPN IPsec DEBUG IPsec (ESP) packet dropped; waiting for pending IPsec connection IPsec (ESP) packet dropped; waiting for pending IPsec connection IPsec (ESP) packet dropped; waiting for pending IPsec connection Connection Traffic Network Traffic INFO Connection Closed Connection Traffic Network Traffic INFO Connection Closed Connection Traffic Network Traffic INFO Connection Closed Attack Network Access ALERT Attack Network Access ALERT Attack Network Access ALERT User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity PPP Dial Up INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO FTP: Data connection from non default port dropped FTP: Data connection from non default port dropped FTP: Data connection from non default port dropped PPP Dial Up: Previous session was connected for %s PPP Dial Up: Previous session was connected for %s PPP Dial Up: Previous session was connected for %s IKE Initiator: Using secondary gateway to negotiate IKE Initiator: Using secondary gateway to negotiate IKE Initiator: Using secondary gateway to negotiate SonicOS 5.9 / / 6.2 Log Events Reference Guide 59

62 User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO IKE Initiator drop: VPN tunnel end point does not match configured VPN Policy Bound to scope IKE Initiator drop: VPN tunnel end point does not match configured VPN Policy Bound to scope IKE Initiator drop: VPN tunnel end point does not match configured VPN Policy Bound to scope IKE Responder drop: VPN tunnel end point does not match configured VPN Policy Bound to scope IKE Responder drop: VPN tunnel end point does not match configured VPN Policy Bound to scope User Activity VPN IKE INFO IKE Responder drop: VPN tunnel end point does not match configured VPN Policy Bound to scope WLAN IDS WLAN IDS ALERT 901 Found Rogue Access Point WLAN IDS WLAN IDS ALERT 901 Found Rogue Access Point WLAN IDS WLAN IDS ALERT 901 Found Rogue Access Point WLAN IDS WLAN IDS ALERT WLAN IDS WLAN IDS ALERT WLAN IDS WLAN IDS ALERT User Activity User Activity User Activity Association Flood from WLAN station Association Flood from WLAN station Association Flood from WLAN station User login failed Guest service limit reached User login failed Guest service limit reached User login failed Guest service limit reached 60

63 User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity Guest Session Timeout Guest Session Timeout Guest Session Timeout Guest Account Timeout Guest Account Timeout Guest Account Timeout Guest login denied. Guest '%s' is already logged in. Please try again later. Guest login denied. Guest '%s' is already logged in. Please try again later. Guest login denied. Guest '%s' is already logged in. Please try again later. Guest account '%s' created Guest account '%s' created Guest account '%s' created Guest account '%s' deleted Guest account '%s' deleted Guest account '%s' deleted Guest account '%s' disabled Guest account '%s' disabled Guest account '%s' disabled SonicOS 5.9 / / 6.2 Log Events Reference Guide 61

64 User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity Guest account '%s' re enabled Guest account '%s' re enabled Guest account '%s' re enabled Guest account '%s' pruned Guest account '%s' pruned Guest account '%s' pruned Guest account '%s' re generated Guest account '%s' re generated Guest account '%s' re generated Guest Idle Timeout Guest Idle Timeout User Activity Guest Idle Timeout System Error Firewall Event ALERT 646 Interface %s Link Is Up System Error Firewall Event ALERT 646 Interface %s Link Is Up System Error Firewall Event ALERT 646 Interface %s Link Is Up System Error Firewall Event ALERT 647 Interface %s Link Is Down System Error Firewall Event ALERT 647 Interface %s Link Is Down System Error Firewall Event ALERT 647 Interface %s Link Is Down Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO Interface IP Assignment changed: Shutting down %s Interface IP Assignment changed: Shutting down %s Interface IP Assignment changed: Shutting down %s Interface IP Assignment : Binding and initializing %s 62

65 Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO System Error Firewall Event WARNING System Error Firewall Event WARNING System Error Firewall Event WARNING System Error Firewall Event WARNING System Error Firewall Event WARNING System Error Firewall Event WARNING Interface IP Assignment : Binding and initializing %s Interface IP Assignment : Binding and initializing %s Network for interface %s overlaps with another interface. Network for interface %s overlaps with another interface. Network for interface %s overlaps with another interface. Please connect interface %s to another network to function properly Please connect interface %s to another network to function properly Please connect interface %s to another network to function properly The preferences file is too large to be saved in available flash memory The preferences file is too large to be saved in available flash memory The preferences file is too large to be saved in available flash memory All preference values have been set to factory default values All preference values have been set to factory default values All preference values have been set to factory default values System Environment Firewall Hardware ERROR 101 Voltages Out of Tolerance System Environment Firewall Hardware ERROR 101 Voltages Out of Tolerance System Environment Firewall Hardware ERROR 101 Voltages Out of Tolerance SonicOS 5.9 / / 6.2 Log Events Reference Guide 63

66 System Environment Firewall Hardware ALERT 102 Fan Failure System Environment Firewall Hardware ALERT 102 Fan Failure System Environment Firewall Hardware ALERT 102 Fan Failure System Environment Firewall Hardware ALERT 103 Thermal Yellow System Environment Firewall Hardware ALERT 103 Thermal Yellow System Environment Firewall Hardware ALERT 103 Thermal Yellow System Environment Firewall Hardware ALERT 104 Thermal Red System Environment Firewall Hardware ALERT 104 Thermal Red System Environment Firewall Hardware ALERT 104 Thermal Red System Environment Firewall Hardware ALERT 105 Thermal Red Timer Exceeded System Environment Firewall Hardware ALERT 105 Thermal Red Timer Exceeded System Environment Firewall Hardware ALERT 105 Thermal Red Timer Exceeded Attack Network Access ALERT 558 TCP SYN/FIN packet dropped Attack Network Access ALERT 558 TCP SYN/FIN packet dropped Attack Network Access ALERT 558 TCP SYN/FIN packet dropped Maintenance WAN Failover WARNING Maintenance WAN Failover WARNING WLB Spill over started, configured threshold exceeded WLB Spill over started, configured threshold exceeded Maintenance WAN Failover WARNING WLB Spill over started, configured threshold exceeded Maintenance WAN Failover WARNING WLB Spill over stopped Maintenance WAN Failover WARNING WLB Spill over stopped Maintenance WAN Failover WARNING WLB Spill over stopped Attack Access ERROR 559 User login disabled from %s 64

67 Attack Access ERROR 559 User login disabled from %s Attack Access ERROR 559 User login disabled from %s System Error WAN Failover ALERT 651 WLB Failover in progress System Error WAN Failover ALERT 651 WLB Failover in progress System Error WAN Failover ALERT 651 WLB Failover in progress System Error WAN Failover ALERT 653 WLB Resource is now available System Error WAN Failover ALERT 653 WLB Resource is now available System Error WAN Failover ALERT 653 WLB Resource is now available System Error WAN Failover ALERT 654 WLB Resource failed System Error WAN Failover ALERT 654 WLB Resource failed System Error WAN Failover ALERT 654 WLB Resource failed User Activity VPN IKE WARNING Header verification failed User Activity VPN IKE WARNING Header verification failed User Activity VPN IKE WARNING Header verification failed Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Maintenance DHCP Client INFO Received DHCP offer packet has errors Received DHCP offer packet has errors Received DHCP offer packet has errors Received response packet for DHCP request has errors Received response packet for DHCP request has errors Received response packet for DHCP request has errors LAN UDP LAN TCP Network Access NOTICE IP type %s packet dropped LAN UDP LAN TCP Network Access NOTICE IP type %s packet dropped LAN UDP LAN TCP Network Access NOTICE IP type %s packet dropped Attack PPP Dial Up ERROR 566 Maximum sequential failed dial attempts (10) to a single dial up number: %s SonicOS 5.9 / / 6.2 Log Events Reference Guide 65

68 Attack PPP Dial Up ERROR Attack PPP Dial Up ERROR Attack PPP Dial Up ERROR Attack PPP Dial Up ERROR Attack PPP Dial Up ERROR Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO Maximum sequential failed dial attempts (10) to a single dial up number: %s Maximum sequential failed dial attempts (10) to a single dial up number: %s Regulatory requirements prohibit %s from being re dialed for 30 minutes Regulatory requirements prohibit %s from being re dialed for 30 minutes Regulatory requirements prohibit %s from being re dialed for 30 minutes Received PPPoE Active Discovery Offer Received PPPoE Active Discovery Offer Received PPPoE Active Discovery Offer Received PPPoE Active Discovery Session_confirmation Received PPPoE Active Discovery Session_confirmation Received PPPoE Active Discovery Session_confirmation Sending PPPoE Active Discovery Request Sending PPPoE Active Discovery Request Maintenance PPPoE INFO Sending PPPoE Active Discovery Request Debug PPTP DEBUG PPTP decode failure Debug PPTP DEBUG PPTP decode failure Debug PPTP DEBUG PPTP decode failure Debug Network ICMP packet allowed Debug Network ICMP packet allowed Debug Network ICMP packet allowed 66

69 Debug Network ICMP packet from LAN allowed Debug Network ICMP packet from LAN allowed Debug Network ICMP packet from LAN allowed System Error Firewall Hardware ERROR 655 Diagnostic Code G System Error Firewall Hardware ERROR 655 Diagnostic Code G System Error Firewall Hardware ERROR 655 Diagnostic Code G System Error Firewall Hardware ERROR 656 Diagnostic Code H System Error Firewall Hardware ERROR 656 Diagnostic Code H System Error Firewall Hardware ERROR 656 Diagnostic Code H System Error Firewall Hardware ERROR 657 Diagnostic Code I System Error Firewall Hardware ERROR 657 Diagnostic Code I System Error Firewall Hardware ERROR 657 Diagnostic Code I Debug Network DNS packet allowed Debug Network DNS packet allowed Debug Network DNS packet allowed System Error L2TP Server ERROR System Error L2TP Server ERROR System Error L2TP Server ERROR User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING Attack Attack Attack ALERT 568 ALERT 568 ALERT Debug UDP VPN IKE INFO Debug UDP VPN IKE INFO Adding L2TP IP pool Address object Failed. Adding L2TP IP pool Address object Failed. Adding L2TP IP pool Address object Failed. Received unencrypted packet in crypto active state Received unencrypted packet in crypto active state Received unencrypted packet in crypto active state Spank attack multicast packet dropped Spank attack multicast packet dropped Spank attack multicast packet dropped Received ISAKMP packet destined to port %s Received ISAKMP packet destined to port %s SonicOS 5.9 / / 6.2 Log Events Reference Guide 67

70 Debug UDP VPN IKE INFO Attack Attack Attack Attack Attack Received ISAKMP packet destined to port %s ALERT 569 IPS Detection Alert: %s ALERT 569 IPS Detection Alert: %s ALERT 569 IPS Detection Alert: %s ALERT 570 IPS Prevention Alert: %s ALERT 570 IPS Prevention Alert: %s Attack ALERT 570 IPS Prevention Alert: %s Maintenance Crypto Test ERROR Crypto Hardware AES test failed Maintenance Crypto Test ERROR Crypto Hardware AES test failed Maintenance Crypto Test ERROR Crypto Hardware AES test failed Maintenance Security Services WARNING Maintenance Security Services WARNING 571 Received IPS Alert: Your Intrusion Prevention (IDP) subscription has expired. Received IPS Alert: Your Intrusion Prevention (IDP) subscription has expired Maintenance Security Services WARNING 571 Received IPS Alert: Your Intrusion Prevention (IDP) subscription has expired WLAN IDS WLAN IDS WARNING 904 WLAN client null probing WLAN IDS WLAN IDS WARNING 904 WLAN client null probing WLAN IDS WLAN IDS WARNING 904 WLAN client null probing Debug VPN IKE ERROR Payload processing failed Debug VPN IKE ERROR Payload processing failed Debug VPN IKE ERROR Payload processing failed Maintenance Wireless INFO Maintenance Wireless INFO WLAN not in AP mode, DHCP server will not provide lease to clients on WLAN WLAN not in AP mode, DHCP server will not provide lease to clients on WLAN 68

71 Maintenance Wireless INFO Debug Bootp DEBUG Debug Bootp DEBUG Debug Bootp DEBUG Maintenance Bootp INFO Maintenance Bootp INFO Maintenance Bootp INFO Maintenance Bootp INFO Maintenance Bootp INFO WLAN not in AP mode, DHCP server will not provide lease to clients on WLAN BOOTP server response relayed to remote device BOOTP server response relayed to remote device BOOTP server response relayed to remote device BOOTP Client IP address on LAN conflicts with remote device IP, deleting IP address from remote table BOOTP Client IP address on LAN conflicts with remote device IP, deleting IP address from remote table BOOTP Client IP address on LAN conflicts with remote device IP, deleting IP address from remote table BOOTP reply relayed to local device BOOTP reply relayed to local device Maintenance Bootp INFO BOOTP reply relayed to local device VoIP VoIP INFO VoIP Call Connected VoIP VoIP INFO VoIP Call Connected VoIP VoIP INFO VoIP Call Connected VoIP VoIP INFO VoIP Call Disconnected VoIP VoIP INFO VoIP Call Disconnected VoIP VoIP INFO VoIP Call Disconnected VoIP VoIP DEBUG H.323/RAS Admission Reject VoIP VoIP DEBUG H.323/RAS Admission Reject VoIP VoIP DEBUG H.323/RAS Admission Reject VoIP VoIP DEBUG H.323/RAS Admission Confirm VoIP VoIP DEBUG H.323/RAS Admission Confirm VoIP VoIP DEBUG H.323/RAS Admission Confirm SonicOS 5.9 / / 6.2 Log Events Reference Guide 69

72 VoIP VoIP DEBUG H.323/RAS Admission Request VoIP VoIP DEBUG H.323/RAS Admission Request VoIP VoIP DEBUG H.323/RAS Admission Request VoIP VoIP DEBUG H.323/RAS Bandwidth Reject VoIP VoIP DEBUG H.323/RAS Bandwidth Reject VoIP VoIP DEBUG H.323/RAS Bandwidth Reject VoIP VoIP DEBUG H.323/RAS Disengage Confirm VoIP VoIP DEBUG H.323/RAS Disengage Confirm VoIP VoIP DEBUG H.323/RAS Disengage Confirm VoIP VoIP DEBUG H.323/RAS Gatekeeper Reject VoIP VoIP DEBUG H.323/RAS Gatekeeper Reject VoIP VoIP DEBUG H.323/RAS Gatekeeper Reject VoIP VoIP DEBUG H.323/RAS Location Confirm VoIP VoIP DEBUG H.323/RAS Location Confirm VoIP VoIP DEBUG H.323/RAS Location Confirm VoIP VoIP DEBUG H.323/RAS Location Reject VoIP VoIP DEBUG H.323/RAS Location Reject VoIP VoIP DEBUG H.323/RAS Location Reject VoIP VoIP DEBUG H.323/RAS Registration Reject VoIP VoIP DEBUG H.323/RAS Registration Reject VoIP VoIP DEBUG H.323/RAS Registration Reject VoIP VoIP DEBUG H.323/H.225 Setup VoIP VoIP DEBUG H.323/H.225 Setup VoIP VoIP DEBUG H.323/H.225 Setup VoIP VoIP DEBUG H.323/H.225 Connect VoIP VoIP DEBUG H.323/H.225 Connect VoIP VoIP DEBUG H.323/H.225 Connect VoIP VoIP DEBUG H.323/H.245 Address VoIP VoIP DEBUG H.323/H.245 Address VoIP VoIP DEBUG H.323/H.245 Address VoIP VoIP DEBUG H.323/H.245 End Session VoIP VoIP DEBUG H.323/H.245 End Session VoIP VoIP DEBUG H.323/H.245 End Session VoIP VoIP DEBUG VoIP %s Endpoint added VoIP VoIP DEBUG VoIP %s Endpoint added VoIP VoIP DEBUG VoIP %s Endpoint added VoIP VoIP DEBUG VoIP %s Endpoint removed 70

73 VoIP VoIP DEBUG VoIP %s Endpoint removed VoIP VoIP DEBUG VoIP %s Endpoint removed VoIP VoIP WARNING VoIP VoIP WARNING VoIP VoIP WARNING VoIP VoIP DEBUG VoIP VoIP DEBUG VoIP %s Endpoint not added configured 'public' endpoint limit reached VoIP %s Endpoint not added configured 'public' endpoint limit reached VoIP %s Endpoint not added configured 'public' endpoint limit reached H.323/RAS Unknown Message Response H.323/RAS Unknown Message Response VoIP VoIP DEBUG H.323/RAS Unknown Message Response VoIP VoIP DEBUG H.323/RAS Disengage Reject VoIP VoIP DEBUG H.323/RAS Disengage Reject VoIP VoIP DEBUG H.323/RAS Disengage Reject VoIP VoIP DEBUG VoIP VoIP DEBUG H.323/RAS Unregistration Reject H.323/RAS Unregistration Reject VoIP VoIP DEBUG H.323/RAS Unregistration Reject VoIP VoIP DEBUG SIP Request VoIP VoIP DEBUG SIP Request VoIP VoIP DEBUG SIP Request VoIP VoIP DEBUG SIP Response VoIP VoIP DEBUG SIP Response VoIP VoIP DEBUG SIP Response VoIP VoIP WARNING VoIP VoIP WARNING SIP Register expiration exceeds configured Signaling inactivity time out SIP Register expiration exceeds configured Signaling inactivity time out SonicOS 5.9 / / 6.2 Log Events Reference Guide 71

74 VoIP VoIP WARNING System Error Firewall Event ALERT System Error Firewall Event ALERT System Error Firewall Event ALERT System Error Firewall Event ALERT System Error Firewall Event ALERT System Error Firewall Event ALERT Attack VPN IPsec ERROR Attack VPN IPsec ERROR 572 SIP Register expiration exceeds configured Signaling inactivity time out Packet dropped; connection limit for this source IP address has been reached Packet dropped; connection limit for this source IP address has been reached Packet dropped; connection limit for this source IP address has been reached Packet dropped; connection limit for this destination IP address has been reached Packet dropped; connection limit for this destination IP address has been reached Packet dropped; connection limit for this destination IP address has been reached Packet destination not in VPN Access list Packet destination not in VPN Access list Attack VPN IPsec ERROR 572 Packet destination not in VPN Access list Debug IPComp DEBUG IPComp connection interrupt Debug IPComp DEBUG IPComp connection interrupt Debug IPComp DEBUG IPComp connection interrupt TCP UDP ICMP IPComp NOTICE IPComp packet dropped TCP UDP ICMP IPComp NOTICE IPComp packet dropped TCP UDP ICMP IPComp NOTICE IPComp packet dropped IPComp packet dropped; waiting for pending IPComp connection Debug IPComp DEBUG 72

75 Debug IPComp DEBUG Debug IPComp DEBUG System Error Firewall Logging CRITICAL System Error Firewall Logging CRITICAL System Error Firewall Logging CRITICAL System Error Firewall Logging CRITICAL System Error Firewall Logging CRITICAL System Error Firewall Logging CRITICAL System Error Firewall Logging WARNING System Error Firewall Logging WARNING System Error Firewall Logging WARNING Maintenance Network INFO Maintenance Network INFO Maintenance Network INFO System Error VPN IKE WARNING System Error VPN IKE WARNING System Error VPN IKE WARNING System Error VPN Client ERROR IPComp packet dropped; waiting for pending IPComp connection IPComp packet dropped; waiting for pending IPComp connection Maximum events per second threshold exceeded Maximum events per second threshold exceeded Maximum events per second threshold exceeded Maximum syslog data per second threshold exceeded Maximum syslog data per second threshold exceeded Maximum syslog data per second threshold exceeded SMTP POP Before SMTP authentication failed SMTP POP Before SMTP authentication failed SMTP POP Before SMTP authentication failed Syslog Server cannot be reached Syslog Server cannot be reached Syslog Server cannot be reached IKE Responder: Proposed IKE ID mismatch IKE Responder: Proposed IKE ID mismatch IKE Responder: Proposed IKE ID mismatch IKE Responder: IP Address already exists in the DHCP relay table. Client traffic not allowed. SonicOS 5.9 / / 6.2 Log Events Reference Guide 73

76 System Error VPN Client ERROR System Error VPN Client ERROR System Error VPN Client ERROR System Error VPN Client ERROR System Error VPN Client ERROR User Activity VPN IKE ERROR User Activity VPN IKE ERROR User Activity VPN IKE ERROR Attack Attack Attack ERROR 6434 ERROR 6434 ERROR PPP Dial Up INFO PPP Dial Up INFO PPP Dial Up INFO PPP Dial Up INFO PPP Dial Up INFO IKE Responder: IP Address already exists in the DHCP relay table. Client traffic not allowed. IKE Responder: IP Address already exists in the DHCP relay table. Client traffic not allowed. IKE Responder: %s Policy does not allow static IP for Virtual Adapter. IKE Responder: %s Policy does not allow static IP for Virtual Adapter. IKE Responder: %s Policy does not allow static IP for Virtual Adapter. Received notify: INVALID_PAYLOAD Received notify: INVALID_PAYLOAD Received notify: INVALID_PAYLOAD Drop WLAN traffic from non SonicPoint devices Drop WLAN traffic from non SonicPoint devices Drop WLAN traffic from non SonicPoint devices PPP Dial Up: Dialing not allowed by schedule. %s PPP Dial Up: Dialing not allowed by schedule. %s PPP Dial Up: Dialing not allowed by schedule. %s PPP Dial Up: Connection disconnected as scheduled. PPP Dial Up: Connection disconnected as scheduled. PPP Dial Up: Connection disconnected PPP Dial Up INFO as scheduled SonicPoint SonicPoint INFO SonicPoint Status 74

77 SonicPoint SonicPoint INFO SonicPoint Status SonicPoint SonicPoint INFO SonicPoint Status Maintenance High Availability INFO HA Peer Firewall Rebooted Maintenance High Availability INFO HA Peer Firewall Rebooted Maintenance High Availability INFO HA Peer Firewall Rebooted System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability INFO System Error High Availability INFO System Error High Availability INFO System Error High Availability ERROR System Error High Availability ERROR 6234 Error Rebooting HA Peer Firewall Error Rebooting HA Peer Firewall Error Rebooting HA Peer Firewall License of HA pair doesn't match: %s License of HA pair doesn't match: %s License of HA pair doesn't match: %s Primary received reboot signal from Secondary Primary received reboot signal from Secondary Primary received reboot signal from Secondary Secondary received reboot signal from Primary Secondary received reboot signal from Primary Secondary received reboot signal from Primary Success to reach Interface %s probe Success to reach Interface %s probe Success to reach Interface %s probe Failure to reach Interface %s probe Failure to reach Interface %s probe SonicOS 5.9 / / 6.2 Log Events Reference Guide 75

78 System Error High Availability ERROR Multicast INFO Multicast INFO Multicast INFO Multicast INFO Multicast INFO Multicast INFO Multicast INFO Multicast INFO Multicast INFO Multicast NOTICE Multicast NOTICE Multicast NOTICE Multicast NOTICE Multicast NOTICE Multicast NOTICE Multicast WARNING Multicast WARNING Failure to reach Interface %s probe IGMP V2 client joined multicast Group : %s IGMP V2 client joined multicast Group : %s IGMP V2 client joined multicast Group : %s IGMP V3 client joined multicast Group : %s IGMP V3 client joined multicast Group : %s IGMP V3 client joined multicast Group : %s IGMP Leave group message Received on interface %s IGMP Leave group message Received on interface %s IGMP Leave group message Received on interface %s IGMP packet dropped, wrong checksum received on interface %s IGMP packet dropped, wrong checksum received on interface %s IGMP packet dropped, wrong checksum received on interface %s Multicast UDP packet dropped, no state entry Multicast UDP packet dropped, no state entry Multicast UDP packet dropped, no state entry Multicast UDP packet dropped, RTP stateful failed Multicast UDP packet dropped, RTP stateful failed 76

79 Multicast WARNING Multicast DEBUG Multicast DEBUG Multicast DEBUG Network Monitor ALERT Network Monitor ALERT Network Monitor ALERT Network Monitor ALERT Network Monitor ALERT Network Monitor ALERT Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Multicast UDP packet dropped, RTP stateful failed IGMP querier Router detected on interface %s IGMP querier Router detected on interface %s IGMP querier Router detected on interface %s Network Monitor: Host %s is offline Network Monitor: Host %s is offline Network Monitor: Host %s is offline Network Monitor: Host %s is online Network Monitor: Host %s is online Network Monitor: Host %s is online TCP packet received with invalid SEQ number; TCP packet dropped TCP packet received with invalid SEQ number; TCP packet dropped TCP packet received with invalid SEQ number; TCP packet dropped TCP packet received with invalid ACK number; TCP packet dropped TCP packet received with invalid ACK number; TCP packet dropped TCP packet received with invalid ACK number; TCP packet dropped TCP connection reject received; TCP connection dropped SonicOS 5.9 / / 6.2 Log Events Reference Guide 77

80 Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG TCP connection reject received; TCP connection dropped TCP connection reject received; TCP connection dropped TCP connection abort received; TCP connection dropped TCP connection abort received; TCP connection dropped Debug Network DEBUG TCP connection abort received; TCP connection dropped Debug Network Access NOTICE EIGRP packet dropped Debug Network Access NOTICE EIGRP packet dropped Debug Network Access NOTICE EIGRP packet dropped System Error VPN ERROR System Error VPN ERROR VPN policy count received exceeds the limit; %s VPN policy count received exceeds the limit; %s System Error VPN ERROR VPN policy count received exceeds the limit; %s Maintenance PPPoE INFO Sending LCP Echo Request Maintenance PPPoE INFO Sending LCP Echo Request Maintenance PPPoE INFO Sending LCP Echo Request Maintenance PPPoE INFO Received LCP Echo Request Maintenance PPPoE INFO Received LCP Echo Request Maintenance PPPoE INFO Received LCP Echo Request Maintenance PPPoE INFO Sending LCP Echo Reply Maintenance PPPoE INFO Sending LCP Echo Reply Maintenance PPPoE INFO Sending LCP Echo Reply Maintenance PPPoE INFO Received LCP Echo Reply Maintenance PPPoE INFO Received LCP Echo Reply Maintenance PPPoE INFO Received LCP Echo Reply Network Network Network Guest Services drop traffic to deny network Guest Services drop traffic to deny network Guest Services drop traffic to deny network 78

81 Network Network Network Network Network Guest Services pass traffic to access allow network Guest Services pass traffic to access allow network Guest Services pass traffic to access allow network WLAN max concurrent users reached already WLAN max concurrent users reached already Network WLAN max concurrent users reached already SonicPoint SonicPoint INFO SonicPoint Provision SonicPoint SonicPoint INFO SonicPoint Provision SonicPoint SonicPoint INFO SonicPoint Provision Maintenance Maintenance Maintenance Maintenance Maintenance Maintenance WLAN disabled by schedule WLAN disabled by schedule WLAN disabled by schedule WLAN enabled by schedule WLAN enabled by schedule WLAN enabled by schedule TCP UDP ICMP Wireless WARNING TCP UDP ICMP Wireless WARNING Packet dropped by WLAN SSL VPN enforcement check Packet dropped by WLAN SSL VPN enforcement check TCP UDP ICMP Wireless WARNING Packet dropped by WLAN SSL VPN enforcement check Maintenance Wireless INFO SSL VPN enforcement Maintenance Wireless INFO SSL VPN enforcement Maintenance Wireless INFO SSL VPN enforcement Firewall Event INFO Source IP address connection status: %s SonicOS 5.9 / / 6.2 Log Events Reference Guide 79

82 Firewall Event INFO Firewall Event INFO Firewall Event INFO Firewall Event INFO Firewall Event INFO System Error Firewall Logging WARNING System Error Firewall Logging WARNING System Error Firewall Logging WARNING Maintenance PPPoE INFO Maintenance PPPoE INFO Maintenance PPPoE INFO User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS INFO User Activity RADIUS INFO User Activity RADIUS INFO User Activity RADIUS WARNING User Activity RADIUS WARNING Source IP address connection status: %s Source IP address connection status: %s Destination IP address connection status: %s Destination IP address connection status: %s Destination IP address connection status: %s SMTP authentication problem:%s SMTP authentication problem:%s SMTP authentication problem:%s PPPoE Client: Previous session was connected for %s PPPoE Client: Previous session was connected for %s PPPoE Client: Previous session was connected for %s User login denied RADIUS communication problem User login denied RADIUS communication problem User login denied RADIUS communication problem User login denied LDAP authentication failure User login denied LDAP authentication failure User login denied LDAP authentication failure User login denied LDAP server Timeout User login denied LDAP server Timeout 80

83 User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User login denied LDAP server Timeout User login denied LDAP server down or misconfigured User login denied LDAP server down or misconfigured User login denied LDAP server down or misconfigured User login denied LDAP communication problem User login denied LDAP communication problem User login denied LDAP communication problem User login denied invalid credentials on LDAP server User login denied invalid credentials on LDAP server User login denied invalid credentials on LDAP server User login denied insufficient access on LDAP server User login denied insufficient access on LDAP server User login denied insufficient access on LDAP server User login denied LDAP schema mismatch User login denied LDAP schema mismatch User login denied LDAP schema mismatch Allowed LDAP server certificate with wrong host name Allowed LDAP server certificate with wrong host name Allowed LDAP server certificate with wrong host name SonicOS 5.9 / / 6.2 Log Events Reference Guide 81

84 User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity RADIUS WARNING User Activity User login denied LDAP server name resolution failed User login denied LDAP server name resolution failed User login denied LDAP server name resolution failed User login denied RADIUS server name resolution failed User login denied RADIUS server name resolution failed User login denied RADIUS server name resolution failed User login denied LDAP server certificate not valid User login denied LDAP server certificate not valid User login denied LDAP server certificate not valid User login denied TLS or local certificate problem User login denied TLS or local certificate problem User login denied TLS or local certificate problem User login denied LDAP directory mismatch User login denied LDAP directory mismatch User login denied LDAP directory mismatch LDAP server does not allow CHAP LDAP server does not allow CHAP LDAP server does not allow CHAP User login denied user already logged in 82

85 User Activity User Activity Network Access NOTICE Network Access NOTICE Network Access NOTICE Maintenance Security Services INFO Maintenance Security Services INFO User login denied user already logged in User login denied user already logged in TCP handshake violation detected; TCP connection dropped TCP handshake violation detected; TCP connection dropped TCP handshake violation detected; TCP connection dropped Access attempt from host out of compliance with GSC Policy Access attempt from host out of compliance with GSC Policy Maintenance Security Services INFO Access attempt from host out of compliance with GSC Policy Maintenance Security Services INFO GSC Policy out of date on host Maintenance Security Services INFO GSC Policy out of date on host Maintenance Security Services INFO GSC Policy out of date on host Maintenance Security Services INFO Maintenance Security Services INFO Maintenance Security Services INFO Maintenance Security Services WARNING Maintenance Security Services WARNING 8628 Access attempt from host without GSC installed Access attempt from host without GSC installed Access attempt from host without GSC installed Failed to synchronize license information with Licensing Server. %s Failed to synchronize license information with Licensing Server. %s Maintenance Security Services WARNING 8628 Failed to synchronize license information with Licensing Server. %s System Error DDNS ERROR DDNS Failure: Provider %s System Error DDNS ERROR DDNS Failure: Provider %s SonicOS 5.9 / / 6.2 Log Events Reference Guide 83

86 System Error DDNS ERROR DDNS Failure: Provider %s System Error DDNS ERROR DDNS Failure: Provider %s System Error DDNS ERROR DDNS Failure: Provider %s System Error DDNS ERROR DDNS Failure: Provider %s Maintenance DDNS INFO Maintenance DDNS INFO DDNS Update success for domain %s DDNS Update success for domain %s Maintenance DDNS INFO DDNS Update success for domain %s System Error DDNS WARNING DDNS Warning: Provider %s System Error DDNS WARNING DDNS Warning: Provider %s System Error DDNS WARNING DDNS Warning: Provider %s Maintenance DDNS INFO Maintenance DDNS INFO DDNS association %s taken Offline locally DDNS association %s taken Offline locally Maintenance DDNS INFO DDNS association %s taken Offline locally Maintenance DDNS INFO DDNS association %s added Maintenance DDNS INFO DDNS association %s added Maintenance DDNS INFO DDNS association %s added Maintenance DDNS INFO DDNS association %s enabled Maintenance DDNS INFO DDNS association %s enabled Maintenance DDNS INFO DDNS association %s enabled Maintenance DDNS INFO DDNS association %s disabled Maintenance DDNS INFO DDNS association %s disabled Maintenance DDNS INFO DDNS association %s disabled Maintenance DDNS INFO Maintenance DDNS INFO Maintenance DDNS INFO Maintenance DDNS INFO Maintenance DDNS INFO DDNS Association %s put on line DDNS Association %s put on line DDNS Association %s put on line All DDNS associations have been deleted All DDNS associations have been deleted 84

87 Maintenance DDNS INFO Maintenance DDNS INFO Maintenance DDNS INFO All DDNS associations have been deleted DDNS association %s deactivated DDNS association %s deactivated Maintenance DDNS INFO DDNS association %s deactivated Maintenance DDNS INFO DDNS association %s deleted Maintenance DDNS INFO DDNS association %s deleted Maintenance DDNS INFO DDNS association %s deleted DDNS INFO DDNS association %s updated DDNS INFO DDNS association %s updated DDNS INFO DDNS association %s updated Attack Attack Attack Attack Attack ALERT 6435 IPS Detection Alert: %s ALERT 6435 IPS Detection Alert: %s ALERT 6435 IPS Detection Alert: %s ALERT 6436 IPS Prevention Alert: %s ALERT 6436 IPS Prevention Alert: %s Attack ALERT 6436 IPS Prevention Alert: %s DPI SSL INFO DPI SSL: %s Network Access DPI SSL INFO DPI SSL: %s DPI SSL INFO DPI SSL: %s User Activity User Activity User Activity Attack Attack Application Firewall ALERT Application Firewall Alert: %s Application Firewall ALERT Application Firewall Alert: %s Application Firewall ALERT Application Firewall Alert: %s ALERT 6437 ALERT 6437 Anti Spyware Prevention Alert: %s Anti Spyware Prevention Alert: %s SonicOS 5.9 / / 6.2 Log Events Reference Guide 85

88 Attack Attack Attack ALERT 6437 ALERT 6438 ALERT 6438 Anti Spyware Prevention Alert: %s Anti Spyware Detection Alert: %s Anti Spyware Detection Alert: %s Attack ALERT 6438 Anti Spyware Detection Alert: %s Maintenance Security Services WARNING 8631 Anti Spyware Service Expired Maintenance Security Services WARNING 8631 Anti Spyware Service Expired Maintenance Security Services WARNING 8631 Anti Spyware Service Expired RBL NOTICE RBL NOTICE RBL NOTICE RBL NOTICE RBL NOTICE RBL NOTICE RBL NOTICE RBL NOTICE RBL NOTICE RBL ERROR RBL ERROR RBL ERROR Outbound connection to RBLlisted SMTP server dropped Outbound connection to RBLlisted SMTP server dropped Outbound connection to RBLlisted SMTP server dropped Inbound connection from RBLlisted SMTP server dropped Inbound connection from RBLlisted SMTP server dropped Inbound connection from RBLlisted SMTP server dropped SMTP server found on RBL blacklist SMTP server found on RBL blacklist SMTP server found on RBL blacklist No valid DNS server specified for RBL lookups No valid DNS server specified for RBL lookups No valid DNS server specified for RBL lookups GMS INFO Interface statistics report GMS INFO Interface statistics report GMS INFO Interface statistics report GMS INFO SonicPoint statistics report 86

89 GMS INFO SonicPoint statistics report GMS INFO SonicPoint statistics report Attack Security Services ALERT 8632 Gateway Anti Virus Alert: %s Attack Security Services ALERT 8632 Gateway Anti Virus Alert: %s Attack Security Services ALERT 8632 Gateway Anti Virus Alert: %s Maintenance Security Services WARNING Maintenance Security Services WARNING Maintenance Security Services WARNING Maintenance PPP Dial Up INFO Maintenance PPP Dial Up INFO Maintenance PPP Dial Up INFO Network WARNING Network WARNING Network WARNING User Activity User Activity User Activity Gateway Anti Virus Service expired Gateway Anti Virus Service expired Gateway Anti Virus Service expired PPP Dial Up: Invalid DNS IP address returned from Dial Up ISP; overriding using dial up profile settings PPP Dial Up: Invalid DNS IP address returned from Dial Up ISP; overriding using dial up profile settings PPP Dial Up: Invalid DNS IP address returned from Dial Up ISP; overriding using dial up profile settings Too many gratuitous ARPs detected Too many gratuitous ARPs detected Too many gratuitous ARPs detected Incoming call received for Remotely Triggered Dial out session Incoming call received for Remotely Triggered Dial out session Incoming call received for Remotely Triggered Dial out session SonicOS 5.9 / / 6.2 Log Events Reference Guide 87

90 User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity Remotely Triggered Dial out session started. Requesting authentication Remotely Triggered Dial out session started. Requesting authentication Remotely Triggered Dial out session started. Requesting authentication Incorrect authentication received for Remotely Triggered Dial out Incorrect authentication received for Remotely Triggered Dial out Incorrect authentication received for Remotely Triggered Dial out Successful authentication received for Remotely Triggered Dial out Successful authentication received for Remotely Triggered Dial out Successful authentication received for Remotely Triggered Dial out Authentication Timeout during Remotely Triggered Dial out session Authentication Timeout during Remotely Triggered Dial out session Authentication Timeout during Remotely Triggered Dial out session Remotely Triggered Dial out session ended. Valid WAN bound data found. Normal dialup sequence will commence 88

91 User Activity User Activity System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR System Error High Availability ERROR Remotely Triggered Dial out session ended. Valid WAN bound data found. Normal dialup sequence will commence Remotely Triggered Dial out session ended. Valid WAN bound data found. Normal dialup sequence will commence Secondary will be shut down in %s minutes Secondary will be shut down in %s minutes Secondary will be shut down in %s minutes Secondary shut down because license is expired Secondary shut down because license is expired System Error High Availability ERROR Secondary shut down because license is expired System Error High Availability INFO Secondary active System Error High Availability INFO Secondary active System Error High Availability INFO Secondary active High Availability ERROR %s High Availability ERROR %s High Availability ERROR %s High Availability INFO %s High Availability INFO %s High Availability INFO %s High Availability ALERT %s High Availability ALERT %s High Availability ALERT %s High Availability NOTICE %s High Availability NOTICE %s High Availability NOTICE %s DHCP Server INFO DHCP Scopes altered automatically due to change in network settings for interface %s SonicOS 5.9 / / 6.2 Log Events Reference Guide 89

92 DHCP Server INFO DHCP Server INFO System Error DHCP Server WARNING System Error DHCP Server WARNING System Error DHCP Server WARNING System Error DHCP Server WARNING System Error DHCP Server WARNING DHCP Scopes altered automatically due to change in network settings for interface %s DHCP Scopes altered automatically due to change in network settings for interface %s DHCP lease file in the storage is corrupted; read failed DHCP lease file in the storage is corrupted; read failed DHCP lease file in the storage is corrupted; read failed Failed to write DHCP leases to storage Failed to write DHCP leases to storage System Error DHCP Server WARNING Failed to write DHCP leases to storage Maintenance DHCP Server INFO DHCP leases written to storage Maintenance DHCP Server INFO DHCP leases written to storage Maintenance DHCP Server INFO DHCP leases written to storage ARS INFO %s ARS INFO %s ARS INFO %s ARS NOTICE %s DHCP Server NOTICE %s DHCP Server NOTICE %s ARS DEBUG %s ARS DEBUG %s ARS DEBUG %s Maintenance Network WARNING Maintenance Network WARNING IP address conflict detected from Ethernet address %s IP address conflict detected from Ethernet address %s Maintenance Network WARNING IP address conflict detected from Ethernet address %s User Activity VPN PKI INFO OCSP sending request User Activity VPN PKI INFO OCSP sending request. 90

93 User Activity VPN PKI INFO OCSP sending request User Activity VPN PKI ERROR User Activity VPN PKI ERROR OCSP send request message failed. OCSP send request message failed User Activity VPN PKI ERROR OCSP send request message failed User Activity VPN PKI INFO OCSP received response User Activity VPN PKI INFO OCSP received response User Activity VPN PKI INFO OCSP received response User Activity VPN PKI INFO OCSP Resolved Domain Name User Activity VPN PKI INFO OCSP Resolved Domain Name User Activity VPN PKI INFO OCSP Resolved Domain Name User Activity VPN PKI ERROR User Activity VPN PKI ERROR User Activity VPN PKI ERROR User Activity VPN PKI ERROR User Activity VPN PKI ERROR User Activity VPN PKI ERROR Attack Debug Attack Attack WARNING WARNING WARNING WARNING OCSP Failed to Resolve Domain Name. OCSP Failed to Resolve Domain Name. OCSP Failed to Resolve Domain Name. OCSP Internal error handling received response. OCSP Internal error handling received response. OCSP Internal error handling received response. SYN Flood Mode changed by user to: Watch and report possible SYN floods SYN Flood Mode changed by user to: Watch and report possible SYN floods SYN Flood Mode changed by user to: Watch and report possible SYN floods SYN Flood Mode changed by user to: Watch and proxy WAN connections when under attack SonicOS 5.9 / / 6.2 Log Events Reference Guide 91

94 Debug Attack Attack Debug Attack Attack Debug Attack Attack Debug Attack Attack Debug Attack WARNING WARNING WARNING WARNING WARNING ALERT ALERT ALERT SYN Flood Mode changed by user to: Watch and proxy WAN connections when under attack SYN Flood Mode changed by user to: Watch and proxy WAN connections when under attack SYN Flood Mode changed by user to: Always proxy WAN connections SYN Flood Mode changed by user to: Always proxy WAN connections SYN Flood Mode changed by user to: Always proxy WAN connections Possible SYN flood detected on WAN IF %s switching to connection proxy mode Possible SYN flood detected on WAN IF %s switching to connection proxy mode Possible SYN flood detected on WAN IF %s switching to connection proxy mode ALERT Possible SYN Flood on IF %s ALERT Possible SYN Flood on IF %s ALERT Possible SYN Flood on IF %s ALERT ALERT ALERT SYN flood ceased or flooding machines blacklisted connection proxy disabled SYN flood ceased or flooding machines blacklisted connection proxy disabled SYN flood ceased or flooding machines blacklisted connection proxy disabled 92

95 Attack Debug Attack Attack Debug Attack Attack Debug Attack Attack Debug Attack Attack Debug Attack Attack Debug Attack Attack WARNING WARNING WARNING WARNING WARNING WARNING ALERT ALERT ALERT ALERT ALERT ALERT WARNING WARNING WARNING ALERT ALERT ALERT WARNING SYN Flood blacklisting enabled by user SYN Flood blacklisting enabled by user SYN Flood blacklisting enabled by user SYN Flood blacklisting disabled by user SYN Flood blacklisting disabled by user SYN Flood blacklisting disabled by user SYN Flooding machine %s blacklisted SYN Flooding machine %s blacklisted SYN Flooding machine %s blacklisted Machine %s removed from SYN flood blacklist Machine %s removed from SYN flood blacklist Machine %s removed from SYN flood blacklist Possible SYN Flood on IF %s continues Possible SYN Flood on IF %s continues Possible SYN Flood on IF %s continues Possible SYN Flood on IF %s has ceased Possible SYN Flood on IF %s has ceased Possible SYN Flood on IF %s has ceased SYN Flood Blacklist on IF %s continues SonicOS 5.9 / / 6.2 Log Events Reference Guide 93

96 Debug Attack Attack Debug WARNING WARNING SYN Flood Blacklist on IF %s continues SYN Flood Blacklist on IF %s continues DEBUG TCP SYN received DEBUG TCP SYN received Attack DEBUG TCP SYN received User Activity Security Services NOTICE %s User Activity Security Services NOTICE %s User Activity Security Services NOTICE %s User Activity VPN PKI ALERT CRL has expired User Activity VPN PKI ALERT CRL has expired User Activity VPN PKI ALERT CRL has expired User Activity VPN PKI ALERT Failed to find certificate User Activity VPN PKI ALERT Failed to find certificate User Activity VPN PKI ALERT Failed to find certificate User Activity VPN PKI ALERT User Activity VPN PKI ALERT User Activity VPN PKI ALERT User Activity VPN PKI ALERT User Activity VPN PKI ALERT CRL missing Issuer requires CRL checking. CRL missing Issuer requires CRL checking. CRL missing Issuer requires CRL checking. CRL validation failure for Root Certificate CRL validation failure for Root Certificate User Activity VPN PKI ALERT CRL validation failure for Root Certificate User Activity VPN PKI ALERT Cannot Validate Issuer Path User Activity VPN PKI ALERT Cannot Validate Issuer Path User Activity VPN PKI ALERT Cannot Validate Issuer Path RF Management WARNING RF Management WARNING WLAN radio frequency threat detected WLAN radio frequency threat detected 94

97 RF Management WARNING Maintenance Maintenance Dynamic Address Objects INFO Dynamic Address Objects INFO WLAN radio frequency threat detected Unable to resolve dynamic address object Unable to resolve dynamic address object Maintenance Dynamic Address Objects INFO Unable to resolve dynamic address object Firewall Logging NOTICE System clock manually updated Firewall Logging NOTICE System clock manually updated Firewall Logging NOTICE System clock manually updated TCP Network Access DEBUG TCP Network Access DEBUG TCP Network Access DEBUG TCP UDP Network Access NOTICE TCP UDP Network Access NOTICE TCP UDP Network Access NOTICE TCP Network Access NOTICE TCP Network Access NOTICE TCP Network Access NOTICE UDP Network Access NOTICE UDP Network Access NOTICE UDP Network Access NOTICE UDP Network Access NOTICE UDP Network Access NOTICE HTTP method detected; examining stream for host header HTTP method detected; examining stream for host header HTTP method detected; examining stream for host header IP Header checksum error; packet dropped IP Header checksum error; packet dropped IP Header checksum error; packet dropped TCP checksum error; packet dropped TCP checksum error; packet dropped TCP checksum error; packet dropped UDP checksum error; packet dropped UDP checksum error; packet dropped UDP checksum error; packet dropped ICMP checksum error; packet dropped ICMP checksum error; packet dropped SonicOS 5.9 / / 6.2 Log Events Reference Guide 95

98 UDP Network Access NOTICE Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG ICMP checksum error; packet dropped TCP packet received with invalid header length; TCP packet dropped TCP packet received with invalid header length; TCP packet dropped TCP packet received with invalid header length; TCP packet dropped TCP packet received on nonexistent/closed connection; TCP packet dropped TCP packet received on nonexistent/closed connection; TCP packet dropped TCP packet received on nonexistent/closed connection; TCP packet dropped TCP packet received without mandatory SYN flag; TCP packet dropped TCP packet received without mandatory SYN flag; TCP packet dropped TCP packet received without mandatory SYN flag; TCP packet dropped TCP packet received without mandatory ACK flag; TCP packet dropped TCP packet received without mandatory ACK flag; TCP packet dropped TCP packet received without mandatory ACK flag; TCP packet dropped 96

99 Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network INFO Debug Network INFO Debug Network INFO Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG TCP packet received on a closing connection; TCP packet dropped TCP packet received on a closing connection; TCP packet dropped TCP packet received on a closing connection; TCP packet dropped TCP packet received with SYN flag on an existing connection; TCP packet dropped TCP packet received with SYN flag on an existing connection; TCP packet dropped TCP packet received with SYN flag on an existing connection; TCP packet dropped TCP packet received with invalid SACK option length; TCP packet dropped TCP packet received with invalid SACK option length; TCP packet dropped TCP packet received with invalid SACK option length; TCP packet dropped TCP packet received with invalid MSS option length; TCP packet dropped TCP packet received with invalid MSS option length; TCP packet dropped TCP packet received with invalid MSS option length; TCP packet dropped TCP packet received with invalid option length; TCP packet dropped SonicOS 5.9 / / 6.2 Log Events Reference Guide 97

100 Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Attack Network INFO Debug Network INFO Attack Network INFO Attack Debug Attack Attack Debug Attack Attack Debug ALERT ALERT ALERT WARNING WARNING WARNING ALERT ALERT TCP packet received with invalid option length; TCP packet dropped TCP packet received with invalid option length; TCP packet dropped TCP packet received with invalid source port; TCP packet dropped TCP packet received with invalid source port; TCP packet dropped TCP packet received with invalid source port; TCP packet dropped TCP packet received with invalid SYN Flood cookie; TCP packet dropped TCP packet received with invalid SYN Flood cookie; TCP packet dropped TCP packet received with invalid SYN Flood cookie; TCP packet dropped RST Flooding machine %s blacklisted RST Flooding machine %s blacklisted RST Flooding machine %s blacklisted RST Flood Blacklist on IF %s continues RST Flood Blacklist on IF %s continues RST Flood Blacklist on IF %s continues Machine %s removed from RST flood blacklist Machine %s removed from RST flood blacklist 98

101 Attack Attack Debug Attack Attack Debug Attack Attack Debug Attack Attack Debug Attack Attack Debug Attack Attack Debug Attack ALERT ALERT ALERT ALERT WARNING WARNING WARNING ALERT ALERT ALERT Machine %s removed from RST flood blacklist FIN Flooding machine %s blacklisted FIN Flooding machine %s blacklisted FIN Flooding machine %s blacklisted FIN Flood Blacklist on IF %s continues FIN Flood Blacklist on IF %s continues FIN Flood Blacklist on IF %s continues Machine %s removed from FIN flood blacklist Machine %s removed from FIN flood blacklist Machine %s removed from FIN flood blacklist ALERT Possible RST Flood on IF %s ALERT Possible RST Flood on IF %s ALERT Possible RST Flood on IF %s ALERT Possible FIN Flood on IF %s ALERT Possible FIN Flood on IF %s ALERT Possible FIN Flood on IF %s ALERT ALERT ALERT Possible RST Flood on IF %s has ceased Possible RST Flood on IF %s has ceased Possible RST Flood on IF %s has ceased SonicOS 5.9 / / 6.2 Log Events Reference Guide 99

102 Attack Debug Attack Attack Debug Attack Attack Debug ALERT ALERT ALERT WARNING WARNING WARNING WARNING WARNING Possible FIN Flood on IF %s has ceased Possible FIN Flood on IF %s has ceased Possible FIN Flood on IF %s has ceased Possible RST Flood on IF %s continues Possible RST Flood on IF %s continues Possible RST Flood on IF %s continues Possible FIN Flood on IF %s continues Possible FIN Flood on IF %s continues Attack WARNING Possible FIN Flood on IF %s continues Debug Network WARNING Packet Dropped IP TTL expired Debug Network WARNING Packet Dropped IP TTL expired Debug Network WARNING Packet Dropped IP TTL expired Maintenance Maintenance Maintenance Maintenance Maintenance Maintenance Dynamic Address Objects INFO Dynamic Address Objects INFO Dynamic Address Objects INFO Dynamic Address Objects INFO Dynamic Address Objects INFO Dynamic Address Objects INFO User Activity VPN IKE WARNING User Activity VPN IKE WARNING Added host entry to dynamic address object Added host entry to dynamic address object Added host entry to dynamic address object Removed host entry from dynamic address object Removed host entry from dynamic address object Removed host entry from dynamic address object IKE Responder: Phase 1 Authentication Method does not match IKE Responder: Phase 1 Authentication Method does not match 100

103 User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING IKE Responder: Phase 1 Authentication Method does not match IKE Responder: Phase 1 encryption algorithm does not match IKE Responder: Phase 1 encryption algorithm does not match IKE Responder: Phase 1 encryption algorithm does not match IKE Responder: Phase 1 encryption algorithm keylength does not match IKE Responder: Phase 1 encryption algorithm keylength does not match IKE Responder: Phase 1 encryption algorithm keylength does not match IKE Responder: Phase 1 hash algorithm does not match IKE Responder: Phase 1 hash algorithm does not match IKE Responder: Phase 1 hash algorithm does not match IKE Responder: Phase 1 XAUTH required but Policy has no user name IKE Responder: Phase 1 XAUTH required but Policy has no user name IKE Responder: Phase 1 XAUTH required but Policy has no user name IKE Responder: Phase 1 XAUTH required but Policy has no user password IKE Responder: Phase 1 XAUTH required but Policy has no user password SonicOS 5.9 / / 6.2 Log Events Reference Guide 101

104 User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING IKE Responder: Phase 1 XAUTH required but Policy has no user password IKE Responder: Phase 1 DH Group does not match IKE Responder: Phase 1 DH Group does not match IKE Responder: Phase 1 DH Group does not match IKE Responder: AH authentication algorithm does not match IKE Responder: AH authentication algorithm does not match IKE Responder: AH authentication algorithm does not match IKE Responder: ESP encryption algorithm does not match IKE Responder: ESP encryption algorithm does not match IKE Responder: ESP encryption algorithm does not match IKE Responder: ESP authentication algorithm does not match IKE Responder: ESP authentication algorithm does not match IKE Responder: ESP authentication algorithm does not match IKE Responder: AH authentication key length does not match IKE Responder: AH authentication key length does not match IKE Responder: AH authentication key length does not match IKE Responder: ESP encryption key length does not match IKE Responder: ESP encryption key length does not match IKE Responder: ESP encryption key length does not match 102

105 User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO IKE Responder: ESP authentication key length does not match IKE Responder: ESP authentication key length does not match IKE Responder: ESP authentication key length does not match IKE Responder: AH authentication key rounds does not match IKE Responder: AH authentication key rounds does not match IKE Responder: AH authentication key rounds does not match IKE Responder: ESP encryption key rounds does not match IKE Responder: ESP encryption key rounds does not match IKE Responder: ESP encryption key rounds does not match IKE Responder: ESP authentication key rounds does not match IKE Responder: ESP authentication key rounds does not match IKE Responder: ESP authentication key rounds does not match IKE Initiator: Remote party Timeout Retransmitting IKE Request. IKE Initiator: Remote party Timeout Retransmitting IKE Request. IKE Initiator: Remote party Timeout Retransmitting IKE Request. IKE Responder: Remote party Timeout Retransmitting IKE Request. IKE Responder: Remote party Timeout Retransmitting IKE Request. SonicOS 5.9 / / 6.2 Log Events Reference Guide 103

106 User Activity VPN IKE INFO User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING IKE Responder: Remote party Timeout Retransmitting IKE Request. IKE Responder: IPsec protocol mismatch IKE Responder: IPsec protocol mismatch IKE Responder: IPsec protocol mismatch IKE Initiator: Proposed IKE ID mismatch IKE Initiator: Proposed IKE ID mismatch IKE Initiator: Proposed IKE ID mismatch IKE Responder: Peer's local network does not match VPN Policy's [Destination ] IKE Responder: Peer's local network does not match VPN Policy's [Destination ] IKE Responder: Peer's local network does not match VPN Policy's [Destination ] IKE Responder: Peer's destination network does not match VPN Policy's [Local Network] IKE Responder: Peer's destination network does not match VPN Policy's [Local Network] IKE Responder: Peer's destination network does not match VPN Policy's [Local Network] IKE Responder: Route table overrides VPN Policy IKE Responder: Route table overrides VPN Policy IKE Responder: Route table overrides VPN Policy 104

107 User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO IKE Initiator: IKE proposal does not match (Phase 1) IKE Initiator: IKE proposal does not match (Phase 1) IKE Initiator: IKE proposal does not match (Phase 1) IKEv2 Initiator: Send IKE_SA_INIT Request IKEv2 Initiator: Send IKE_SA_INIT Request IKEv2 Initiator: Send IKE_SA_INIT Request IKEv2 Responder: Received IKE_SA_INIT Request IKEv2 Responder: Received IKE_SA_INIT Request IKEv2 Responder: Received IKE_SA_INIT Request IKEv2 Initiator: Send IKE_AUTH Request IKEv2 Initiator: Send IKE_AUTH Request IKEv2 Initiator: Send IKE_AUTH Request IKEv2 Responder: Received IKE_AUTH Request IKEv2 Responder: Received IKE_AUTH Request User Activity VPN IKE INFO IKEv2 Responder: Received IKE_AUTH Request User Activity VPN IKE INFO IKEv2 Authentication successful User Activity VPN IKE INFO IKEv2 Authentication successful User Activity VPN IKE INFO IKEv2 Authentication successful User Activity VPN IKE INFO IKEv2 Accept IKE SA Proposal User Activity VPN IKE INFO IKEv2 Accept IKE SA Proposal User Activity VPN IKE INFO IKEv2 Accept IKE SA Proposal User Activity VPN IKE INFO IKEv2 Accept IPsec SA Proposal User Activity VPN IKE INFO IKEv2 Accept IPsec SA Proposal User Activity VPN IKE INFO IKEv2 Accept IPsec SA Proposal SonicOS 5.9 / / 6.2 Log Events Reference Guide 105

108 User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO IKEv2 Initiator: Send CREATE_CHILD_SA Request IKEv2 Initiator: Send CREATE_CHILD_SA Request IKEv2 Initiator: Send CREATE_CHILD_SA Request IKEv2 Responder: Received CREATE_CHILD_SA Request IKEv2 Responder: Received CREATE_CHILD_SA Request IKEv2 Responder: Received CREATE_CHILD_SA Request IKEv2 Send delete IKE SA Request IKEv2 Send delete IKE SA Request IKEv2 Send delete IKE SA Request IKEv2 Received delete IKE SA Request IKEv2 Received delete IKE SA Request IKEv2 Received delete IKE SA Request IKEv2 Send delete IPsec SA Request IKEv2 Send delete IPsec SA Request IKEv2 Send delete IPsec SA Request IKEv2 Received delete IPsec SA Request IKEv2 Received delete IPsec SA Request IKEv2 Received delete IPsec SA Request IKEv2 Responder: Peer's destination network does not match VPN Policy's [Local Network] 106

109 User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO IKEv2 Responder: Peer's destination network does not match VPN Policy's [Local Network] IKEv2 Responder: Peer's destination network does not match VPN Policy's [Local Network] IKEv2 Responder: Peer's local network does not match VPN Policy's [Destination Network] IKEv2 Responder: Peer's local network does not match VPN Policy's [Destination Network] User Activity VPN IKE INFO IKEv2 Responder: Peer's local network does not match VPN Policy's [Destination Network] User Activity VPN IKE WARNING IKEv2 Payload processing error User Activity VPN IKE WARNING IKEv2 Payload processing error User Activity VPN IKE WARNING IKEv2 Payload processing error User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING IKEv2 Initiator: Negotiations failed. Extra payloads present. IKEv2 Initiator: Negotiations failed. Extra payloads present. IKEv2 Initiator: Negotiations failed. Extra payloads present. IKEv2 Initiator: Negotiations failed. Missing required payloads. IKEv2 Initiator: Negotiations failed. Missing required payloads. IKEv2 Initiator: Negotiations failed. Missing required payloads. IKEv2 Initiator: Negotiations failed. Invalid input state. IKEv2 Initiator: Negotiations failed. Invalid input state. IKEv2 Initiator: Negotiations failed. Invalid input state. SonicOS 5.9 / / 6.2 Log Events Reference Guide 107

110 User Activity VPN IKE WARNING User Activity VPN IKE WARNING IKEv2 Initiator: Negotiations failed. Invalid output state. IKEv2 Initiator: Negotiations failed. Invalid output state User Activity VPN IKE WARNING IKEv2 Initiator: Negotiations failed. Invalid output state User Activity VPN IKE WARNING IKEv2 Payload validation failed User Activity VPN IKE WARNING IKEv2 Payload validation failed User Activity VPN IKE WARNING IKEv2 Payload validation failed User Activity VPN IKE WARNING IKEv2 Unable to find IKE SA User Activity VPN IKE WARNING IKEv2 Unable to find IKE SA User Activity VPN IKE WARNING IKEv2 Unable to find IKE SA User Activity VPN IKE WARNING IKEv2 Decrypt packet failed User Activity VPN IKE WARNING IKEv2 Decrypt packet failed User Activity VPN IKE WARNING IKEv2 Decrypt packet failed User Activity VPN IKE WARNING IKEv2 Out of memory User Activity VPN IKE WARNING IKEv2 Out of memory User Activity VPN IKE WARNING IKEv2 Out of memory User Activity VPN IKE ERROR User Activity VPN IKE ERROR User Activity VPN IKE ERROR User Activity VPN IKE WARNING User Activity VPN IKE WARNING IKEv2 Responder: Policy for remote IKE ID not found IKEv2 Responder: Policy for remote IKE ID not found IKEv2 Responder: Policy for remote IKE ID not found IKEv2 Process Message queue failed IKEv2 Process Message queue failed User Activity VPN IKE WARNING IKEv2 Process Message queue failed User Activity VPN IKE WARNING IKEv2 Invalid state User Activity VPN IKE WARNING IKEv2 Invalid state User Activity VPN IKE WARNING IKEv2 Invalid state System Error VPN IKE ERROR IKE Responder: Client Policy has no VPN Access Networks assigned. Check Configuration. 108

111 System Error VPN IKE ERROR IKE Responder: Client Policy has no VPN Access Networks assigned. Check Configuration System Error VPN IKE ERROR IKE Responder: Client Policy has no VPN Access Networks assigned. Check Configuration User Activity VPN IKE WARNING IKEv2 Invalid SPI size User Activity VPN IKE WARNING IKEv2 Invalid SPI size User Activity VPN IKE WARNING IKEv2 Invalid SPI size User Activity VPN IKE WARNING IKEv2 VPN Policy not found User Activity VPN IKE WARNING IKEv2 VPN Policy not found User Activity VPN IKE WARNING IKEv2 VPN Policy not found User Activity VPN IKE WARNING User Activity VPN IKE WARNING IKEv2 IPsec proposal does not match IKEv2 IPsec proposal does not match User Activity VPN IKE WARNING IKEv2 IPsec proposal does not match User Activity VPN IKE WARNING IKEv2 IPsec attribute not found User Activity VPN IKE WARNING IKEv2 IPsec attribute not found User Activity VPN IKE WARNING IKEv2 IPsec attribute not found User Activity VPN IKE WARNING IKEv2 IKE attribute not found User Activity VPN IKE WARNING IKEv2 IKE attribute not found User Activity VPN IKE WARNING IKEv2 IKE attribute not found User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO IKEv2 Peer is not responding. Negotiation aborted. IKEv2 Peer is not responding. Negotiation aborted. IKEv2 Peer is not responding. Negotiation aborted. IKEv2 Initiator: Remote party Timeout Retransmitting IKEv2 Request. IKEv2 Initiator: Remote party Timeout Retransmitting IKEv2 Request. IKEv2 Initiator: Remote party Timeout Retransmitting IKEv2 Request. SonicOS 5.9 / / 6.2 Log Events Reference Guide 109

112 User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO IKEv2 Initiator: Received IKE_SA_INT response IKEv2 Initiator: Received IKE_SA_INT response IKEv2 Initiator: Received IKE_SA_INT response IKEv2 Initiator: Received IKE_AUTH response IKEv2 Initiator: Received IKE_AUTH response IKEv2 Initiator: Received IKE_AUTH response IKEv2 Initiator: Received CREATE_CHILD_SA response IKEv2 Initiator: Received CREATE_CHILD_SA response IKEv2 Initiator: Received CREATE_CHILD_SA response IKEv2 Responder: Send IKE_SA_INIT response IKEv2 Responder: Send IKE_SA_INIT response IKEv2 Responder: Send IKE_SA_INIT response IKEv2 Responder: Send IKE_AUTH response IKEv2 Responder: Send IKE_AUTH response User Activity VPN IKE INFO IKEv2 Responder: Send IKE_AUTH response User Activity VPN IKE INFO IKEv2 negotiation complete User Activity VPN IKE INFO IKEv2 negotiation complete User Activity VPN IKE INFO IKEv2 negotiation complete User Activity VPN IKE ERROR User Activity VPN IKE ERROR User Activity VPN IKE ERROR IKEv2 Function sendto() failed to transmit packet. IKEv2 Function sendto() failed to transmit packet. IKEv2 Function sendto() failed to transmit packet. 110

113 User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity IKEv2 Initiator: Proposed IKE ID mismatch IKEv2 Initiator: Proposed IKE ID mismatch IKEv2 Initiator: Proposed IKE ID mismatch IKEv2 IKE proposal does not match IKEv2 IKE proposal does not match IKEv2 IKE proposal does not match IKEv2 Received notify status payload IKEv2 Received notify status payload IKEv2 Received notify status payload IKEv2 Received notify error payload IKEv2 Received notify error payload IKEv2 Received notify error payload IKEv2 No NAT device detected between negotiating peers IKEv2 No NAT device detected between negotiating peers IKEv2 No NAT device detected between negotiating peers IKEv2 NAT device detected between negotiating peers IKEv2 NAT device detected between negotiating peers IKEv2 NAT device detected between negotiating peers User login denied not allowed by Policy rule SonicOS 5.9 / / 6.2 Log Events Reference Guide 111

114 User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING User Activity CIA WARNING User Activity CIA WARNING User login denied not allowed by Policy rule User login denied not allowed by Policy rule User login denied not found locally User login denied not found locally User login denied not found locally User login denied SSO agent Timeout User login denied SSO agent Timeout User login denied SSO agent Timeout User login denied SSO agent configuration error User login denied SSO agent configuration error User login denied SSO agent configuration error User login denied SSO agent communication problem User login denied SSO agent communication problem User login denied SSO agent communication problem User login denied SSO agent name resolution failed User login denied SSO agent name resolution failed User login denied SSO agent name resolution failed SSO agent returned user name too long SSO agent returned user name too long 112

115 User Activity CIA WARNING User Activity CIA WARNING User Activity CIA WARNING User Activity CIA WARNING User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity SSO agent returned user name too long SSO agent returned domain name too long SSO agent returned domain name too long SSO agent returned domain name too long Configuration mode administration session started Configuration mode administration session started Configuration mode administration session started Configuration mode administration session ended Configuration mode administration session ended Configuration mode administration session ended Read only mode GUI administration session started Read only mode GUI administration session started Read only mode GUI administration session started Non config mode GUI administration session started Non config mode GUI administration session started Non config mode GUI administration session started GUI administration session ended GUI administration session ended GUI administration session ended SonicOS 5.9 / / 6.2 Log Events Reference Guide 113

116 Blocked Sites Network Blocked Sites Network Blocked Sites Network Blocked Sites Network Blocked Sites Network SSL Control: Website found in blacklist SSL Control: Website found in blacklist SSL Control: Website found in blacklist SSL Control: Website found in whitelist SSL Control: Website found in whitelist Blocked Sites Network SSL Control: Website found in whitelist Blocked Sites Network SSL Control: HTTPS via SSL Blocked Sites Network SSL Control: HTTPS via SSL Blocked Sites Network SSL Control: HTTPS via SSL Blocked Sites Network Blocked Sites Network Blocked Sites Network Blocked Sites Network Blocked Sites Network Blocked Sites Network Blocked Sites Network Blocked Sites Network SSL Control: Certificate with invalid date SSL Control: Certificate with invalid date SSL Control: Certificate with invalid date SSL Control: Self signed certificate SSL Control: Self signed certificate SSL Control: Self signed certificate SSL Control: Weak cipher being used SSL Control: Weak cipher being used Blocked Sites Network SSL Control: Weak cipher being used Blocked Sites Network SSL Control: Untrusted CA Blocked Sites Network SSL Control: Untrusted CA Blocked Sites Network SSL Control: Untrusted CA Blocked Sites Network SSL Control: Certificate chain not complete 114

117 Blocked Sites Network Blocked Sites Network Blocked Sites Network Blocked Sites Network Blocked Sites Network User Activity User Activity SSL Control: Certificate chain not complete SSL Control: Certificate chain not complete SSL Control: Failed to decode Server Hello SSL Control: Failed to decode Server Hello SSL Control: Failed to decode Server Hello User logged out logout detected by SSO User logged out logout detected by SSO User Activity User logged out logout detected by SSO System Error RADIUS ERROR Bind to LDAP server failed System Error RADIUS ERROR Bind to LDAP server failed System Error RADIUS ERROR Bind to LDAP server failed System Error RADIUS ALERT System Error RADIUS ALERT System Error RADIUS ALERT System Error RADIUS WARNING System Error RADIUS WARNING System Error RADIUS WARNING User Activity VPN IKE INFO Using LDAP without TLS highly insecure Using LDAP without TLS highly insecure Using LDAP without TLS highly insecure LDAP using non administrative account VPN client user will not be able to change passwords LDAP using non administrative account VPN client user will not be able to change passwords LDAP using non administrative account VPN client user will not be able to change passwords IKEv2 Responder: Send CREATE_CHILD_SA response SonicOS 5.9 / / 6.2 Log Events Reference Guide 115

118 User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO IKEv2 Responder: Send CREATE_CHILD_SA response IKEv2 Responder: Send CREATE_CHILD_SA response IKEv2 Send delete IKE SA response IKEv2 Send delete IKE SA response IKEv2 Send delete IKE SA response IKEv2 Send delete IPsec SA response IKEv2 Send delete IPsec SA response IKEv2 Send delete IPsec SA response IKEv2 Received delete IKE SA response IKEv2 Received delete IKE SA response IKEv2 Received delete IKE SA response IKEv2 Received delete IPsec SA response IKEv2 Received delete IPsec SA response IKEv2 Received delete IPsec SA response System Environment Firewall Hardware INFO 3G/4G %s device detected System Environment Firewall Hardware INFO 3G/4G %s device detected System Environment Firewall Hardware INFO 3G/4G %s device detected PPP INFO PPP message: %s PPP INFO PPP message: %s PPP INFO PPP message: %s User Activity PPP Dial Up INFO Chat started User Activity PPP Dial Up INFO Chat started 116

119 User Activity PPP Dial Up INFO Chat started User Activity PPP Dial Up INFO Chat completed User Activity PPP Dial Up INFO Chat completed User Activity PPP Dial Up INFO Chat completed User Activity PPP Dial Up INFO Chat wrote '%s' User Activity PPP Dial Up INFO Chat wrote '%s' User Activity PPP Dial Up INFO Chat wrote '%s' User Activity PPP Dial Up INFO Chat %s User Activity PPP Dial Up INFO Chat %s User Activity PPP Dial Up INFO Chat %s User Activity PPP Dial Up INFO Chat failed: %s User Activity PPP Dial Up INFO Chat failed: %s User Activity PPP Dial Up INFO Chat failed: %s System Error PPP Dial Up ERROR System Error PPP Dial Up ERROR Unable to send message to dialup task Unable to send message to dialup task System Error PPP Dial Up ERROR Unable to send message to dialup task User Activity PPP Dial Up ALERT 3G/4G Dial up: %s User Activity PPP Dial Up ALERT 3G/4G Dial up: %s User Activity PPP Dial Up ALERT 3G/4G Dial up: %s User Activity PPP Dial Up ALERT User Activity PPP Dial Up ALERT User Activity PPP Dial Up ALERT System Error PPP Dial Up ALERT 3G/4G Dial up: data usage limit reached for the '%s' billing cycle. Disconnecting the session. 3G/4G Dial up: data usage limit reached for the '%s' billing cycle. Disconnecting the session. 3G/4G Dial up: data usage limit reached for the '%s' billing cycle. Disconnecting the session. %s auto dial failed: Current Connection Model is configured as Ethernet Only SonicOS 5.9 / / 6.2 Log Events Reference Guide 117

120 System Error PPP Dial Up ALERT System Error PPP Dial Up ALERT Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG Debug Network DEBUG User Activity User Activity User Activity Access WARNING Access WARNING Access WARNING %s auto dial failed: Current Connection Model is configured as Ethernet Only %s auto dial failed: Current Connection Model is configured as Ethernet Only TCP packet received with nonpermitted option; TCP packet dropped TCP packet received with nonpermitted option; TCP packet dropped TCP packet received with nonpermitted option; TCP packet dropped TCP packet received with invalid Window Scale option length; TCP packet dropped TCP packet received with invalid Window Scale option length; TCP packet dropped TCP packet received with invalid Window Scale option length; TCP packet dropped TCP packet received with invalid Window Scale option value; TCP packet dropped TCP packet received with invalid Window Scale option value; TCP packet dropped TCP packet received with invalid Window Scale option value; TCP packet dropped Problem occurred during user group membership retrieval Problem occurred during user group membership retrieval Problem occurred during user group membership retrieval 118

121 User Activity User Activity User Activity User Activity VPN IKE ERROR User Activity VPN IKE ERROR User login denied password expired User login denied password expired User login denied password expired IKE Responder: IKE Phase 1 exchange does not match IKE Responder: IKE Phase 1 exchange does not match User Activity VPN IKE ERROR IKE Responder: IKE Phase 1 exchange does not match PPP Dial Up INFO PPP Dial Up: Starting PPP PPP Dial Up INFO PPP Dial Up: Starting PPP PPP Dial Up INFO PPP Dial Up: Starting PPP PPP Dial Up INFO PPP Dial Up INFO PPP Dial Up INFO PPP Dial Up INFO PPP Dial Up INFO PPP Dial Up INFO DHCP Server ALERT DHCP Server ALERT DHCP Server ALERT DHCP Server ALERT DHCP Server ALERT DHCP Server ALERT Dial up: Traffic generated by '%s' Dial up: Traffic generated by '%s' Dial up: Traffic generated by '%s' Dial up: Session initiated by data packet Dial up: Session initiated by data packet Dial up: Session initiated by data packet DHCP Server: IP conflict detected DHCP Server: IP conflict detected DHCP Server: IP conflict detected DHCP Server: Received DHCP decline from client DHCP Server: Received DHCP decline from client DHCP Server: Received DHCP decline from client SonicOS 5.9 / / 6.2 Log Events Reference Guide 119

122 Firewall Hardware ERROR Firewall Hardware ERROR 5425 Power supply without redundancy Power supply without redundancy Firewall Hardware ERROR 5425 Power supply without redundancy High Availability INFO Discovered HA %s Firewall High Availability INFO Discovered HA %s Firewall High Availability INFO Discovered HA %s Firewall Firewall Event INFO Firewall Event INFO Firewall Event INFO Firewall Event INFO Firewall Event INFO Firewall Event INFO Firewall Event INFO Firewall Event INFO Firewall Event INFO Diagnostic Auto restart scheduled for %s minutes from now Diagnostic Auto restart scheduled for %s minutes from now Diagnostic Auto restart scheduled for %s minutes from now Diagnostic Auto restart canceled Diagnostic Auto restart canceled Diagnostic Auto restart canceled As per Diagnostic Auto restart configuration Request, restarting system As per Diagnostic Auto restart configuration Request, restarting system As per Diagnostic Auto restart configuration Request, restarting system User login denied password doesn't meet constraints User login denied password doesn't meet constraints User login denied password doesn't meet constraints User Activity VPN INFO VPN policy %s is added VPN INFO VPN Policy Added User Activity VPN INFO VPN policy %s is added 120

123 User Activity VPN INFO VPN policy %s is deleted VPN INFO VPN Policy Deleted User Activity VPN INFO VPN policy %s is deleted User Activity VPN INFO VPN policy %s is modified VPN INFO VPN Policy Modified User Activity VPN INFO VPN policy %s is modified Firewall Hardware ALERT 5418 PC Card removed Firewall Hardware ALERT 5418 PC Card removed Firewall Hardware ALERT 5418 PC Card removed Firewall Hardware ALERT 5419 PC Card inserted Firewall Hardware ALERT 5419 PC Card inserted Firewall Hardware ALERT 5419 PC Card inserted Firewall Hardware ALERT 3G/4G: No SIM detected Firewall Hardware ALERT 3G/4G: No SIM detected Firewall Hardware ALERT 3G/4G: No SIM detected High Availability INFO Peer firewall rebooting (%s) High Availability INFO Peer firewall rebooting (%s) High Availability INFO Peer firewall rebooting (%s) High Availability INFO High Availability INFO High Availability INFO High Availability INFO High Availability INFO High Availability INFO Primary firewall rebooting itself as it transitioned from Active to Standby while Preempt Primary firewall rebooting itself as it transitioned from Active to Standby while Preempt Primary firewall rebooting itself as it transitioned from Active to Standby while Preempt Secondary firewall rebooting itself as it transitioned from Active to Standby while Preempt Secondary firewall rebooting itself as it transitioned from Active to Standby while Preempt Secondary firewall rebooting itself as it transitioned from Active to Standby while Preempt SonicOS 5.9 / / 6.2 Log Events Reference Guide 121

124 Crypto Test ERROR Crypto Test ERROR Crypto Test ERROR Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO Maintenance Firewall Event INFO DHCP Server WARNING DHCP Server WARNING DHCP Server WARNING Firewall Event INFO Firewall Event INFO Firewall Event INFO Firewall Event CRITICAL Firewall Event CRITICAL Firewall Event CRITICAL Firewall Event CRITICAL Crypto SHA1 based DRNG KAT test failed Crypto SHA1 based DRNG KAT test failed Crypto SHA1 based DRNG KAT test failed Successfully sent %s file to remote backup server Successfully sent %s file to remote backup server Successfully sent %s file to remote backup server Failed to send file to remote backup server, Error: %s Failed to send file to remote backup server, Error: %s Failed to send file to remote backup server, Error: %s Multiple DHCP Servers are detected on network Multiple DHCP Servers are detected on network Multiple DHCP Servers are detected on network Invalid DNS Server will not be accepted by the dynamic client Invalid DNS Server will not be accepted by the dynamic client Invalid DNS Server will not be accepted by the dynamic client DHCP Server sanity check passed %s DHCP Server sanity check passed %s DHCP Server sanity check passed %s DHCP Server sanity check failed %s 122

125 Firewall Event CRITICAL DHCP Server sanity check failed %s Firewall Event CRITICAL DHCP Server sanity check failed %s User Activity CIA WARNING SSO agent returned error User Activity CIA WARNING SSO agent returned error User Activity CIA WARNING SSO agent returned error L2TP Client INFO L2TP Tunnel Negotiation %s L2TP Client INFO L2TP Tunnel Negotiation %s L2TP Client INFO L2TP Tunnel Negotiation %s User Activity CIA ALERT SSO agent is down User Activity CIA ALERT SSO agent is down User Activity CIA ALERT SSO agent is down User Activity CIA ALERT SSO agent is up User Activity CIA ALERT SSO agent is up User Activity CIA ALERT SSO agent is up SonicPoint N INFO SonicPoint N Status SonicPoint N INFO SonicPoint N Status SonicPoint N INFO SonicPoint N Status SonicPoint N INFO SonicPoint N Provision SonicPoint N INFO SonicPoint N Provision SonicPoint N INFO SonicPoint N Provision SSL VPN INFO %s SSL VPN INFO %s SSL VPN INFO %s Blocked Sites Network Blocked Sites Network SSL VPN zone remote user login allowed SSL VPN zone remote user login allowed SSL VPN zone remote user login allowed SSL Control: Certificate with MD5 Digest Signature Algorithm SSL Control: Certificate with MD5 Digest Signature Algorithm SonicOS 5.9 / / 6.2 Log Events Reference Guide 123

126 Blocked Sites Network SSL Control: Certificate with MD5 Digest Signature Algorithm Anti Spam WARNING %s is operational Anti Spam WARNING %s is operational Anti Spam WARNING %s is operational Anti Spam WARNING %s is unavailable Anti Spam WARNING %s is unavailable Anti Spam WARNING %s is unavailable Anti Spam INFO Anti Spam INFO Anti Spam INFO Anti Spam INFO Anti Spam INFO Anti Spam INFO Anti Spam WARNING Anti Spam WARNING Anti Spam WARNING Anti Spam WARNING Anti Spam WARNING Anti Spam service is enabled by administrator. Anti Spam service is enabled by administrator. Anti Spam service is enabled by administrator. Anti Spam service is disabled by administrator. Anti Spam service is disabled by administrator. Anti Spam service is disabled by administrator. Your Anti Spam Service subscription has expired. Your Anti Spam Service subscription has expired. Your Anti Spam Service subscription has expired. SMTP connection limit is reached. Connection is dropped. SMTP connection limit is reached. Connection is dropped Anti Spam WARNING SMTP connection limit is reached. Connection is dropped Anti Spam WARNING Anti Spam Startup Failure %s Anti Spam WARNING Anti Spam Startup Failure %s Anti Spam WARNING Anti Spam Startup Failure %s 124

127 Anti Spam WARNING Anti Spam WARNING Anti Spam WARNING DHCP Server NOTICE DHCP Server NOTICE DHCP Server NOTICE Anti Spam NOTICE Anti Spam NOTICE Anti Spam NOTICE Anti Spam NOTICE Anti Spam NOTICE Anti Spam NOTICE Anti Spam NOTICE Anti Spam NOTICE Anti Spam NOTICE Anti Spam ERROR Anti Spam ERROR Anti Spam ERROR Anti Spam Teardown Failure %s Anti Spam Teardown Failure %s Anti Spam Teardown Failure %s DHCP Server: Received DHCP message from untrusted relay agent DHCP Server: Received DHCP message from untrusted relay agent DHCP Server: Received DHCP message from untrusted relay agent Outbound connection to GRIDlisted SMTP server dropped Outbound connection to GRIDlisted SMTP server dropped Outbound connection to GRIDlisted SMTP server dropped Inbound connection from GRIDlisted SMTP server dropped Inbound connection from GRIDlisted SMTP server dropped Inbound connection from GRIDlisted SMTP server dropped SMTP server found on Reject List SMTP server found on Reject List SMTP server found on Reject List No valid DNS server specified for GRID lookups No valid DNS server specified for GRID lookups No valid DNS server specified for GRID lookups SonicOS 5.9 / / 6.2 Log Events Reference Guide 125

128 Anti Spam INFO Anti Spam INFO Unprocessed E mail received from MTA on Inbound SMTP port Unprocessed E mail received from MTA on Inbound SMTP port Anti Spam INFO Unprocessed E mail received from MTA on Inbound SMTP port VPN PKI NOTICE SCEP Client: %s VPN PKI NOTICE SCEP Client: %s VPN PKI NOTICE SCEP Client: %s ALERT 6465 ALERT 6465 ALERT 6465 Possible DNS rebind attack detected Possible DNS rebind attack detected Possible DNS rebind attack detected ALERT 6466 DNS rebind attack blocked ALERT 6466 DNS rebind attack blocked ALERT 6466 DNS rebind attack blocked Network Monitor ALERT Network Monitor ALERT Network Monitor ALERT Network Monitor ALERT Network Monitor ALERT Network Monitor ALERT Network Monitor ALERT Network Monitor: Policy %s status is UP Network Monitor: Policy %s status is UP Network Monitor: Policy %s status is UP Network Monitor: Policy %s status is DOWN Network Monitor: Policy %s status is DOWN Network Monitor: Policy %s status is DOWN Network Monitor: Policy %s status is UNKNOWN 126

129 Network Monitor ALERT Network Monitor ALERT Network Monitor ALERT Network Monitor ALERT Network Monitor ALERT Network Monitor INFO Network Monitor INFO Network Monitor INFO Network Monitor INFO Network Monitor INFO Network Monitor INFO Network Monitor INFO Network Monitor INFO Network Monitor: Policy %s status is UNKNOWN Network Monitor: Policy %s status is UNKNOWN Network Monitor: Host %s status is UNKNOWN Network Monitor: Host %s status is UNKNOWN Network Monitor: Host %s status is UNKNOWN Network Monitor Policy %s Added Network Monitor Policy %s Added Network Monitor Policy %s Added Network Monitor Policy %s Deleted Network Monitor Policy %s Deleted Network Monitor Policy %s Deleted Network Monitor Policy %s Modified Network Monitor Policy %s Modified Network Monitor INFO Network Monitor Policy %s Modified System Error Firewall Event ALERT %s System Error Firewall Event ALERT %s System Error Firewall Event ALERT %s Anti Spam INFO Anti Spam INFO Message blocked by Real Time E mail Scanner Message blocked by Real Time E mail Scanner Anti Spam INFO Message blocked by Real Time E mail Scanner VPN PKI INFO CSR Generation: %s VPN PKI INFO CSR Generation: %s SonicOS 5.9 / / 6.2 Log Events Reference Guide 127

130 VPN PKI INFO CSR Generation: %s DHCP Server INFO Assigned IP address %s DHCP Server INFO Assigned IP address %s DHCP Server INFO Assigned IP address %s DHCP Server INFO Released IP address %s DHCP Server INFO Released IP address %s DHCP Server INFO Released IP address %s FTP DEBUG FTP DEBUG FTP server accepted the connection FTP server accepted the connection FTP DEBUG FTP server accepted the connection FTP DEBUG FTP client user name was sent FTP DEBUG FTP client user name was sent FTP DEBUG FTP client user name was sent FTP DEBUG FTP DEBUG FTP client user logged in successfully FTP client user logged in successfully FTP DEBUG FTP client user logged in successfully FTP DEBUG FTP client user logged in failed FTP DEBUG FTP client user logged in failed FTP DEBUG FTP client user logged in failed FTP DEBUG FTP client user logged out FTP DEBUG FTP client user logged out FTP DEBUG FTP client user logged out User Activity User Activity User Activity User Activity Access WARNING Access WARNING Access WARNING User login denied SSO probe failed User login denied SSO probe failed User login denied SSO probe failed User login denied Mail Address(From/to) or SMTP Server is not configured 128

131 User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING User login denied Mail Address(From/to) or SMTP Server is not configured User login denied Mail Address(From/to) or SMTP Server is not configured RADIUS user cannot use One Time Password no mail address set for equivalent local user RADIUS user cannot use One Time Password no mail address set for equivalent local user RADIUS user cannot use One Time Password no mail address set for equivalent local user User login denied Terminal Services agent Timeout User login denied Terminal Services agent Timeout User login denied Terminal Services agent Timeout User login denied Terminal Services agent name resolution failed User login denied Terminal Services agent name resolution failed User login denied Terminal Services agent name resolution failed User login denied No name received from Terminal Services agent User login denied No name received from Terminal Services agent SonicOS 5.9 / / 6.2 Log Events Reference Guide 129

132 User Activity User Activity User Activity User Activity User Activity User Activity User Activity Access WARNING Access WARNING Access WARNING Access WARNING User Activity High Availability INFO High Availability INFO User Activity High Availability INFO User Activity High Availability ERROR High Availability ERROR User login denied No name received from Terminal Services agent User login denied Terminal Services agent communication problem User login denied Terminal Services agent communication problem User login denied Terminal Services agent communication problem User logged out logout reported by Terminal Services agent User logged out logout reported by Terminal Services agent User logged out logout reported by Terminal Services agent High Availability has been enabled, Dial Up device(s) are not supported in High Availability processing. High Availability has been enabled, Dial Up device(s) are not supported in High Availability processing. High Availability has been enabled, Dial Up device(s) are not supported in High Availability processing. The High Availability monitoring IP configuration of Interface %s is incorrect. The High Availability monitoring IP configuration of Interface %s is incorrect. 130

133 User Activity High Availability ERROR User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING The High Availability monitoring IP configuration of Interface %s is incorrect. IKE Responder: ESP mode mismatch Local Tunnel Remote Transport IKE Responder: ESP mode mismatch Local Tunnel Remote Transport IKE Responder: ESP mode mismatch Local Tunnel Remote Transport IKE Responder: ESP mode mismatch Local Transport Remote Tunnel IKE Responder: ESP mode mismatch Local Transport Remote Tunnel User Activity VPN IKE WARNING IKE Responder: ESP mode mismatch Local Transport Remote Tunnel Anti Spam DEBUG Probe Response Success %s Anti Spam DEBUG Probe Response Success %s Anti Spam DEBUG Probe Response Success %s Anti Spam DEBUG Probe Response Failure %s Anti Spam DEBUG Probe Response Failure %s Anti Spam DEBUG Probe Response Failure %s PPPoE INFO %s PPPoE INFO %s PPPoE INFO %s Maintenance PPTP INFO %s Maintenance PPTP INFO %s Maintenance PPTP INFO %s Maintenance L2TP Client INFO %s Maintenance L2TP Client INFO %s Maintenance L2TP Client INFO %s Received unauthenticated GRID Anti Spam DEBUG response SonicOS 5.9 / / 6.2 Log Events Reference Guide 131

134 Anti Spam DEBUG Anti Spam DEBUG Anti Spam DEBUG Anti Spam DEBUG Anti Spam DEBUG Anti Spam DEBUG Anti Spam DEBUG Received unauthenticated GRID response Received unauthenticated GRID response Invalid key or serial number used for GRID response Invalid key or serial number used for GRID response Invalid key or serial number used for GRID response Invalid key version used for GRID response Invalid key version used for GRID response Anti Spam DEBUG Invalid key version used for GRID response Anti Spam DEBUG Host IP address not in GRID List Anti Spam DEBUG Host IP address not in GRID List Anti Spam DEBUG Host IP address not in GRID List Anti Spam DEBUG Anti Spam DEBUG Anti Spam DEBUG Anti Spam DEBUG Anti Spam DEBUG No response received from DNS server No response received from DNS server No response received from DNS server Not blacklisted as per configuration Not blacklisted as per configuration Anti Spam DEBUG Not blacklisted as per configuration Anti Spam DEBUG Default to not blacklisted Anti Spam DEBUG Default to not blacklisted Anti Spam DEBUG Default to not blacklisted Anti Spam DEBUG Anti Spam DEBUG Failed to insert entry into GRID result IP cached table Failed to insert entry into GRID result IP cached table 132

135 Anti Spam DEBUG Failed to insert entry into GRID result IP cached table Anti Spam DEBUG Resolved ES Cloud %s Anti Spam DEBUG Resolved ES Cloud %s Anti Spam DEBUG Resolved ES Cloud %s Anti Spam DEBUG Updated ES Cloud Address %s Anti Spam DEBUG Updated ES Cloud Address %s Anti Spam DEBUG Updated ES Cloud Address %s Advanced Switching Advanced Switching Advanced Switching INFO %s Advanced Switching INFO %s Advanced Switching INFO %s High Availability WARNING High Availability WARNING Your Active/Active Clustering subscription has expired. Your Active/Active Clustering subscription has expired High Availability WARNING Your Active/Active Clustering subscription has expired User Activity CIA ALERT Terminal Services agent is down User Activity CIA ALERT Terminal Services agent is down User Activity CIA ALERT Terminal Services agent is down User Activity CIA ALERT Terminal Services agent is up User Activity CIA ALERT Terminal Services agent is up User Activity CIA ALERT Terminal Services agent is up High Availability ERROR High Availability ERROR High Availability ERROR Active/Active Clustering license is not activated on the following cluster units: %s Active/Active Clustering license is not activated on the following cluster units: %s Active/Active Clustering license is not activated on the following cluster units: %s Connection Traffic SSL VPN INFO SSL VPN Traffic Connection Traffic SSL VPN INFO SSL VPN Traffic SonicOS 5.9 / / 6.2 Log Events Reference Guide 133

136 Connection Traffic SSL VPN INFO SSL VPN Traffic Application Control Detection ALERT Application Control Detection ALERT Application Control Detection ALERT Application Control Detection ALERT Application Control Detection ALERT Application Control Detection ALERT Firewall Event ERROR Firewall Event ERROR Firewall Event ERROR User Activity User Activity User Activity User Activity User Activity User Activity Security Services WARNING Security Services WARNING Application Control Detection Alert: %s Application Control Detection Alert: %s Application Control Detection Alert: %s Application Control Prevention Alert: %s Application Control Prevention Alert: %s Application Control Prevention Alert: %s Name Resolution for Syslog or GMS failed. Name Resolution for Syslog or GMS failed. Name Resolution for Syslog or GMS failed. User account '%s' expired and disabled User account '%s' expired and disabled User account '%s' expired and disabled User account '%s' expired and pruned User account '%s' expired and pruned User account '%s' expired and pruned Received Alert: Your Visualization Control subscription has expired. Received Alert: Your Visualization Control subscription has expired. 134

137 Security Services WARNING Maintenance Firewall Event DEBUG Maintenance Firewall Event DEBUG Maintenance Firewall Event DEBUG Maintenance Firewall Event DEBUG Maintenance Firewall Event DEBUG Maintenance Firewall Event DEBUG System Error High Availability ALERT System Error High Availability ALERT 664 Received Alert: Your Visualization Control subscription has expired. Attempt to contact Remote backup server for upload approval failed Attempt to contact Remote backup server for upload approval failed Attempt to contact Remote backup server for upload approval failed Backup remote server did not approve upload Request Backup remote server did not approve upload Request Backup remote server did not approve upload Request Modules attached to HA units do not match: %s Modules attached to HA units do not match: %s System Error High Availability ALERT 664 Modules attached to HA units do not match: %s E1/T1 Status INFO E1_T1 Layer 1 status: No signal None INFO E1_T1 Layer 1 status: No signal E1/T1 Status INFO E1_T1 Layer 1 status: No signal E1/T1 Status INFO None INFO E1/T1 Status INFO E1/T1 Status INFO None INFO E1/T1 Status INFO E1_T1 Layer 1 status: No frame synchronization E1_T1 Layer 1 status: No frame synchronization E1_T1 Layer 1 status: No frame synchronization E1_T1 Layer 1 status: No multiframe synchronization E1_T1 Layer 1 status: No multiframe synchronization E1_T1 Layer 1 status: No multiframe synchronization SonicOS 5.9 / / 6.2 Log Events Reference Guide 135

138 E1/T1 Status INFO None INFO E1/T1 Status INFO E1/T1 Status INFO None INFO E1_T1 Layer 1 status: Remote alarm detected E1_T1 Layer 1 status: Remote alarm detected E1_T1 Layer 1 status: Remote alarm detected E1_T1 Layer 1 status: Controlled slip E1_T1 Layer 1 status: Controlled slip E1/T1 Status INFO E1_T1 Layer 1 status: Controlled slip E1/T1 Status INFO E1_T1 Layer 1 status: OK None INFO E1_T1 Layer 1 status: OK E1/T1 Status INFO E1_T1 Layer 1 status: OK Bandwidth Optimization INFO Unused DEBUG Bandwidth Optimization INFO Bandwidth Optimization ALERT Unused DEBUG Bandwidth Optimization ALERT Bandwidth Optimization ALERT Unused DEBUG Bandwidth Optimization ALERT Bandwidth Optimization ALERT Unused DEBUG Bandwidth Optimization ALERT WAN Acceleration device %s found WAN Acceleration device %s found WAN Acceleration device %s found WAN Acceleration device %s is operational WAN Acceleration device %s is operational WAN Acceleration device %s is operational WAN Acceleration device %s is no longer operational WAN Acceleration device %s is no longer operational WAN Acceleration device %s is no longer operational WAN Acceleration device %s is being used WAN Acceleration device %s is being used WAN Acceleration device %s is being used 136

139 Bandwidth Optimization ALERT Unused DEBUG Bandwidth Optimization ALERT Bandwidth Optimization WARNING Unused DEBUG Bandwidth Optimization WARNING Bandwidth Optimization WARNING Unused DEBUG Bandwidth Optimization WARNING Bandwidth Optimization WARNING Unused DEBUG Bandwidth Optimization WARNING Debug Network Access ALERT Debug Network Access ALERT Debug Network Access ALERT User Activity CIA ALERT WAN Acceleration device %s is no longer being used WAN Acceleration device %s is no longer being used WAN Acceleration device %s is no longer being used Remote WAN Acceleration device stopped responding to probes Remote WAN Acceleration device stopped responding to probes Remote WAN Acceleration device stopped responding to probes Remote WAN Acceleration device started responding to probes Remote WAN Acceleration device started responding to probes Remote WAN Acceleration device started responding to probes Your WAN Acceleration Service subscription has expired. Your WAN Acceleration Service subscription has expired. Your WAN Acceleration Service subscription has expired. Malformed DNS packet detected Malformed DNS packet detected Malformed DNS packet detected A high percentage of the system packet buffers are held waiting for SSO SonicOS 5.9 / / 6.2 Log Events Reference Guide 137

140 User Activity CIA ALERT User Activity CIA ALERT User Activity CIA ALERT User Activity CIA ALERT A high percentage of the system packet buffers are held waiting for SSO A high percentage of the system packet buffers are held waiting for SSO A user has a very high number of connections waiting for SSO A user has a very high number of connections waiting for SSO User Activity CIA ALERT A user has a very high number of connections waiting for SSO VPN IKE DEBUG Deleting IPsec SA. (Phase 2) VPN IKE DEBUG Deleting IPsec SA. (Phase 2) VPN IKE DEBUG Deleting IPsec SA. (Phase 2) DHCP Server WARNING DHCP Server WARNING Delete invalid scope because port IP in the range of this DHCP scope. Delete invalid scope because port IP in the range of this DHCP scope DHCP Server WARNING Delete invalid scope because port IP in the range of this DHCP scope DSL ALERT DSL: %s Device Up DSL ALERT DSL: %s Device Up DSL ALERT DSL: %s Device Up DSL ALERT DSL: %s Device Down DSL ALERT DSL: %s Device Down DSL ALERT DSL: %s Device Down DSL ALERT DSL: %s WAN is connected DSL ALERT DSL: %s WAN is connected DSL ALERT DSL: %s WAN is connected DSL ALERT DSL: %s WAN is initializing DSL ALERT DSL: %s WAN is initializing DSL ALERT DSL: %s WAN is initializing VPN IKE WARNING IKE Responder: Peer's proposed network does not match VPN Policy's Network 138

141 VPN IKE WARNING VPN IKE WARNING RADIUS INFO RADIUS INFO RADIUS INFO RADIUS INFO RADIUS INFO RADIUS INFO RADIUS INFO RADIUS INFO RADIUS INFO RADIUS INFO RADIUS INFO RADIUS INFO High Availability ERROR High Availability ERROR High Availability ERROR Security Services Security Services WARNING IKE Responder: Peer's proposed network does not match VPN Policy's Network IKE Responder: Peer's proposed network does not match VPN Policy's Network Added new LDAP mirror user group: %s Added new LDAP mirror user group: %s Added new LDAP mirror user group: %s Deleted LDAP mirror user group: %s Deleted LDAP mirror user group: %s Deleted LDAP mirror user group: %s Added a new member to an LDAP mirror user group Added a new member to an LDAP mirror user group Added a new member to an LDAP mirror user group Removed a member from an LDAP mirror user group Removed a member from an LDAP mirror user group Removed a member from an LDAP mirror user group Monitoring probe out interface mismatch %s Monitoring probe out interface mismatch %s Monitoring probe out interface mismatch %s Received Alert: Your Firewall Botnet Filter subscription has expired. SonicOS 5.9 / / 6.2 Log Events Reference Guide 139

142 Security Services Security Services WARNING Security Services Security Services WARNING Maintenance Firewall Event ALERT Maintenance Firewall Event ALERT Received Alert: Your Firewall Botnet Filter subscription has expired. Received Alert: Your Firewall Botnet Filter subscription has expired. Product maximum entries reached %s Product maximum entries reached %s Maintenance Firewall Event ALERT Product maximum entries reached %s Network Access NOTICE Nat Mapping Network Access NOTICE Nat Mapping Network Access NOTICE Nat Mapping GeoIP ALERT GeoIP ALERT GeoIP ALERT GeoIP ALERT GeoIP ALERT GeoIP ALERT Botnet ALERT Botnet ALERT Botnet ALERT Botnet ALERT Botnet ALERT Botnet ALERT Initiator from country blocked: %s Initiator from country blocked: %s Initiator from country blocked: %s Responder from country blocked: %s Responder from country blocked: %s Responder from country blocked: %s Suspected Botnet initiator blocked: %s Suspected Botnet initiator blocked: %s Suspected Botnet initiator blocked: %s Suspected Botnet responder blocked: %s Suspected Botnet responder blocked: %s Suspected Botnet responder blocked: %s 140

143 User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity %s %s %s Access WARNING %s Access WARNING %s Access WARNING %s Access ERROR %s Access ERROR %s Access ERROR %s System Error High Availability ALERT System Error High Availability ALERT System Error High Availability ALERT System Error High Availability ALERT System Error High Availability ALERT System Error High Availability ALERT Maintenance High Availability INFO Maintenance High Availability INFO On HA peer firewall, Interface %s Link Is Up On HA peer firewall, Interface %s Link Is Up On HA peer firewall, Interface %s Link Is Up On HA peer firewall, Interface %s Link Is Down On HA peer firewall, Interface %s Link Is Down On HA peer firewall, Interface %s Link Is Down Peer firewall has reduced link status. In event of failover, it will operate with limited capability. Peer firewall has reduced link status. In event of failover, it will operate with limited capability. SonicOS 5.9 / / 6.2 Log Events Reference Guide 141

144 Maintenance High Availability INFO Maintenance High Availability INFO Maintenance High Availability INFO Maintenance High Availability INFO Attack MacIP Spoof ALERT Attack MacIP Spoof ALERT Attack MacIP Spoof ALERT Attack MacIP Spoof ALERT Attack MacIP Spoof ALERT Attack MacIP Spoof ALERT Attack MacIP Spoof ALERT Attack MacIP Spoof ALERT Attack MacIP Spoof ALERT Attack MacIP Spoof ALERT Attack MacIP Spoof ALERT Attack MacIP Spoof ALERT Peer firewall has reduced link status. In event of failover, it will operate with limited capability. Peer firewall has equivalent link status. In event of failover, it will operate with equal capability. Peer firewall has equivalent link status. In event of failover, it will operate with equal capability. Peer firewall has equivalent link status. In event of failover, it will operate with equal capability. MAC IP Anti spoof check enforced for hosts MAC IP Anti spoof check enforced for hosts MAC IP Anti spoof check enforced for hosts MAC IP Anti spoof cache not found for this router MAC IP Anti spoof cache not found for this router MAC IP Anti spoof cache not found for this router MAC IP Anti spoof cache found, but it is not a router MAC IP Anti spoof cache found, but it is not a router MAC IP Anti spoof cache found, but it is not a router MAC IP Anti spoof cache found, but it is blacklisted device MAC IP Anti spoof cache found, but it is blacklisted device MAC IP Anti spoof cache found, but it is blacklisted device 142

145 Attack Attack Attack Attack Attack Attack ALERT ALERT ALERT ALERT ALERT ALERT Debug DHCP Relay INFO Debug DHCP Relay INFO Possible UDP flood attack detected Possible UDP flood attack detected Possible UDP flood attack detected Possible ICMP flood attack detected Possible ICMP flood attack detected Possible ICMP flood attack detected DHCP INFORM received from remote device DHCP INFORM received from remote device Debug DHCP Relay INFO DHCP INFORM received from remote device DEBUG IP Pool of the VPN Policy is Full DEBUG IP Pool of the VPN Policy is Full DEBUG IP Pool of the VPN Policy is Full DEBUG DEBUG DEBUG INFO INFO INFO IP Pool of the VPN Policy is Not Configured IP Pool of the VPN Policy is Not Configured IP Pool of the VPN Policy is Not Configured MOBIKE: Update Peer Gateway IP MOBIKE: Update Peer Gateway IP MOBIKE: Update Peer Gateway IP INFO IP Address is allocated for Client INFO IP Address is allocated for Client INFO IP Address is allocated for Client WARNING Invalid SNMP packet WARNING Invalid SNMP packet WARNING Invalid SNMP packet SonicOS 5.9 / / 6.2 Log Events Reference Guide 143

146 WARNING Invalid SNMPv3 engineid WARNING Invalid SNMPv3 engineid WARNING Invalid SNMPv3 engineid WARNING Invalid SNMPv3 User WARNING Invalid SNMPv3 User WARNING Invalid SNMPv3 User WARNING Invalid SNMPv3 Time Window WARNING Invalid SNMPv3 Time Window WARNING Invalid SNMPv3 Time Window INFO SNMP Packet Dropped INFO SNMP Packet Dropped INFO SNMP Packet Dropped INFO HTTPS Handshake: %s INFO HTTPS Handshake: %s INFO HTTPS Handshake: %s User Activity INFO Guest traffic quota exceeded User Activity INFO Guest traffic quota exceeded User Activity INFO Guest traffic quota exceeded TCP UDP ICMP WARNING TCP UDP ICMP WARNING TCP UDP ICMP WARNING UDP NOTICE UDP NOTICE UDP NOTICE UDP NOTICE UDP NOTICE Packet dropped by wireless Advanced IDP Packet dropped by wireless Advanced IDP Packet dropped by wireless Advanced IDP Failed on updating time from NTP server Failed on updating time from NTP server Failed on updating time from NTP server Time update from NTP server was successful Succeed in updating time from NTP server UDP NOTICE Time update from NTP server was successful UDP NOTICE NTP Request sent UDP NOTICE NTP Request sent 144

147 UDP NOTICE NTP Request sent Debug NOTICE Debug ALERT Unhandled link local or multicast IPv6 packet dropped Unhandled link local or multicast IPv6 packet dropped Debug NOTICE Unhandled link local or multicast IPv6 packet dropped Network INFO Packet allowed by Access Rules Network INFO Packet allowed Network INFO Packet allowed: %s Security Services DEBUG Security Services DEBUG Received Blacklisted Directive from %s Received Blacklisted Directive from %s Security Services DEBUG Received Blacklisted Directive from %s Security Services DEBUG Not Blacklisted by domain %s Security Services DEBUG Not Blacklisted by domain %s Security Services DEBUG Not Blacklisted by domain %s Security Services DEBUG Security Services DEBUG Security Services DEBUG Security Services DEBUG Security Services DEBUG No DNS response to domain %s No DNS response to domain %s No DNS response to domain %s RBL DNS server responded with error code %s RBL DNS server responded with error code %s Security Services DEBUG RBL DNS server responded with error code %s INFO %s INFO %s INFO %s WARNING %s WARNING %s WARNING %s WARNING %s SonicOS 5.9 / / 6.2 Log Events Reference Guide 145

148 WARNING %s WARNING %s User Activity User Activity User Activity RADIUS WARNING RADIUS WARNING RADIUS WARNING RADIUS WARNING RADIUS WARNING RADIUS WARNING RADIUS WARNING RADIUS WARNING RADIUS WARNING Firewall Hardware ALERT Firewall Hardware ALERT User login Failed An error has occurred while sending your one time password User login Failed An error has occurred while sending your one time password User login Failed An error has occurred while sending your one time password Failed to add an LDAP mirror user group Failed to add an LDAP mirror user group Failed to add an LDAP mirror user group Failed to add a member to an LDAP mirror user group Failed to add a member to an LDAP mirror user group Failed to add a member to an LDAP mirror user group An LDAP user group nesting is not being mirrored An LDAP user group nesting is not being mirrored An LDAP user group nesting is not being mirrored Physical interface utilization is greater than 80% of the maximum rated tolerance(for the interface)for more than 10 seconds. Physical interface utilization is greater than 80% of the maximum rated tolerance(for the interface)for more than 10 seconds. 146

149 Firewall Hardware ALERT Firewall Hardware ALERT Firewall Hardware ALERT Firewall Hardware ALERT Firewall Hardware ALERT Firewall Hardware ALERT Firewall Hardware ALERT Firewall Hardware ALERT Firewall Hardware ALERT Firewall Hardware ALERT Firewall Hardware ALERT Firewall Hardware ALERT Firewall Hardware ALERT Physical interface utilization is greater than 80% of the maximum rated tolerance(for the interface)for more than 10 seconds. CPU reaches 80% utilization for more than 10 seconds. CPU reaches 80% utilization for more than 10 seconds. CPU reaches 80% utilization for more than 10 seconds. Current session count is more than 50% of the supported maximum. Current session count is more than 50% of the supported maximum. Current session count is more than 50% of the supported maximum. Current dynamic NAT translation count is more than 50% of the configured maximum. Total firewall throughput is greater than 50% of the maximum rated tolerance for more than 10 seconds. Current dynamic NAT translation count is more than 50% of the configured maximum. Total firewall throughput is greater than 50% of the maximum rated tolerance for more than 10 seconds. Current dynamic NAT translation count is more than 50% of the configured maximum. Total firewall throughput is greater than 50% of the maximum rated tolerance for more than 10 seconds. SonicOS 5.9 / / 6.2 Log Events Reference Guide 147

150 VPN IKE INFO VPN IKE INFO IPv6 VPN only support IKEv2 mode IPv6 VPN only support IKEv2 mode VPN IKE INFO IPv6 VPN only support IKEv2 mode VPN IKE NOTICE IPv6 Tunnel packet dropped VPN IKE NOTICE IPv6 Tunnel packet dropped VPN IKE NOTICE IPv6 Tunnel packet dropped Network NOTICE Network NOTICE Network NOTICE Network INFO Network INFO ICMPv6 packet from LAN dropped ICMPv6 packet from LAN dropped ICMPv6 packet from LAN dropped ICMPv6 packet from LAN allowed ICMPv6 packet from LAN allowed Network INFO ICMPv6 packet from LAN allowed Network INFO ICMPv6 packet allowed Network INFO ICMPv6 packet allowed Network INFO ICMPv6 packet allowed Network NOTICE Network NOTICE ICMPv6 packet dropped due to policy ICMPv6 packet dropped due to policy Network NOTICE ICMPv6 packet dropped due to policy DEBUG %s DEBUG %s DEBUG %s DHCP Server WARNING DHCP Server WARNING DHCP Server WARNING DHCPv6 lease file in the storage is corrupted; read failed DHCPv6 lease file in the storage is corrupted; read failed DHCPv6 lease file in the storage is corrupted; read failed 148

151 DHCP Server WARNING DHCP Server WARNING DHCP Server WARNING DHCP Server INFO DHCP Server INFO Failed to write DHCPv6 leases to storage Failed to write DHCPv6 leases to storage Failed to write DHCPv6 leases to storage DHCPv6 leases written to storage DHCPv6 leases written to storage DHCP Server INFO DHCPv6 leases written to storage Network Access DEBUG YouTube for school enforced Network Access DEBUG YouTube for school enforced Network Access DEBUG YouTube for school enforced Maintenance AppServerEvent INFO AppFlow Server Event Unused INFO Appflow Server Event Unused INFO Appflow Server Event Bandwidth Optimization WARNING Bandwidth Optimization WARNING Bandwidth Optimization WARNING Firewall Event WARNING Firewall Event WARNING Firewall Event WARNING Firewall Event INFO Firewall Event INFO Firewall Event INFO WLAN HTTP traffic not being sent to WXA WebCache; zone conflict WLAN HTTP traffic not being sent to WXA WebCache; zone conflict WLAN HTTP traffic not being sent to WXA WebCache; zone conflict SonicPoint association request to License Manager failed: %s SonicPoint association request to License Manager failed: %s SonicPoint association request to License Manager failed: %s SonicPoint association posted successfully to License Manager SonicPoint association posted successfully to License Manager SonicPoint association posted successfully to License Manager SonicOS 5.9 / / 6.2 Log Events Reference Guide 149

152 User Activity VPN IKE DEBUG %s User Activity VPN IKE DEBUG %s User Activity VPN IKE DEBUG %s Firewall Settings Firewall Event NOTICE Firmware Update Failed NOTICE Firmware Update Failed Firewall Settings Firewall Event NOTICE Firmware Update Failed Firewall Settings Firewall Event NOTICE Firmware Update Success NOTICE Firmware Update Success Firewall Settings Firewall Event NOTICE Firmware Update Success Maintenance INFO Crypto DH test success Maintenance INFO Crypto DH test success Maintenance INFO Crypto DH test success Maintenance INFO Crypto Hmac MD5 test success Maintenance INFO Crypto Hmac MD5 test success Maintenance INFO Crypto Hmac MD5 test success Maintenance INFO Maintenance INFO Crypto hardware DES test success Crypto hardware DES test success Maintenance INFO Crypto hardware DES test success Maintenance INFO Crypto MD5 test success Maintenance INFO Crypto MD5 test success Maintenance INFO Crypto MD5 test success INFO INFO Crypto SHA1 based DRNG KAT test success Crypto SHA1 based DRNG KAT test success INFO Crypto SHA1 based DRNG KAT test success Maintenance INFO Crypto Hmac Sha1 test success Maintenance INFO Crypto Hmac Sha1 test success Maintenance INFO Crypto Hmac Sha1 test success 150

153 Maintenance INFO Maintenance INFO Crypto hardware 3DES test success Crypto hardware 3DES test success Maintenance INFO Crypto hardware 3DES test success Maintenance INFO Crypto DES test success Maintenance INFO Crypto DES test success Maintenance INFO Crypto DES test success Maintenance ERROR Crypto AES test failed Maintenance ERROR Crypto AES test failed Maintenance ERROR Crypto AES test failed Maintenance INFO Crypto AES test success Maintenance INFO Crypto AES test success Maintenance INFO Crypto AES test success Maintenance INFO Crypto DRBG test success Maintenance INFO Crypto DRBG test success Maintenance INFO Crypto DRBG test success Maintenance ERROR Crypto DRBG test failed Maintenance ERROR Crypto DRBG test failed Maintenance ERROR Crypto DRBG test failed Maintenance INFO Maintenance INFO Crypto Hmac Sha256 test success Crypto Hmac Sha256 test success Maintenance INFO Crypto Hmac Sha256 test success Maintenance ERROR Crypto Hmac Sha256 test failed Maintenance ERROR Crypto Hmac Sha256 test failed Maintenance ERROR Crypto Hmac Sha256 test failed Maintenance INFO Crypto RSA test success Maintenance INFO Crypto RSA test success Maintenance INFO Crypto RSA test success Maintenance INFO Crypto Sha1 test success Maintenance INFO Crypto Sha1 test success Maintenance INFO Crypto Sha1 test success Maintenance INFO Crypto Sha256 test success Maintenance INFO Crypto Sha256 test success SonicOS 5.9 / / 6.2 Log Events Reference Guide 151

154 Maintenance INFO Crypto Sha256 test success Maintenance ERROR Crypto Sha256 test failed Maintenance ERROR Crypto Sha256 test failed Maintenance ERROR Crypto Sha256 test failed Maintenance INFO Maintenance INFO Maintenance INFO Maintenance INFO Maintenance INFO Maintenance INFO Maintenance INFO Maintenance INFO Maintenance INFO Maintenance ALERT Maintenance ALERT Maintenance ALERT Maintenance ALERT Maintenance ALERT Maintenance ALERT Debug Network Access ALERT Crypto hardware AES test success Crypto hardware AES test success Crypto hardware AES test success Crypto hardware DES with SHA test success Crypto hardware DES with SHA test success Crypto hardware DES with SHA test success Crypto hardware 3DES with SHA test success Crypto hardware 3DES with SHA test success Crypto hardware 3DES with SHA test success Ndpp SelfTest write/read encrypt/decrypt successsfully Ndpp SelfTest write/read encrypt/decrypt successsfully Ndpp SelfTest write/read encrypt/decrypt successsfully Ndpp SelfTest write/read encrypt/decrypt failure Ndpp SelfTest write/read encrypt/decrypt failure Ndpp SelfTest write/read encrypt/decrypt failure Source or Destination IPv6 address is reserved by RFC Packet is dropped 152

155 Debug Network Access ALERT Debug Network Access ALERT Debug Network Access ALERT Debug Network Access ALERT Debug Network Access ALERT Debug Network Access ALERT Debug Network Access ALERT Debug Network Access ALERT Debug Network Access ALERT Debug Network Access ALERT Debug Network Access ALERT User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING Source or Destination IPv6 address is reserved by RFC Packet is dropped Source or Destination IPv6 address is reserved by RFC Packet is dropped Destination IPv6 address is unspecified. Packet is dropped Destination IPv6 address is unspecified. Packet is dropped Destination IPv6 address is unspecified. Packet is dropped Source IPv6 address is unspecified but this packet is not Neighbor Solicitation message for DAD. Packet is dropped Source IPv6 address is unspecified but this packet is not Neighbor Solicitation message for DAD. Packet is dropped Source IPv6 address is unspecified but this packet is not Neighbor Solicitation message for DAD. Packet is dropped Packet is dropped due to NDPP rules. Packet is dropped due to NDPP rules. Packet is dropped due to NDPP rules. IKE Responder : VPN Policy for IKE ID not found IKE Responder : VPN Policy for IKE ID not found IKE Responder : VPN Policy for IKE ID not found IKE Responder : VPN Policy for gateway address not found IKE Responder : VPN Policy for gateway address not found SonicOS 5.9 / / 6.2 Log Events Reference Guide 153

156 User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING User Activity VPN IKE WARNING Firewall Event WARNING Firewall Event WARNING Firewall Event WARNING Firewall Event INFO Firewall Event INFO Firewall Event INFO DHCP Server ALERT DHCP Server ALERT DHCP Server ALERT VPN IKE INFO VPN IKE INFO IKE Responder : VPN Policy for gateway address not found IKE Initiator : VPN Policy for IKE ID not found IKE Initiator : VPN Policy for IKE ID not found IKE Initiator : VPN Policy for IKE ID not found IKE Initiator : VPN Policy for gateway address not found IKE Initiator : VPN Policy for gateway address not found IKE Initiator : VPN Policy for gateway address not found HA association request to License Manager failed: %s HA association request to License Manager failed: %s HA association request to License Manager failed: %s HA association posted successfully to License Manager HA association posted successfully to License Manager HA association posted successfully to License Manager DHCP Server: Resources of this pool ran out. Client Info: %s DHCP Server: Resources of this pool ran out. Client Info: %s DHCP Server: Resources of this pool ran out. Client Info: %s IKEv2: Peer's IP Version of Traffic Selector does not match with ours IKEv2: Peer's IP Version of Traffic Selector does not match with ours 154

157 VPN IKE INFO IKEv2: Peer's IP Version of Traffic Selector does not match with ours INFO NAT policy added INFO NAT policy added INFO NAT policy added INFO NAT policy modified INFO NAT policy modified INFO NAT policy modified INFO NAT policy deleted INFO NAT policy deleted INFO NAT policy deleted Network ALERT Network ALERT Possible ARP attack from MAC address %s Possible ARP attack from MAC address %s Network ALERT Possible ARP attack from MAC address %s Firewall Hardware ALERT 5426 %s Firewall Hardware ALERT 5426 %s Firewall Hardware ALERT 5426 %s Firewall Hardware ALERT 5427 %s Firewall Hardware ALERT 5427 %s Firewall Hardware ALERT 5427 %s Firewall Hardware ALERT 5428 %s Firewall Hardware ALERT 5428 %s Firewall Hardware ALERT 5428 %s Firewall Hardware ALERT 5429 %s Firewall Hardware ALERT 5429 %s Firewall Hardware ALERT 5429 %s Firewall Hardware ALERT 5430 %s Firewall Hardware ALERT 5430 %s Firewall Hardware ALERT 5430 %s Firewall Hardware ALERT 5431 %s Firewall Hardware ALERT 5431 %s Firewall Hardware ALERT 5431 %s Firewall Hardware ALERT 5432 %s SonicOS 5.9 / / 6.2 Log Events Reference Guide 155

158 Firewall Hardware ALERT 5432 %s Firewall Hardware ALERT 5432 %s User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO User Activity VPN IKE INFO IKEv2 Received Dead Peer Detection Request IKEv2 Received Dead Peer Detection Request IKEv2 Received Dead Peer Detection Request IKEv2 Received Dead Peer Detection Response IKEv2 Received Dead Peer Detection Response IKEv2 Received Dead Peer Detection Response IKEv2 Send Dead Peer Detection Request IKEv2 Send Dead Peer Detection Request IKEv2 Send Dead Peer Detection Request IKEv2 Send Dead Peer Detection Response IKEv2 Send Dead Peer Detection Response User Activity VPN IKE INFO IKEv2 Send Dead Peer Detection Response User Activity VPN IKE INFO IKEv2 Send Invalid SPI Request User Activity VPN IKE INFO IKEv2 Send Invalid SPI Request User Activity VPN IKE INFO IKEv2 Send Invalid SPI Request User Activity VPN IKE INFO User Activity VPN IKE INFO IKEv2 Received Invalid SPI Request IKEv2 Received Invalid SPI Request User Activity VPN IKE INFO IKEv2 Received Invalid SPI Request User Activity VPN IKE INFO IKEv2 Send Invalid SPI Response User Activity VPN IKE INFO IKEv2 Send Invalid SPI Response User Activity VPN IKE INFO IKEv2 Send Invalid SPI Response 156

159 User Activity VPN IKE INFO User Activity VPN IKE INFO IKEv2 Received Invalid SPI Response IKEv2 Received Invalid SPI Response User Activity VPN IKE INFO IKEv2 Received Invalid SPI Response Maintenance Firewall Event ALERT NDPP mode is changed to %s Maintenance Firewall Event ALERT NDPP mode is changed to %s Maintenance Firewall Event ALERT NDPP mode is changed to %s User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity User Activity %s %s %s %s %s %s %s %s %s Firewall Settings Firewall Event INFO Certification %s Firewall Settings Firewall Event INFO Certification %s Firewall Settings Firewall Event INFO Certification %s Firewall Settings Firewall Event INFO %s Firewall Settings Firewall Event INFO %s Firewall Settings Firewall Event INFO %s SonicOS 5.9 / / 6.2 Log Events Reference Guide 157

160 User Activity User Activity User Activity User Activity User Activity Firewall Settings Firewall Event INFO User %s password is changed Firewall Settings Firewall Event INFO User %s password is changed Firewall Settings Firewall Event INFO User %s password is changed Firewall Settings Firewall Event INFO Password rule %s is changed Firewall Settings Firewall Event INFO Password rule %s is changed Firewall Settings Firewall Event INFO Password rule %s is changed Firewall Settings Firewall Event INFO Firewall Settings Firewall Event INFO Firewall Settings Firewall Event INFO %s %s %s User Inactive timeout is changed to %s User Inactive timeout is changed to %s User Inactive timeout is changed to %s Update administrator/user lockout params %s Update administrator/user lockout params %s User Activity Update administrator/user lockout params %s User Activity VPN INFO VPN Policy %s User Activity VPN INFO VPN Policy %s User Activity VPN INFO VPN Policy %s System Error Firewall Event INFO %s System Error Firewall Event INFO %s System Error Firewall Event INFO %s Crypto Test INFO Crypto Sha384 test success Crypto Test INFO Crypto Sha384 test success Crypto Test INFO Crypto Sha384 test success 158

161 Crypto Test ERROR Crypto Sha384 test failed Crypto Test ERROR Crypto Sha384 test failed Crypto Test ERROR Crypto Sha384 test failed Crypto Test INFO Crypto Sha512 test success Crypto Test INFO Crypto Sha512 test success Crypto Test INFO Crypto Sha512 test success Crypto Test ERROR Crypto Sha512 test failed Crypto Test ERROR Crypto Sha512 test failed Crypto Test ERROR Crypto Sha512 test failed Crypto Test INFO Crypto Ikev1 test success Crypto Test INFO Crypto Ikev1 test success Crypto Test INFO Crypto Ikev1 test success Crypto Test ERROR Crypto Ikev1 test failed Crypto Test ERROR Crypto Ikev1 test failed Crypto Test ERROR Crypto Ikev1 test failed Crypto Test INFO Crypto Ikev2 test success Crypto Test INFO Crypto Ikev2 test success Crypto Test INFO Crypto Ikev2 test success Crypto Test ERROR Crypto Ikev2 test failed Crypto Test ERROR Crypto Ikev2 test failed Crypto Test ERROR Crypto Ikev2 test failed Crypto Test INFO Crypto SSH test success Crypto Test INFO Crypto SSH test success Crypto Test INFO Crypto SSH test success Crypto Test ERROR Crypto SSH test failed Crypto Test ERROR Crypto SSH test failed Crypto Test ERROR Crypto SSH test failed Crypto Test INFO Crypto SNMP test success Crypto Test INFO Crypto SNMP test success Crypto Test INFO Crypto SNMP test success Crypto Test ERROR Crypto SNMP test failed Crypto Test ERROR Crypto SNMP test failed Crypto Test ERROR Crypto SNMP test failed Crypto Test INFO Crypto TLS 1.0/1.1 test success Crypto Test INFO Crypto TLS 1.0/1.1 test success Crypto Test INFO Crypto TLS 1.0/1.1 test success Crypto Test ERROR Crypto TLS 1.0/1.1 test failed SonicOS 5.9 / / 6.2 Log Events Reference Guide 159

162 Crypto Test ERROR Crypto TLS 1.0/1.1 test failed Crypto Test ERROR Crypto TLS 1.0/1.1 test failed Crypto Test INFO Crypto Test INFO Crypto Hmac Sha384 test success Crypto Hmac Sha384 test success Crypto Test INFO Crypto Hmac Sha384 test success Crypto Test ERROR Crypto Hmac Sha384 test failed Crypto Test ERROR Crypto Hmac Sha384 test failed Crypto Test ERROR Crypto Hmac Sha384 test failed Crypto Test INFO Crypto Test INFO Crypto Hmac Sha512 test success Crypto Hmac Sha512 test success Crypto Test INFO Crypto Hmac Sha512 test success Crypto Test ERROR Crypto Hmac Sha512 test failed Crypto Test ERROR Crypto Hmac Sha512 test failed Crypto Test ERROR Crypto Hmac Sha512 test failed b Management Wireless ALERT Wireless Flood Attack b Management Wireless ALERT Wireless Flood Attacking b Management Wireless ALERT Wireless Flood Attack VPN PKI ALERT Cert Payload processing failed VPN PKI ALERT Cert Payload processing failed VPN PKI ALERT Cert Payload processing failed DPI SSL NOTICE DPI SSL: %s DPI SSL NOTICE DPI SSL: %s DPI SSL NOTICE DPI SSL: %s Attack Attack Attack ALERT ALERT ALERT TCP Flooding machine %s blacklisted TCP Flooding machine %s blacklisted TCP Flooding machine %s blacklisted 160

163 Attack Attack Attack Attack Attack Attack Attack Attack Attack Attack Attack Attack Attack Attack Attack WARNING WARNING WARNING ALERT ALERT ALERT TCP Flood Blacklist on IF %s continues TCP Flood Blacklist on IF %s continues TCP Flood Blacklist on IF %s continues Machine %s removed from TCP flood blacklist Machine %s removed from TCP flood blacklist Machine %s removed from TCP flood blacklist ALERT Possible TCP Flood on IF %s ALERT Possible TCP Flood on IF %s ALERT Possible TCP Flood on IF %s ALERT ALERT ALERT WARNING WARNING WARNING RADIUS WARNING RADIUS WARNING RADIUS WARNING Attack ALERT Possible TCP Flood on IF %s has ceased Possible TCP Flood on IF %s has ceased Possible TCP Flood on IF %s has ceased Possible TCP Flood on IF %s continues Possible TCP Flood on IF %s continues Possible TCP Flood on IF %s continues LDAP mirroring overflow: too many user groups LDAP mirroring overflow: too many user groups LDAP mirroring overflow: too many user groups IPv6 fragment dropped, invalid length (<1280 Bytes) SonicOS 5.9 / / 6.2 Log Events Reference Guide 161

164 Attack Attack Attack Attack Attack Attack Attack Attack Attack Attack Attack ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT Anti Spam ALERT Anti Spam ALERT Anti Spam ALERT Anti Spam ALERT Anti Spam ALERT Anti Spam ALERT Bandwidth Optimization WARNING IPv6 fragment dropped, invalid length (<1280 Bytes) IPv6 fragment dropped, invalid length (<1280 Bytes) IGMP packet dropped, incomplete fragments IGMP packet dropped, incomplete fragments IGMP packet dropped, incomplete fragments UDP fragment dropped, exceeds maximum IP datagram size (>65535) UDP fragment dropped, exceeds maximum IP datagram size (>65535) UDP fragment dropped, exceeds maximum IP datagram size (>65535) Nestea/Teardrop attack dropped Nestea/Teardrop attack dropped Nestea/Teardrop attack dropped SHLO verification failed with this client IP %s SHLO verification failed with this client IP %s SHLO verification failed with this client IP %s Possible replay attack with this client IP %s Possible replay attack with this client IP %s Possible replay attack with this client IP %s WXA association request to License Manager failed: %s 162

165 Unused WARNING Bandwidth Optimization WARNING Bandwidth Optimization INFO Unused INFO Bandwidth Optimization INFO Security Services WARNING Security Services WARNING WXA association request to License Manager failed: %s WXA association request to License Manager failed: %s WXA association posted successfully to License Manager WXA association posted successfully to License Manager WXA association posted successfully to License Manager Received App Control Alert: Your Application Control subscription has expired. Received App Control Alert: Your Application Control subscription has expired Security Services WARNING Received App Control Alert: Your Application Control subscription has expired User Activity Unused INFO 5609 Configuration succeeded: %s User Activity Unused INFO 5609 Configuration succeeded: %s User Activity Firewall Logging INFO 5609 Configuration succeeded: %s User Activity Unused INFO 5610 Configuration failed: %s User Activity Unused INFO 5610 Configuration failed: %s User Activity Firewall Logging INFO 5610 Configuration failed: %s Debug Network DEBUG Debug Unused DEBUG Debug Network DEBUG Debug Network DEBUG Debug Unused DEBUG TCP packet received with invalid Timestamps option length; TCP packet dropped TCP packet received with invalid Timestamps option length; TCP packet dropped TCP packet received with invalid Timestamps option length; TCP packet dropped TCP packet received with wrapped sequence number; TCP packet dropped TCP packet received with wrapped sequence number; TCP packet dropped SonicOS 5.9 / / 6.2 Log Events Reference Guide 163

166 Debug Network DEBUG Attack Attack TCP packet received with wrapped sequence number; TCP packet dropped ALERT TCP Null Flag dropped ALERT TCP Null Flag dropped Attack ALERT TCP Null Flag dropped Attack VPN IPsec ALERT IPSec VPN Decryption Failed Attack VPN IPsec ALERT IPSec VPN Decryption Failed Attack VPN IPsec ALERT IPSec VPN Decryption Failed Maintenance Security Services INFO Maintenance Unused INFO Maintenance Security Services INFO Maintenance Security Services INFO Maintenance Unused INFO Access attempt from host without Client CF agent installed Access attempt from host without Client CF agent installed Access attempt from host without Client CF agent installed Client CF agent out of date on host Client CF agent out of date on host Maintenance Security Services INFO Client CF agent out of date on host Attack Unused ALERT Packet Data Attack Unused ALERT Packet Data Attack Security Services ALERT Packet Data Maintenance Unused ALERT 5243 Blade up:%s Maintenance Firewall Event ALERT 5243 Blade up:%s Maintenance Unused ALERT 5243 Blade up:%s Maintenance Unused ALERT 5244 Blade down:%s Maintenance Firewall Event ALERT 5244 Blade down:%s Maintenance Unused ALERT 5244 Blade down:%s Bandwidth Optimization ERROR WXA Startup Failure %s Unused ERROR WXA Startup Failure %s Bandwidth Optimization ERROR WXA Startup Failure %s 164

167 Bandwidth Optimization WARNING WXA Get Failure %s Unused WARNING WXA Get Failure %s Bandwidth Optimization WARNING WXA Get Failure %s Bandwidth Optimization NOTICE WXA Parse Failure %s Unused NOTICE WXA Parse Failure %s Bandwidth Optimization NOTICE WXA Parse Failure %s Bandwidth Optimization NOTICE WXA Register Failure %s Unused NOTICE WXA Register Failure %s Bandwidth Optimization NOTICE WXA Register Failure %s Bandwidth Optimization NOTICE WXA Unregister Failure %s Unused NOTICE WXA Unregister Failure %s Bandwidth Optimization NOTICE WXA Unregister Failure %s Bandwidth Optimization NOTICE WXA Probe Failure %s Unused NOTICE WXA Probe Failure %s Bandwidth Optimization NOTICE WXA Probe Failure %s Bandwidth Optimization ALERT WXA Create Failure %s Unused ALERT WXA Create Failure %s Bandwidth Optimization ALERT WXA Create Failure %s Bandwidth Optimization WARNING WXA Set Failure %s Unused WARNING WXA Set Failure %s Bandwidth Optimization WARNING WXA Set Failure %s Bandwidth Optimization ERROR WXA Delete Failure %s Unused ERROR WXA Delete Failure %s SonicOS 5.9 / / 6.2 Log Events Reference Guide 165

168 Bandwidth Optimization ERROR WXA Delete Failure %s Bandwidth Optimization INFO WXA Enable %s Unused INFO WXA Enable %s Bandwidth Optimization INFO WXA Enable %s Bandwidth Optimization INFO WXA Disable %s Unused INFO WXA Disable %s Bandwidth Optimization INFO WXA Disable %s Bandwidth Optimization WARNING WXA Request Failure %s Unused WARNING WXA Request Failure %s Unused INFO Unused INFO DHCP Client INFO Unused DEBUG Unused DEBUG DHCP Client DEBUG Unused DEBUG Unused DEBUG DHCP Client DEBUG Unused DEBUG Unused DEBUG Bandwidth Optimization WARNING WXA Request Failure %s General DHCPv6 Client Information [%s] General DHCPv6 Client Information [%s] General DHCPv6 Client Information [%s] DHCPv6 Client sent message [%s] DHCPv6 Client sent message [%s] DHCPv6 Client sent message [%s] DHCPv6 Client received message [%s] DHCPv6 Client received message [%s] DHCPv6 Client received message [%s] DHCPv6 Client Duplicate Address Detection [%s] DHCPv6 Client Duplicate Address Detection [%s] 166

169 DHCP Client DEBUG Unused DEBUG Unused DEBUG DHCPv6 Client Duplicate Address Detection [%s] DHCPv6 Client waiting reply timeout [%s] DHCPv6 Client waiting reply timeout [%s] DHCP Client DEBUG DHCPv6 Client waiting reply timeout [%s] Unused DEBUG Router Advertisement flags [%s] Unused DEBUG Router Advertisement flags [%s] DHCP Client DEBUG Router Advertisement flags [%s] Unused INFO Unused INFO DHCP Client INFO Unused INFO Unused INFO DHCP Client INFO Unused INFO Unused INFO DHCP Server INFO Unused INFO Unused INFO DHCP Server INFO Unused INFO Unused INFO DHCPv6 Client got a new lease [%s] DHCPv6 Client got a new lease [%s] DHCPv6 Client got a new lease [%s] DHCPv6 Client released lease [%s] DHCPv6 Client released lease [%s] DHCPv6 Client released lease [%s] DHCPv6 Server assigned lease %s DHCPv6 Server assigned lease %s DHCPv6 Server assigned lease %s DHCPv6 Server released lease %s DHCPv6 Server released lease %s DHCPv6 Server released lease %s DHCPv6 Server received DHCPv6 Decline from client %s DHCPv6 Server received DHCPv6 Decline from client %s SonicOS 5.9 / / 6.2 Log Events Reference Guide 167

170 DHCP Server INFO Unused WARNING Unused WARNING DHCP Server WARNING Unused INFO Unused INFO DHCP Server INFO Unused INFO Unused INFO DHCP Server INFO Unused DEBUG Unused DEBUG DHCP Server DEBUG Unused DEBUG Unused DEBUG DHCP Server DEBUG Unused WARNING Unused WARNING Network WARNING DHCPv6 Server received DHCPv6 Decline from client %s DHCPv6 Server: Resources of this pool ran out. Client Info: %s DHCPv6 Server: Resources of this pool ran out. Client Info: %s DHCPv6 Server: Resources of this pool ran out. Client Info: %s DHCPv6 Server: Add a new scope (%s) DHCPv6 Server: Add a new scope (%s) DHCPv6 Server: Add a new scope (%s) DHCPv6 Server: Delete scope (%s) DHCPv6 Server: Delete scope (%s) DHCPv6 Server: Delete scope (%s) DHCPv6 Server received message (%s) DHCPv6 Server received message (%s) DHCPv6 Server received message (%s) DHCPv6 Server sent message (%s) DHCPv6 Server sent message (%s) DHCPv6 Server sent message (%s) IPv6 address conflict detected from Ethernet address %s IPv6 address conflict detected from Ethernet address %s IPv6 address conflict detected from Ethernet address %s 168

171 Log > Syslog In addition to the standard event log, the Dell SonicWALL security appliance can send a detailed log to an external Syslog server. The Dell SonicWALL Syslog captures all log activity and includes every connection source and destination IP address, IP service, and number of bytes transferred. Syslog Analyzers such as Dell SonicWALL ViewPoint, Analyzer, or WebTrends Firewall Suite can be used to sort, analyze, and graph the Syslog data. For more information on configuring the Log > Syslog page, refer to the SonicOS Administrator s Guide. SonicOS 5.9 / / 6.2 Log Events Reference Guide 169

172 Index of Syslog Tag Field Descriptions This section provides an alphabetical listing of Syslog tags and the associated field description. For more information about the pri Syslog Tag, see Table 3: Priority Level on page 182. The value here is taken from the Priority Level column of the Index of Log Event Messages on page 2. For more information about the c Syslog Tag, see Legacy Category on page 178. Tag Tags for Arc- Sight Field Description <ddd> Syslog message prefix The beginning of each syslog message has a string of the form <ddd> where ddd is a decimal number indicating facility and priority of the message af_polid Application Filter Displays the Application Filter Policy ID af_policy Application Filter Displays the Application Policy name Displays the Application Policy type such as: SMTP Client Request HTTP Client Request HTTP Server Response FTP Client Request af_type Application Filter FTP Client Upload File FTP Client Download File POP3 Client Request POP3 Server Response FTP Data Transfer IPS Content App Control Content Custom Policy Type CFS af_service Application Filter Displays the Application Policy service name 170

173 Displays the Application Policy action such as HTTP Block Page HTTP Redirect Bandwidth Management af_action Application Filter Disable Attachment FTP Notification Reply Reset/Drop Block SMTP Bypass DPI CFS Block Page Packet Monitor af_object Application policy object name Displays the custom Application Policy object name ai Active Interface via GMS heartbeat Displays the Active WAN Interface. Normally it is Primary WAN but in a failover, it displays the value of the failover default outbound WAN interface, if there s more than one WAN. When there is only one WAN interface, it is always Primary WAN regardless of the link state app app Numeric application ID Indicates the application for the applied syslog. Only displays when Flow Reporting is enabled. appcat appcat Application Control Display the application category when Application Control is enabled appid appid Application ID Display the application ID when Application Control is enabled appname Non-Signature Application Name Indicates the non-signature Application Name that matches the Application ID app or f of the Syslog. arg arg URL Used to render a URL: arg represents the URL path name part bcastrx bcastrx Interface statistics report Displays the broadcast packets received bcasttx bcasttx Interface statistics report Displays the broadcast packets transmitted bytesrx bytesrx Interface statistics report Displays the bytes received SonicOS 5.9 / / 6.2 Log Events Reference Guide 171

174 bytestx bytestx Interface statistics report Displays the bytes transmitted c cat Message category (legacy only) Indicates the legacy category number (Note: We are not currently sending new category information.) category category Blocking code description Applicable only when CFS is enabled, indicates the category of the blocked content such as Gambling. This works in conjunction with code Blocking code. catid Rule category Indicates the category ID of the rule cdur cn3label Connection Duration Displays the connection duration change SWGMSchangeUrl Configuration change webpage Displays the basename of the firewall web page that performed the last configuration change code reason Blocking code Indicates the CFS block code category icmpcode cn2 ICMP type and code Indicates the ICMP code conns Firewall status report via GMS heartbeat Indicates the number of connections in use contentobject Application Filter Indicates rule name cs4 Interface Statistics Display interface statistics deviceoutboundinterface Interface Indicates interface on which the packet leaves the device deviceinbound- Interface Interface Indicates interface on which the packet enters the device dpt Port Display destination port dnpt NAT ed Port Display NAT ed destination port dst dst Destination dstv6 dst Destination Destination IP address, and optionally, port, network interface, and resolved name. Destination IPv6 address, and optionally, port, network interface, and resolved name. 172

175 dstname request URL dstname dstname Notes Displays the URL of accessed Websites and hosts Indicates additional information such as description of forbidden/deleted attachments dstzone cs4label (destination) Destination zone name Displays destination zone dur cs6label Numeric, session duration in seconds Indicates the duration in units of seconds that a session is connected dyn Firewall status report via GMS heartbeat Displays the HA and dialup connection state (rendered as h.d where h is n (not enabled), b (backup), or p (primary) and d is 1 (enabled) or 0 (disabled)) f flowtype Numeric flow type Indicates the flow type when Flow Reporting is disabled fw Firewall WAN IP Indicates the WAN IP Address fwlan Firewall status report via GMS heartbeat Indicates the LAN zone IP address gcat gcat Group category Display event group category when using Enhanced Syslog goodrx- Bytes goodrxbytes SonicPoint statistics report Indicates the well formed bytes received goodtx- Bytes goodtxbytes SonicPoint statistics report Indicates the well formed bytes transmitted i Firewall status report via GMS heartbeat Displays the GMS message interval in seconds id=firewall WebTrends prefix Syntactic sugar for WebTrends (and GMS by habit) if if Interface statistics report Displays the interface on which statistics are reported ipscat ipscat IPS message Displays the IPS category ipspri ipspri IPS message Displays the IPS priority lic Firewall status report via GMS heartbeat Indicates the number of licenses for firewalls with limited modes SonicOS 5.9 / / 6.2 Log Events Reference Guide 173

176 m Message ID Provides the message ID number mac smac or dmac MAC address Provides the source or destination MAC address mailfrom sender Originator of the msg msg Message n cnt Message count Displays the message which is composed of either or both a predefined message and a dynamic message containing a string %s or numeric %d argument Indicates the number of times event occurs natdst cs2label NAT destination IP Displays the NAT ed destination IP address natdstv6 cs2label NAT destination IPv6 Displays the NAT ed destination IPv6 address natsrc cs1label NAT source IP Displays the NAT ed source IP address natsrcv6 cs1label NAT source IPv6 note cs6 Additional Information npcs cs5 URL op requestmethod HTTP OP code Displays the NAT ed source IPv6 address Additional information that is application-dependent Applicable only when Network Packet Capture System (NPCS Solera) is enabled, displays URL of an NPCS object Displays the HTTP operation (GET, POST, etc.) of web site hit pri Message priority Displays the event priority level (0=emergency..7=debug) proto proto Protocol and service Displays the protocol information (rendered as proto=[protocol] or just [proto]/[service] ) pt Firewall status report via GMS heartbeat Displays the HTTP/HTTPS management port (rendered as hhh.sss ) radio radio SonicPoint statistics report Displays the SonicPoint radio on which event occurred rcptto recipient Indicates the recipient 174

177 rcvd in Bytes received Indicates the number of bytes received within connection result outcome HTTP Result code Displays the HTTP result code (200, 403, etc.) of web site hit rpkt cn1label Packet received Display the number of packet received rule cs1 Rule ID sent out Bytes sent Displays the Access Rule number causing packet drop. The policy index includes Address Object names Displays the number of bytes sent within connection sess cs5label Pre-defined string indicating session type Applies to syslogs with an associated user session being tracked by the UTM sid sid IPS or Anti-Spyware message Provides either IPS or Anti-Spyware signature ID sn Firewall serial number Indicates the device serial number spkt cn2label Packet sent Display the number of packets sent spt Port Displays source port spycat spycat Anti-Spyware message Displays the Anti-Spyware category spypri spypri Anti-Spyware message Displays the Anti-Spyware priority snpt NAT source port Display NAT ed source port src src Source Indicates the source IP address, and optionally, port, network interface, and resolved name. srczone cs3label (source) Source zone name Displays source zone station station SonicPoint statistics report Displays the client (station) on which event occurred time Time Reports the time of event type cn1 ICMP type and code Indicates the ICMP type ucastrx ucastrx Interface statistics report Displays the unicast packets received SonicOS 5.9 / / 6.2 Log Events Reference Guide 175

178 ucasttx ucasttx Interface statistics report Displays the unicast packets transmitted unsynched Firewall status report via GMS heartbeat Reports the time since last local change in seconds usestandbysa Firewall status report via GMS heartbeat Displays whether standby SA is in use ( 1 or 0 ) for GMS management usr (or user) susr User Displays the user name ( user is the tag used by WebTrends) vpnpolicy cs2 (source) Source VPN policy name Displays the source VPN policy name of event vpnpolicydst cs3 (destination) Destination VPN policy name Displays the destination VPN policy name of event Examples of Standard Syslogs The following examples show the content of the Syslog packet. This type of message can be viewed on the Syslog server or any packet analyzer application. Note that this is the Default Syslog Format. id=firewall123 sn=0017c time=" :56:53" fw= pri=6 c=1024 m=97 n=1 src= :5432:x0 dst= :2345:x1 proto=tcp/2345 op=1 sent=9876 rcvd=6789 result=403 dstname=http: arg=// code=20 Category="Online Banking" id=firewall123 sn=0017c time=" :57:04" fw= pri=6 c= m=98 msg="connection Opened" n=1437 usr="admin" src= :61505:x0 dst= :443:x0 proto=tcp/https sent=52 id=firewall123 sn=0017c time=" :57:06" fw= pri=6 c=1024 m=537 msg="connection Closed" n=3683 usr="admin" src= :61505:x0 dst= :443:x0 proto=tcp/https sent=1519 rcvd=951 spkt=7 rpkt=8 cdur=2133 id=firewall123 sn=0017c time=" :56:53" fw= pri=1 c=32 m=609 msg="ips Prevention Alert: P2P BitTorrent -- Peer Sync" sid=1994 ipscat=p2p ipspri=3 P2P BitTorrent -- Peer Sync, SID: 1994, Priority: Low n=1 src= :5432:x0 dst= :2345:x1 id=firewall123 sn=0017c time=" :38:24" bid=1 fw= pri=1 c=16 m=793 msg="app Rules Alert" af_polid=1 af_policy="test" af_type="smtp Client Request" af_service="smtp (Send )" af_action="no Action" n=0 src= :50613:x0 dst= :25:x1" 176

179 id=firewall123 sn=0017c mgmtip= time=" :14:30 UTC" fw= m=96 n=25 i=60 lic=0 unsynched=893 pt= usestandbysa=0 dyn=n.n ai=1 fwlan= conns=0 Examples of ArcSight Syslog The following examples show the content of the Syslog packet. This type of message can be viewed on the Syslog server or any packet analyzer application. MAR :07: C CEF:0 SonicWALL NSA d_75o 97 Syslog Website Accessed 4 cat=1024 gcat=2 src= spt=5432 deviceinboundinterface=x0 cs1label= snpt=1 dst= dpt=2345 deviceoutboundinterface=x1 cs2label= dnpt=2 proto=tcp/2345 out=9876 in=6789 requestmethod=1 outcome=403 request= reason=20 Category-"Online Banking" MAR :07: C CEF:0 SonicWALL NSA d_75o 98 Syslog Connection Logged 4 cat= gcat=2 src= spt=61693 deviceinboundinterface=x0 dst= dpt=443 deviceoutboundinterface=x0 susr="admin" proto=tcp/https out=52 cnt=1570 MAR :07: C CEF:0 SonicWALL NSA d_75o 537 Syslog Close 4 cat=1024 gcat=2 smac=00:00:c5:b3:6b:e5 src= spt=61693 deviceinboundinterface=x0 cs3label=trusted dst= dpt=443 deviceoutboundinterface=x0 cs4label=trusted susr="admin" proto=tcp/https out=1519 in=967 cn2label=7 cn1label=8 cn3label=2333 cnt=3815 MAR :07: C CEF:0 SonicWALL NSA d_75o 609 IDP Prevention Alert 9 cat=32 gcat=3 src= spt=5432 deviceinboundinterface=x0 cs1label= snpt=1 dst= dpt=2345 deviceoutboundinterface=x1 cs2label= dnpt=2 msg="ips Prevention Alert: P2P BitTorrent -- Peer Sync, SID: 1994, Priority: Low" cnt=3 MAR :07: C CEF:0 SonicWALL NSA d_75o 793 Application Firewall Alert 9 cat=16 gcat=10 src= spt=5432 deviceinboundinterface=x0 dst= dpt=2345 deviceoutboundinterface=x1 msg="application Firewall Alert: Policy: foobar, Action Type: Block SMTP - Send Error Reply, Mail From: an unknown string of unknown length" cnt=3 SonicOS 5.9 / / 6.2 Log Events Reference Guide 177

180 Table of Values This section can be used as a reference for understanding different categories and their descriptions. Legacy Categories The following table describes the Legacy categories shared in all SonicOS releases. Table 1 Legacy Category ID (used in Syslog) Name Description 0 Event is not Legacy Category, not backward compatible. 1 System Maintenance Logs general system activity, such as system activations. 2 System Errors Logs problems with DNS or . 4 Blocked Web Sites Logs Web sites or news groups blocked by the Content Filter List or by customized filtering. 8 Blocked Java Etc Logs Java, ActiveX, and Cookies blocked by the Dell SonicWALL security appliance. 16 User Activity Logs successful and unsuccessful log in attempts. 32 Attacks Logs messages showing Denial of Service attacks, such as SYN Flood, Ping of Death, and IP Spoofing. 64 Dropped TCP Logs blocked incoming TCP connections. 128 Dropped UDP Logs blocked incoming UDP packets. 256 Dropped ICMP Logs blocked incoming ICMP packets. 512 Network Debug Logs NetBIOS broadcasts, ARP resolution problems, and NAT resolution problems. Also, detailed messages for VPN connections are displayed to assist the network administrator with troubleshooting problems with active VPN tunnels. Network Debug information is intended for experienced network administrators Syslog Only For Traffic Reporting Used for Syslog only to report HTTP connections opened and closed, and bytes transferred Dropped LAN TCP Used for Syslog only to report that the TCP packet is dropped due to LAN management policy. 178

181 ID (used in Syslog) Name Description 4096 Dropped LAN UDP Used for Syslog only to report that the UDP packet is dropped due to LAN management policy Dropped LAN ICMP Used for Syslog only to report that the ICMP packet is dropped due to LAN management policy Modem Debug Logs Modem Debug activity VPN Tunnel Status Logs status information on VPN tunnels Management Logs WLAN IEEE connections Syslog Only For Traffic Reporting Used for Syslog only to report that the Network Traffic is logged when connection is opened System Environment Logs system environment activity Expanded VOIP Activity Used for Syslog only to log VoIP H.323/ RAS, H.323/H.225, and H.323/H.245 activity Expanded WLAN IDS Activity Expanded SonicPoint Activity Used for Syslog only to log WLAN IDS activity. Used for Syslog only to log SonicPoint activity. Expanded Categories The following table displays expanded category information, also known as the SonicOS Category, for all firmware releases and platforms. Table 2 Expanded Categories Category Description Management Logs management activity Advanced Routing Logs Advanced Routing activity Advanced Switching Logs Advanced Switching activity Anti-Spam Service Logs the Anti-Spam service App Flow Server Logs App Flow Server activity App Rules Logs App Rules activity Application Control Logs Application Control activity Attacks Logs messages showing Denial of Service attacks, such as SYN Flood, Ping of Death, and IP Spoofing. Access Logs Access activity WAN Acceleration Logs the WAN Acceleration activity Blocked Java Etc Logs Java, ActiveX, and Cookies blocked Blocked WebSites Logs Websites blocked SonicOS 5.9 / / 6.2 Log Events Reference Guide 179

182 BOOTP Botnet Blocking SSO Agent Authentication Crypto Test DDNS Denied LAN IP DHCP Client DHCP Relay DHCP Server DPI-SSL Dropped ICMP Dropped TCP Dropped UDP DSL Dynamic Address Objects E1-T1 Firewall Event Firewall Hardware Firewall Logging Firewall Rule FTP Geolocation GMS High Availability Intrusion Prevention IPComp IPNet IPv6 Tunnel L2TP Client L2TP Server MAC-IP Anti-Spoof Modem Modem Debug Logs Bootstrap Protocol (BOOTP) activity Logs the Botnet Blocking activity Logs the SSO Agent Authentication activity Logs Crypto Test activity Logs Dynamic Domain Name System (DDNS) activity Logs LAN IP denied activity Logs DHCP Client activity Logs DHCP Relay activity Logs DHCP Server activity Logs the Deep Packet Inspection of Secure Socket Layer (DPI-SSL) activity Logs blocked incoming Internet Control Message Protocol (ICMP) packet activity Logs blocked incoming Transmission Control Protocol (TCP) connection activity Logs blocked incoming User Datagram Protocol (UDP) packet activity Logs DSL activity Logs Dynamic Address Object activity Logs E1-T1 activity Logs Firewall Event alerts and activity Logs Firewall Hardware alerts and activity Logs other Firewall-related activity Logs Firewall Rule alerts and activity Logs File Transfer Protocol (FTP) activity Logs the Geolocation service activity Logs Dell SonicWALL Global Management System (GMS) activity Logs High Availability activity Logs Intrusion Prevention activity Logs IP Compression (IPComp) activity Logs IPNet activity Logs IPv6 activity Logs Layer 2 Tunnel Protocol (L2TP) client activity Logs Layer 2 Tunnel Protocol (L2TP) server activity Logs the MAC-IP Spoofing activity Logs the Modem activity Logs the Modem Debug activity 180

183 MSAD Multicast Network Network Debug Network Access Network Monitor Network Traffic PPP PPP Dial-Up PPPoE PPTP Remote Authentication RBL RF Monitoring RIP Security Services SNMP SonicPoint SonicPointN SSLVPN System Environment System Errors System Maintenance User Activity VOIP VPN VPN Tunnel Status VPN Client VPN IKE VPN IPSec WAN Availability Logs Microsoft Active Directory (MSAD) activity Logs Multicast activity Logs Network activity Logs NetBios broadcasts, ARP resolution problems, and NAT resolution problems. Logs successful and unsuccessful Network Access activity Logs Network Monitor activity Logs Network Traffic activity Logs Point-to-Point Protocol (PPP) activity Logs Point-to-Point Protocol (PPP) Dial-Up activity Logs Point-to-Point Protocol over Ethernet (PPPoE) activity Logs Point-to-Point Tunneling Protocol (PPTP) activity Logs Remote Authentication activity Logs Realtime Black List (RBL) activity Logs RF Monitoring activity Logs Routing Information Protocol (RIP) activity Logs Security Services activity Logs the Simple Network Management Protocol (SNMP) activity Logs the SonicPoint activity Logs the SonicPointN activity Logs Secure Socket Layer Virtual Private Network (SSLVPN) activity Logs System Environment activity Logs System Errors activity Logs System Maintenance activity Logs successful and unsuccessful log in attempts Logs Voice over IP (VOIP) activity Logs Virtual Private Network (VPN) activity Logs VPN Tunnel Status activity Logs VPN Client activity Logs VPN IKE activity Logs VPN IP Security activity Logs WAN Availability activity SonicOS 5.9 / / 6.2 Log Events Reference Guide 181

184 Wireless WLAN IDS Logs Wireless activity Logs Wireless LAN System (IDS) activity Priority Level The following table displays the Priority Number and Name for Syslog Tags. The value here is taken from the Priority Level column of the Index of Log Event Messages on page 2, or the pri tag in Index of Syslog Tag Field Descriptions on page 170. For example, a tag with pri=0 means Emergency Priority. Table 3 Priority Level Priority Number Priority Name 0 Emergency 1 Alert 2 Critical 3 Error 4 Warning 5 Notice 6 Info 7 Debug 182

185 183