Using the SonicOS Log Event Reference Guide

Transcription

1 Using the SonicOS Log Event Reference Guide This reference guide lists and describes SonicOS log event messages. Reference a log event message by using the alphabetical index of log event messages. This document contains the following sections: SonicOS Log Event Messages Overview on page 1 Configuring SonicOS Log > View on page 3 Referencing the SonicOS Log > View Field Display on page 5 Index of Log Event Messages on page 6 Index of Syslog Tag Field Description on page 53 SonicOS Log Event Messages Overview During the operation of a SonicWALL security appliance, SonicOS software sends log event messages to the Log > View page in the SonicWALL management interface. In Figure 1, the Log > View page is displayed. Figure 1 SonicOS Enhanced Log > View page Note: Event logging automatically begins when the SonicWALL security appliance is powered on and configured. SonicOS supports a traffic log containing entries with multiple fields. Log event messages provide operational informational and debugging information to help you diagnose problems with communication lines, internal hardware, or your firmware configuration. For the SonicOS CLI console display, use the show log command to display log events. Refer to the SonicOS CLI Reference Guide located on the SonicWALL Web site: < SONICOS LOG EVENT REFERENCE GUIDE 1

2 Note: Not all log event messages indicate operational issues with your SonicWALL security appliance. SonicOS Log Entries Each log entry contains the date and time of the event and a brief message describing the event. The SonicWALL manages log events in the following manner: TCP, UDP, or ICMP packets When IP packets are by the SonicWALL security appliance, TCP, UDP and ICMP messages are displayed. The messages include the source and destination IP addresses of the packet. The TCP or UDP port number or the ICMP code follows the IP address. Log event messages usually include the name of the service in quotation marks. Web, FTP, Gopher, or Newsgroup blocked When a computer attempts to connect to the blocked site or newsgroup, a log event is displayed. Blocked is defined as a Web site, connection, or event that is denied access from the SonicWALL security appliance. The computer s IP address, Ethernet address, the name of the blocked Web site, and the Content Filter List Code is displayed. Code definitions for the 12 Content Filter List categories are shown below. 1. Violence 7. Cult 2. Intimate Apparel/Swimsuit 8. Drugs/Illegal Drugs 3. Nudism 9. Criminal Skills/Illegal Skills 4. Adult/Mature Content/ Pornography 10. Sex Education 5. Weapons 11. Gambling 6. Hate/Racism 12. Alcohol & Tobacco ActiveX, Java, Cookie or Code Archive blocked When ActiveX, Java or Web cookies are blocked, messages with the source and destination IP addresses of the connection attempt is displayed. Ping of Death, IP Spoof, and SYN Flood Attacks The IP address of the machine under attack and the source of the attack is displayed. In most attacks, the source address shown is fake and does not reflect the real source of the attack. SonicOS Log View Settings The Log View Settings section of the Log > View page provides you the filtering controls to filter log event messages based on your configured log filter logic. It also contains the following log management buttons: Refresh Renews the Log View table with current log event messages. Clear Log Empties the entries in the Log View table. Log s log event messages to your configured SMTP server or list of addresses. Export Log Exports the log into a plain.txt or.csv file format. 2 SONICOS LOG EVENT REFERENCE GUIDE

3 SonicOS Log View Display Format The Log > View page displays log event messages in following format for alert notification: Time Displays the hour and minute the event occurred. Priority Displays the level urgency for the event. Category Displays the event type. Message Displays a description of the event. Source Displays the source IP address of incoming IP packet. Displays the destination IP address of incoming IP packet. Note Displays displays additional information specific to a particular event occurrence. Rule Displays the source and destination zones for the access rule. This field provides a link to the access rule defined in the Firewall > Rules page. The display fields for a log event message provides you with data to verify your configurations, trouble-shoot your security appliance, and track IP traffic. Configuring SonicOS Log > View The Log > View page in the Web-based SonicWALL management interface allows you to export log reports, log reports, and monitor real-time Syslog data. As soon as you power on your SonicWALL security appliance, SonicOS software sends Syslog data to your log. In the SonicWALL management interface, you can navigate through the subcategories of the Log setting for reporting and customizing log reports. In Figure 2, the Log > View page is displayed. Setting the Log Filter Logic By default, the SonicOS filter logic is set to Priority && Category && Source &&. The double ampersand symbols (&&) indicate the boolean expression and. The default SonicOS filter logic displays all log events. Figure 2 SonicOS Log View Settings SONICOS LOG EVENT REFERENCE GUIDE 3

4 Applying Custom Log Event Message Filters This section provides examples on using the Log View Settings to filter log event messages displayed in the Log View page. Configuration Example: Filtering Log Event Messages by Priority Value To set the log filter logic to display only log event messages with a priority level of Emergency: 1. Select Emergency from the filter-priority Value pull-down menu. 2. Click on the Apply Filters button. Configuration Example: Filtering Log Event Messages by Category Value To set the log filter logic to display only log event messages with a category event type of Attacks: 1. Select Attacks from the filter-category Value pull-down menu. 2. Click on the Apply Filters button. Configuration Example: Filtering Log Event Messages by Source Value To set the log filter logic to display only log event messages associated to a source IP address: 1. Enter the source IP address or select an interface from the filter-source Value pull-down menu. 2. Click on the Apply Filters button. Configuration Example: Filtering Log Event Messages by Value To set the log filter logic to display only log event messages associated to a destination IP address: 1. Enter the destination IP address or select an interface from the filter-source Value pull-down menu. 2. Click on the Apply Filters button. Using Group Filters Note: Use Group filters to change the default SonicOS filter logic (Priority && Category && Source && ) from double ampersand symbols (&&) to double pipe symbols ( ) to indicate the boolean expression or. When using group filters, select two or more Group Filters checkboxes. If you select only one Group Filter checkbox, the filter logic will remain the same. Selecting only the Priority-Group Filter checkbox provides you with the following filter logic: (Priority) && Category && Source && Configuration Example: Using the Priority Group Filter and Category Group Filter To set the log filter logic to display log event messages with a priority level of Emergency or a category event type of Attack: 1. Select the Priority group filter checkbox. 2. Select the Category group filter checkbox. 3. Select Emergency from the filter-priority Value pull-down menu. 4. Select Attacks from the filter-category Value pull-down menu. Figure 3 illustrates the SonicOS filter logic updated as follows: 4 SONICOS LOG EVENT REFERENCE GUIDE

5 Figure 3 (Priority Category) && Source && SonicOS Log Group Filters A filter logic using the boolean expression is less restrictive than the default filter logic using the boolean expression &&. With the boolean expression, log event messages are displayed if they match either filter values. With the boolean expression &&, log event messages are displayed if they match both filter values. Exporting the Logs to a File This section provides instructions to export your log to a file. To export the log to a file: 1. Click on the Export Log button. You will be prompted to select a export file format type as illustrated in Figure 4. Figure 4 SonicOS Export Log Note: 2. Select a file format: Plain text format used in log and alert Saves the log file as plain text, which can be used for alert s. Comma-Separated Value (CSV) format Saves the log file for importing into Microsoft Excel or other presentation development application. 3. Click on the Export button. 4. Save the exported log file to a location on your personal computer s hard drive. You can export a log to a file with applied filter settings. Referencing the SonicOS Log > View Field Display SonicOS 2.5 Enhanced and Standard releases and greater provide the SonicOS Log > View field display as illustrated in Figure 5. SONICOS LOG EVENT REFERENCE GUIDE 5

6 Figure 5 SonicOS Log > View Field Display Referencing the SonicWALL Firmware Log > View Log Field Display SonicWALL Firmware release and greater provide the SonicWALL Firmware Log > View Log field display. Index of Log Event Messages This section contains a list of log event messages for all SonicWALL Firmware and SonicOS Software Releases, ordered alphabetically. Use your web browser s Find function to search for a command. Log Event Message Symbols Key Log Event Message Symbol Description Context %s Ethernet Port Down Represents a character string. [WAN LAN DMZ] Ethernet Port Down The cache is full; %u open connections; some will be Represents a numerical string. The cache is full; [40,000] open connections; some will be TCP IP Layered-Data Packet Processing and SonicOS Log Event Handling In specific cases of multi-layer packet processing, a TCP connection initially logged as "open," will be rejected by a deeper layer of packet processing. In these cases, the connection request has not been forwarded by the SonicWALL security appliance, and the initial Connection Open SonicOS log event message should be ignored in favor of the TCP Connection Dropped log event message. Each log event message described in the following table provides the following log event details: SonicOS Category Displays the SonicOS Software category event type. Legacy Category Displays the SonicWALL Firmware Software category event type. Priority Level Displays the level of urgency of the log event message. Log Message ID Number Displays the ID number of the log event message. SNMP Trap Type Displays the SNMP Trap ID number of the log event message. Log Event Messages "As per Diagnostic Autorestart configuration request, restarting system" #Web site hit SonicOS Category Legacy Category Priority Level Log SNMP Messa TrapT ge ID ype Numb er Firewall Event --- Info Simple Network Traffic Connection Traffic Log Event Type Info Standard HTTP Traffic Report 6 SONICOS LOG EVENT REFERENCE GUIDE

7 %s Auto-dial failed: Current Connection Model is configured as Ethernet Only PPP Dial Up System Error Alert Simple Message %s Ethernet Port Down Firewall Event System Error Error Simple Message %s Ethernet Port Up Firewall Event System Error Warning Simple Message Dumped to at None --- Debug Unused *** Alert from SonicWALL None --- Debug Unused *** SonicWALL Registration Security Maintenance Warning Simple Update Needed: Restore s your existing security service subscriptions by clicking here b Management Wireless 80211bmgmt Info Simple A prior version of Firewall Event System Error Warning Simple preferences was loaded because the most recent preferences file was inaccessible A SonicOS Standard to Firewall Event Maintenance Info Simple Enhanced Upgrade was performed attempt from host Security Maintenance Info Standard out of compliance with s GSC policy attempt from host without Anti-Virus agent installed Security s Maintenance Info Standard attempt from host Security Maintenance Info Standard without GSC installed s rule added Firewall Rule User Activity Info Simple Rule rule deleted Firewall Rule User Activity Info Simple Rule rule modified Firewall Rule User Activity Info Simple Rule rules restored to defaults to proxy server denied Active Backup detects Active Primary: Backup going Idle Firewall Rule User Activity Info Unused Network High Availability Blocked Sites Notice Standard Note Blocked Maintenance Info Unused ActiveX access denied Network Blocked Code Notice Standard Note Blocked ActiveX or Java archive access denied Network Blocked Code Notice Standard Note Blocked AD Connector %s response timed-out; Microsoft Active --- Error Standard Message applying caching policy Directory Add an attack message Firewall Event Attack Error Simple SONICOS LOG EVENT REFERENCE GUIDE 7

8 Added host entry to dynamic address object Dynamic Address Objects Maintenance Info Standard Adding dynamic entry for Network --- Info Standard Note bound MAC address Ethernet Network Adding L2TP IP pool L2TP Server System Error Error Simple address object Failed. Adding to multicast policy Multicast --- Debug Standard list, interface : %s Message Adding to Multicast policy Multicast --- Debug Standard list, VPN SPI : %s Message Administrator logged out User Activity Info Standard Note Administrator logged out - User Activity Info Standard inactivity timer expired Administrator login allowed User Activity Info Standard Administrator login denied due to bad credentials Attack Alert Standard Administrator login denied from %s; logins disabled from this interface Administrator name changed Agent returned no user name All DDNS associations have been deleted All preference values have been set to factory default values Allowed LDAP server certificate with wrong host name Anti-Spyware detection alert: %s Anti-Spyware prevention alert: %s Anti-Spyware service expired Anti-Virus agent out-ofdate on host Anti-Virus licenses exceeded Application Filter detection Alert: %s Application filters block alert: %s Application firewall alert: %s Attack Alert Standard Message Maintenance Info Standard CIA User Activity Warning Standard DDNS Maintenance Info Simple Firewall Event System Error Warning Simple RADIUS User Activity Warning Standard Note Intrusion Intrusion Security s Security s Security s Intrusion Intrusion Network Attack Alert Standard As Message Attack Alert Standard As Message Maintenance Warning Simple Maintenance Info Standard Maintenance Info Standard Attack Alert Standard Message Attack Alert Standard Message User Activity Alert Standard Application Firewall Message 8 SONICOS LOG EVENT REFERENCE GUIDE

9 ARP request packet received Network --- Info Standard Note Ethernet Network ARP request packet sent Network --- Info Standard Note Ethernet Network ARP response packet received Network --- Info Standard Note Ethernet Network ARP response packet sent Network --- Info Standard Note Ethernet Network ARP timeout Network Debug Debug Standard ARP unused/spare Network --- Debug Unused ARS unused/spare Unused --- Debug Unused ARS unused/spare Unused --- Debug Unused ARS unused/spare Unused --- Debug Unused ARS unused/spare Unused --- Debug Unused Association Flood from WLAN station WLAN IDS WLAN IDs Alert Simple timeout User Activity Info Simple during Remotely Triggered Dial-out session AV unused/spare Unused --- Debug Unused Back orifice attack Intrusion Attack Alert Standard Backup active High System Error Info Simple Availability Backup firewall being High System Error Error Simple preempted by Primary Availability Backup firewall has High Maintenance Info Simple transitioned to Active Availability Backup firewall has High Maintenance Info Simple transitioned to Idle Availability Backup firewall rebooting High itself as it transitioned Availability from Active to Idle while Preempt Backup going active in High preempt mode after Availability reboot Backup missed High heartbeats from Primary Availability Backup received error High signal from Primary Availability Backup received High heartbeat from wrong Availability source Backup received reboot High signal from Primary Availability Backup shut down High because license is Availability expired Backup WAN link down, High Primary going Active Availability Backup will be shut down High in %s minutes Availability --- Info Simple System Error Error Simple System Error Error Simple System Error Error Simple Maintenance Info Unused System Error Error Simple System Error Error Simple System Error Error Unused System Error Error Simple Message SONICOS LOG EVENT REFERENCE GUIDE 9

10 Bad CRL format VPN PKI User Activity Alert Simple Bind to LDAP server failed RADIUS System Error Error Simple Note Blocked Quick Mode for VPN Client System Error Error Standard Client using Default Key ID BOOTP Client IP address BOOTP Maintenance Info Standard on LAN conflicts with remote device IP, deleting IP address from remote table BOOTP reply relayed to local device BOOTP Maintenance Info Standard BOOTP Request received from remote BOOTP Debug Debug Standard device BOOTP server response BOOTP Debug Debug Standard relayed to remote device Broadcast packet Network Debug Debug Standard Note Protocol Cannot connect to the CRL server VPN PKI User Activity Alert Simple Cannot Validate Issuer Path VPN PKI User Activity Alert Simple Category: None --- Debug Unused Certificate on Revoked list(crl) VPN PKI User Activity Alert Simple CFL auto-download Security Maintenance Info Simple disabled, time problem detected s Chat %s PPP Dial Up User Activity Info Standard Message Chat completed PPP Dial Up User Activity Info Standard Message Chat failed: %s PPP Dial Up User Activity Info Standard Message Chat started PPP Dial Up User Activity Info Standard Message Chat started by '%s' PPP Dial Up User Activity Info Standard Message Chat wrote '%s' PPP Dial Up User Activity Info Standard Message CLI administrator logged User Activity Info Simple out CLI administrator login allowed User Activity Info Standard Note CLI administrator login denied due to bad User Activity Warning Standard Note credentials Code: None --- Debug Unused Computed hash does not VPN IKE User Activity Warning Standard match hash received from peer; preshared key mismatch 10 SONICOS LOG EVENT REFERENCE GUIDE

11 Configuration mode administration session ended Configuration mode administration session started Connection closed User Activity Info Standard Note User Activity Info Standard Note Network Traffic Connection Traffic Info Standard Traffic Report Connection opened Network Traffic Connection Info Standard Note Protocol Connection timed out VPN PKI User Activity Alert Simple Content filter subscription Security System Error Error Unused expired. s Cookie removed Network Blocked Code Notice Standard CRL has expired VPN PKI User Activity Alert Simple CRL loaded from VPN PKI User Activity Info Simple CRL missing - Issuer requires CRL checking. VPN PKI User Activity Alert Simple CRL validation failure for VPN PKI User Activity Alert Simple Root Certificate Crypto DES test failed Crypto Test Maintenance Error Simple Crypto DH test failed Crypto Test Maintenance Error Simple Crypto hardware 3DES Crypto Test Maintenance Error Simple test failed Crypto hardware 3DES Crypto Test Maintenance Error Simple with SHA test failed Crypto hardware AES Crypto Test Maintenance Error Standard test failed Crypto hardware DES Crypto Test Maintenance Error Simple test failed Crypto hardware DES Crypto Test Maintenance Error Simple with SHA test failed Crypto Hmac-MD5 fest Crypto Test Maintenance Error Simple failed Crypto Hmac-Sha1 test Crypto Test Maintenance Error Simple failed Crypto MD5 test failed Crypto Test Maintenance Error Simple Crypto RSA test failed Crypto Test Maintenance Error Simple Crypto SHA1 based Crypto Test --- Error Simple DRNG KAT test failed Crypto Sha1 test failed Crypto Test Maintenance Error Simple DDNS association %s disabled DDNS Maintenance Info Simple Message DDNS association %s enabled DDNS Maintenance Info Simple Message DDNS association %s added DDNS Maintenance Info Simple Message DDNS association %s deactivated DDNS Maintenance Info Simple Message DDNS association %s deleted DDNS Maintenance Info Simple Message SONICOS LOG EVENT REFERENCE GUIDE 11

12 DDNS Association %s put on line DDNS Maintenance Info Simple Message DDNS association %s taken Offline locally DDNS Maintenance Info Simple Message DDNS failure: provider %s DDNS System Error Error Simple Message DDNS failure: Provider %s DDNS System Error Error Simple Message DDNS failure: Provider %s DDNS System Error Error Simple Message DDNS update success for domain %s DDNS Maintenance Info Standard Message DDNS warning: Provider %s DDNS System Error Warning Simple Message Deleting from Multicast policy list, interface: %s Multicast --- Debug Standard Message Deleting from multicast policy list, VPN SPI: %s Multicast --- Debug Standard Message Deleting IPsec SA VPN IKE User Activity Info Standard Note SPI Deleting IPsec SA for VPN IKE User Activity Info Unused destination IP address connection status: %s Firewall Event --- Info Standard Message : None --- Debug Unused DHCP client enabled but DHCP Client Maintenance Info Simple not ready DHCP Client did not get DHCP Client Maintenance Info Standard DHCP ACK. DHCP Client failed to DHCP Client Maintenance Info Standard verify and lease has expired. Go to INIT state. DHCP Client failed to DHCP Client Maintenance Info Unused verify and lease is still valid. Go to BOUND state. DHCP Client got a new IP DHCP Client Maintenance Info Standard address lease. DHCP Client got ACK from server. DHCP Client Maintenance Info Standard DHCP Client got NACK. DHCP Client Maintenance Info Standard DHCP Client is declining address offered by the server. DHCP Client Maintenance Info Standard DHCP Client sending REQUEST and going to REBIND state. DHCP Client sending REQUEST and going to RENEW state. DHCP DECLINE received from remote device DHCP Client Maintenance Info Standard DHCP Client Maintenance Info Standard DHCP Relay Debug Info Unused 12 SONICOS LOG EVENT REFERENCE GUIDE

13 DHCP DISCOVER DHCP Relay Debug Info Unused received from local device DHCP DISCOVER received from remote DHCP Relay Debug Info Standard device DHCP lease. Lease from Central DHCP Relay Maintenance Warning Standard Gateway conflicts with Relay IP DHCP lease. Lease from Central DHCP Relay Maintenance Warning Standard Gateway conflicts with Remote Management IP DHCP lease file in the Firewall Event System Error Warning Simple flash is corrupted; read failed DHCP lease relayed to local device DHCP Relay Maintenance Info Standard DHCP lease relayed to remote device DHCP Relay Debug Info Standard DHCP lease to LAN device conflicts with DHCP Relay Maintenance Info Standard remote device, deleting remote IP entry DHCP leases written to Firewall Event Maintenance Info Simple flash DHCP NACK received from server DHCP Relay Debug Info Standard DHCP OFFER received from server DHCP Relay Debug Info Standard DHCP Ranges altered automatically due to Firewall Event --- Info Simple Message change in network settings for interface %s DHCP RELEASE received from remote DHCP Relay Debug Info Standard device DHCP RELEASE relayed DHCP Relay Maintenance Info Standard to Central Gateway DHCP REQUEST DHCP Relay Debug Info Unused received from local device DHCP REQUEST received from remote DHCP Relay Debug Info Standard device DHCP Server not DHCP Client Maintenance Info Standard available. Did not get any DHCP OFFER. DHCP Server: IP conflict Firewall Event --- Alert Standard detected DHCP Server: Received DHCP decline from client Firewall Event --- Alert Standard Diagnostic Auto-restart canceled Firewall Event --- Info Simple SONICOS LOG EVENT REFERENCE GUIDE 13

14 Diagnostic Auto-restart scheduled for %s minutes from now Diagnostic Code A Firewall Event --- Info Simple Message Firewall Hardware System Error Error Simple Note Diagnostic Code B Firewall Hardware System Error Error Simple Note Diagnostic Code C Firewall Hardware System Error Error Simple Note Diagnostic Code D Firewall Hardware System Error Error Standard Note Code Diagnostic Code E VPN IPsec System Error Error Standard Note Code Diagnostic Code F Firewall Hardware System Error Error Simple Note Diagnostic Code G Firewall Hardware System Error Error Simple Note Diagnostic Code H Firewall Hardware System Error Error Simple Note Diagnostic Code I Firewall Hardware System Error Error Simple Note Diagnostic Code J Firewall Hardware System Error Error Simple Note Dial-up: Session initiated PPP Dial Up --- Info Standard by data packet Dial-up: Traffic generated PPP Dial Up --- Info Standard by '%s' Message Disconnecting L2TP Tunnel due to traffic timeout L2TP Client Maintenance Info Simple Disconnecting PPPoE due to traffic timeout Disconnecting PPTP Tunnel due to traffic timeout PPPoE Maintenance Info Simple PPTP Maintenance Info Simple Discovered HA %s Firewall High Availability --- Info Simple Message Discovered HA Backup High Maintenance Info Simple Firewall Availability DNS packet allowed Network Debug Info Standard Policy Drop WLAN traffic from Intrusion Attack Error Standard non-sonicpoint devices Duplicate packet Network Debug Debug Unused Dynamic IPsec client connected VPN IPsec User Activity Info Standard EIGRP packet Network Debug Notice Standard Note fragment Intrusion Attack Error Standard Entering FIPS ERROR Crypto Test Maintenance Error Unused state Entering FIPS Error State. Crypto Test System Error Error Unused 14 SONICOS LOG EVENT REFERENCE GUIDE

15 Error initializing Hardware Firewall Maintenance Error Simple acceleration for VPN Hardware Error Rebooting HA Peer High System Error Error Simple Firewall Availability Error setting the IP High System Error Error Simple address of the backup, please manually set to backup LAN IP Availability Error synchronizing HA peer firewall (%s) High Availability System Error Error Simple Message Error updating HA peer High System Error Error Unused configuration Availability ERROR: DHCP over DHCP Relay Maintenance Info Unused VPN policy is not defined. Cannot start IKE. Exceeded Max multicast Multicast --- Warning Standard address limit Failed payload validation VPN IKE User Activity Warning Standard Note Failed payload verification after VPN IKE User Activity Warning Standard Note decryption; possible preshared key mismatch Failed to find certificate VPN PKI User Activity Alert Simple Failed to get CRL from VPN PKI User Activity Alert Simple Failed to Process CRL from VPN PKI User Activity Alert Simple Failed to resolve name Network Maintenance Info Simple Failed to synchronize license information with Security s Maintenance Warning Simple Message Licensing Server. Please see help.mysonicwall.com/ licsyncfail.html (code: %s) Failed to synchronize DHCP Relay System Error Warning Standard Relay IP Table Failed to write DHCP Firewall Event System Error Warning Simple leases to flash Failure to add data Unused Debug Debug Standard channel Failure to reach Interface High System Error Error Simple Message %s probe Availability Fan Failure Firewall System Alert Simple Hardware Environment FIN Flood Blacklist on IF %s continues Intrusion Debug Warning Simple Message FIN-Flooding machine Intrusion Debug Alert Simple Message %s blacklisted Forbidden attachment deleted Intrusion Attack Error Standard SONICOS LOG EVENT REFERENCE GUIDE 15

16 Forbidden attachment disabled Intrusion Attack Alert Standard Found Rogue Point WLAN IDS WLAN IDs Alert Simple Found Rogue Point WLAN IDS WLAN IDs Alert Simple Fragmented packet Network TCP UDP ICMP Notice Standard Note Protocol Fraudulent Microsoft Intrusion Attack Error Standard certificate found; access denied FTP: Data connection Network Attack Alert Standard from non default port FTP: PASV response bounce attack. Intrusion Attack Alert Standard Note FTP: PASV response Intrusion Attack Error Standard spoof attack FTP: PORT bounce attack. Intrusion Attack Alert Standard Note Gateway Anti-Virus Alert: Security Attack Alert Standard %s s Message Gateway Anti-Virus Security Maintenance Warning Simple expired s Global VPN Client VPN Client System Error Info Standard connection is not allowed. Appliance is not registered. Global VPN Client VPN Client System Error Info Standard License Exceeded: Connection denied. Global VPN Client version cannot enforce VPN Client User Activity Info Standard personal firewall. Minimum Version required is 2.1 Got DHCP OFFER. Selecting. DHCP Client Maintenance Info Standard GSC policy out-of-date Security Maintenance Info Standard on host s Guest account '%s' created User Activity Info Standard Message Guest account '%s' deleted User Activity Info Standard Message Guest account '%s' disabled User Activity Info Standard Message Guest account '%s' pruned User Activity Info Standard Message Guest account '%s' re- User Activity Info Standard enabled Guest account '%s' regenerated Message User Activity Info Standard Message 16 SONICOS LOG EVENT REFERENCE GUIDE

17 Guest login denied. Guest '%s' is already logged in. Please try again later. GUI administration User Activity Info Standard Message User Activity Info Standard Note session ended H.323/H.225 Connect VOIP VOIP Debug Standard Note H.323/H.225 Setup VOIP VOIP Debug Standard Note H.323/H.245 Address VOIP VOIP Debug Standard Note H.323/H.245 End Session H.323/RAS Admission Confirm H.323/RAS Admission Reject H.323/RAS Admission Request H.323/RAS Bandwidth Reject H.323/RAS Disengage Confirm H.323/RAS Disengage Reject H.323/RAS Gatekeeper Reject H.323/RAS Location Confirm H.323/RAS Location Reject H.323/RAS Registration Reject H.323/RAS Unknown Message Response H.323/RAS Unregistration Reject HA packet processing error HA Peer Firewall Rebooted HA Peer Firewall Synchronized Hardware Failover settings were not upgraded. VOIP VOIP Debug Standard Note VOIP VOIP Debug Standard Note VOIP VOIP Debug Standard Note VOIP VOIP Debug Standard Note VOIP VOIP Debug Standard Note VOIP VOIP Debug Standard Note VOIP VOIP Debug Standard Note VOIP VOIP Debug Standard Note VOIP VOIP Debug Standard Note VOIP VOIP Debug Standard Note VOIP VOIP Debug Standard Note VOIP VOIP Debug Standard Note VOIP VOIP Debug Standard Note High Maintenance Info Simple Availability High Maintenance Info Simple Availability High Maintenance Info Simple Availability Firewall Event Maintenance Info Simple Header verification failed VPN IKE User Activity Warning Standard Heartbeat received from High Maintenance Info Unused incompatible source Availability HTTP management port has changed Firewall Event Maintenance Info Simple Note HTTP method detected; examining stream for host header Network TCP Debug Standard Policy SONICOS LOG EVENT REFERENCE GUIDE 17

18 HTTPS management port Firewall Event Maintenance Info Simple Note has changed ICMP checksum error Network UDP Notice Standard ICMP packet allowed Network Debug Info Standard Policy ICMP packet Network ICMP Notice Standard Policy due to policy ICMP packet no Network ICMP Notice Standard ICMP match ICMP packet from LAN allowed Network Debug Info Standard ICMP ICMP packet from LAN Network LAN ICMP LAN TCP Notice Standard ICMP If not already enabled, enabling NTP is recommended Firewall Hardware System Error Warning Simple IGMP packet, wrong checksum received on interface %s IGMP Leave group message Received on interface %s IGMP packet, decoding error IGMP Packet Not handled. Packet type : %s IGMP querier Router detected on interface %s IGMP querier Router detected on VPN tunnel, SPI %S IGMP state table entry time out, deleting interface : %s for multicast address : %s IGMP state table entry time out, deleting VPN SPI :%s for Multicast address : %s IGMP V2 client joined multicast Group : %s IGMP V2 Membership report received from interface %s IGMP V3 client joined multicast Group : %s IGMP V3 Membership report received from interface %s IGMP V3 packet, unsupported Record type : %s Multicast --- Notice Standard Message Multicast --- Info Standard Message Multicast --- Notice Standard Multicast --- Notice Standard Message Multicast --- Debug Standard Message Multicast --- Debug Standard Message Multicast --- Debug Standard Message Multicast --- Debug Standard Message Multicast --- Info Standard Message Multicast --- Debug Standard Message Multicast --- Info Standard Message Multicast --- Debug Standard Message Multicast --- Notice Standard Message 18 SONICOS LOG EVENT REFERENCE GUIDE

19 IGMP V3 record type : %s not Handled Multicast --- Debug Standard Message IKE Initiator drop: VPN VPN IKE User Activity Info Standard tunnel end point does not match configured VPN Policy Bound to scope IKE Initiator: Accepting IPsec proposal (Phase 2) VPN IKE User Activity Info Standard Note IKE Initiator: Accepting peer lifetime. (Phase 1) VPN IKE User Activity Info Standard IKE Initiator: Aggressive Mode complete (Phase VPN IKE User Activity Info Standard Note 1). IKE Initiator: IKE proposal VPN IKE User Activity Warning Standard Note does not match (Phase 1) IKE Initiator: Main Mode complete (Phase 1) VPN IKE User Activity Info Standard Note IKE Initiator: Proposed IKE ID mismatch VPN IKE User Activity Warning Standard Note IKE Initiator: Remote party timeout - VPN IKE User Activity Info Standard Note Retransmitting IKE request. IKE Initiator: Start Aggressive Mode VPN IKE User Activity Info Standard Note negotiation (Phase 1) IKE Initiator: Start Main Mode negotiation (Phase VPN IKE User Activity Info Standard Note 1) IKE Initiator: Start Quick Mode (Phase 2). VPN IKE User Activity Info Standard Note IKE Initiator: Using secondary gateway to VPN IKE User Activity Info Standard negotiate IKE negotiation aborted VPN IKE User Activity Info Standard Note due to timeout IKE negotiation complete. VPN IKE User Activity Info Standard Note Adding IPsec SA. (Phase 2) IKE Responder drop: VPN IKE User Activity Info Standard VPN tunnel end point does not match configured VPN Policy Bound to scope IKE Responder: %s VPN Client System Error Error Standard policy does not allow Message static IP for Virtual Adapter. IKE Responder: Accepting IPsec proposal (Phase 2) IKE Responder: Aggressive Mode complete (Phase 1) VPN IKE User Activity Info Standard Note VPN IKE User Activity Info Standard Note SONICOS LOG EVENT REFERENCE GUIDE 19

20 IKE Responder: AH authentication algorithm does not match IKE Responder: AH authentication key length does not match IKE Responder: AH authentication key rounds does not match IKE Responder: AH Perfect Forward Secrecy mismatch IKE Responder: Algorithms and/or keys do not match IKE Responder: Client Policy has no VPN Networks assigned. Check Configuration. IKE Responder: Default LAN gateway is not set but peer is proposing to use this SA as a default route IKE Responder: Default LAN gateway is set but peer is not proposing to use this SA as a default route IKE Responder: ESP authentication algorithm does not match IKE Responder: ESP authentication key length does not match IKE Responder: ESP authentication key rounds does not match IKE Responder: ESP encryption algorithm does not match IKE Responder: ESP encryption key length does not match IKE Responder: ESP encryption key rounds does not match IKE Responder: ESP Perfect Forward Secrecy mismatch IKE Responder: IKE Phase 1 exchange does not match VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE System Error Error Standard Note VPN IKE Attack Error Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Error Standard Note 20 SONICOS LOG EVENT REFERENCE GUIDE

21 IKE Responder: IKE proposal does not match (Phase 1) IKE Responder: IP Address already exists in the DHCP relay table. VPN IKE User Activity Warning Standard Note VPN Client System Error Error Standard Note Client traffic not allowed. IKE Responder: IP VPN IKE User Activity Warning Standard Note Compression algorithm does not match IKE Responder: IPsec VPN IKE User Activity Warning Standard Note proposal does not match (Phase 2) IKE Responder: IPsec VPN IKE User Activity Warning Standard Note protocol mismatch IKE Responder: Main VPN IKE User Activity Info Standard Note Mode complete (Phase 1) IKE Responder: Mode VPN IKE Debug Warning Standard %d - not transport mode. Message Number Xauth is required but not supported by peer. IKE Responder: Mode VPN IKE User Activity Warning Standard %d - not tunnel mode IKE Responder: No match for proposed remote network address IKE Responder: No matching Phase 1 ID found for proposed remote network IKE Responder: Peer's destination network does not match VPN policy's <b>local Network</b> IKE Responder: Peer's local network does not match VPN policy's <b> Network</b> IKE Responder: Phase 1 Method does not match IKE Responder: Phase 1 DH Group does not match IKE Responder: Phase 1 encryption algorithm does not match IKE Responder: Phase 1 encryption algorithm key length does not match IKE Responder: Phase 1 hash algorithm does not match Message Number VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note SONICOS LOG EVENT REFERENCE GUIDE 21

22 IKE Responder: Phase 1 XAUTH required but policy has no user name IKE Responder: Phase 1 XAUTH required but policy has no user password IKE Responder: Proposed IKE ID mismatch IKE Responder: Proposed local network is but SA has no LAN Default Gateway IKE Responder: Proposed remote network is but not DHCP relay nor default route IKE Responder: Received Aggressive Mode request (Phase 1) IKE Responder: Received Main Mode request (Phase 1) IKE Responder: Received Quick Mode Request (Phase 2) IKE Responder: Remote party timeout - Retransmitting IKE request. IKE Responder: Route table overrides VPN policy IKE Responder: Tunnel terminates inside firewall but proposed local network is not inside firewall IKE Responder: Tunnel terminates on DMZ but proposed local network is on LAN IKE Responder: Tunnel terminates on LAN but proposed local network is on DMZ IKE Responder: Tunnel terminates outside firewall but proposed local network is not NAT public address VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE System Error Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Info Standard Note VPN IKE User Activity Info Standard Note VPN IKE User Activity Info Standard Note VPN IKE User Activity Info Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note 22 SONICOS LOG EVENT REFERENCE GUIDE

23 IKE Responder: Tunnel terminates outside firewall but proposed remote network is not NAT public address VPN IKE User Activity Warning Standard Note IKE SA lifetime expired. VPN IKE User Activity Info Standard Note IKEv2 Accept IKE SA Proposal VPN IKE User Activity Info Standard Note IKEv2 Accept IPsec SA Proposal VPN IKE User Activity Info Standard Note IKEv2 successful VPN IKE User Activity Info Standard Note IKEv2 Decrypt packet failed VPN IKE User Activity Warning Standard Note IKEv2 Function sendto() failed to transmit packet. VPN IKE User Activity Error Standard Note IKEv2 IKE attribute not found VPN IKE User Activity Warning Standard Note IKEv2 IKE proposal does VPN IKE User Activity Warning Standard Note not match IKEv2 Initiator: Negotiations failed. Extra payloads present. VPN IKE User Activity Warning Standard Note IKEv2 Initiator: Negotiations failed. Invalid input state. IKEv2 Initiator: Negotiations failed. Invalid output state. IKEv2 Initiator: Negotiations failed. Missing required payloads. VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note VPN IKE User Activity Warning Standard Note IKEv2 Initiator: Proposed VPN IKE User Activity Warning Standard Note IKE ID mismatch IKEv2 Initiator: Received VPN IKE User Activity Info Standard Note CREATE CHILD SA response IKEv2 Initiator: Received IKE AUTH response IKEv2 Initiator: Received IKE SA INT response IKEv2 Initiator: Remote party timeout - Retransmitting IKEv2 request. IKEv2 Initiator: Send CREATE CHILD SA request IKEv2 Initiator: Send IKE AUTH request IKEv2 Initiator: Send IKE SA INIT request VPN IKE User Activity Info Standard Note VPN IKE User Activity Info Standard Note VPN IKE User Activity Info Standard Note VPN IKE User Activity Info Standard Note VPN IKE User Activity Info Standard Note VPN IKE User Activity Info Standard Note SONICOS LOG EVENT REFERENCE GUIDE 23

24 IKEv2 Invalid SPI size VPN IKE User Activity Warning Standard Note IKEv2 Invalid state VPN IKE User Activity Warning Standard Note IKEv2 IPsec attribute not VPN IKE User Activity Warning Standard Note found IKEv2 IPsec proposal does not match VPN IKE User Activity Warning Standard Note IKEv2 NAT device detected between VPN IKE User Activity Info Standard Note negotiating peers IKEv2 negotiation complete VPN IKE User Activity Info Standard Note IKEv2 No NAT device detected between VPN IKE User Activity Info Standard Note negotiating peers IKEv2 Out of memory VPN IKE User Activity Warning Standard Note IKEv2 Payload processing error VPN IKE User Activity Warning Standard Note IKEv2 Payload validation VPN IKE User Activity Warning Standard Note failed. IKEv2 Peer is not responding. Negotiation VPN IKE User Activity Warning Standard Note aborted. IKEv2 Process Message queue failed VPN IKE User Activity Warning Standard Note IKEv2 Received delete IKE SA request VPN IKE User Activity Info Standard Note IKEv2 Received delete IKE SA response VPN IKE User Activity Info Standard Note IKEv2 Received delete IPsec SA request VPN IKE User Activity Info Standard Note IKEv2 Received delete IPsec SA response VPN IKE User Activity Info Standard Note IKEv2 Received notify error payload VPN IKE User Activity Warning Standard Note IKEv2 Received notify VPN IKE User Activity Info Standard Note status payload IKEv2 Responder: Peer's destination network does not match VPN policy's <b>local Network</b> IKEv2 Responder: Peer's local network does not match VPN policy's <b> Network</b> IKEv2 Responder: Policy for remote IKE ID not found IKEv2 Responder: Received CREATE CHILD SA request VPN IKE User Activity Info Standard Note VPN IKE User Activity Info Standard Note VPN IKE User Activity Error Standard Note VPN IKE User Activity Info Standard Note 24 SONICOS LOG EVENT REFERENCE GUIDE

25 IKEv2 Responder: Received IKE AUTH VPN IKE User Activity Info Standard Note request IKEv2 Responder: Received IKE SA INIT VPN IKE User Activity Info Standard Note request IKEv2 Responder: Send CREATE CHILD SA VPN IKE User Activity Info Standard Note response IKEv2 Responder: Send IKE AUTH response VPN IKE User Activity Info Standard Note IKEv2 Responder: Send IKE SA INIT response VPN IKE User Activity Info Standard Note IKEv2 Send delete IKE SA request VPN IKE User Activity Info Standard Note IKEv2 Send delete IKE SA response VPN IKE User Activity Info Standard Note IKEv2 Send delete IPsec VPN IKE User Activity Info Standard Note SA request IKEv2 Send delete IPsec VPN IKE User Activity Info Standard Note SA response IKEv2 Unable to find IKE VPN IKE User Activity Warning Standard Note SA IKEv2 VPN Policy not found VPN IKE User Activity Warning Standard Note Illegal IPsec SPI VPN IPsec User Activity Info Standard Imported HA hardware ID High Maintenance Info Unused did not match this firewall Availability Imported VPN SA is invalid - disabled Firewall Event Maintenance Warning Standard Note Inbound connection from RBL --- Notice Standard RBL-listed SMTP server Incoming call received for User Activity Info Simple Remotely Triggered Dialout session Incompatible IPsec Security Association VPN IPsec User Activity Info Standard Incorrect authentication User Activity Info Simple received for Remotely Triggered Dial-out Ini Killer attack Intrusion Attack Alert Standard Interface %s Link Is Down Firewall Event System Error Error Simple Message Interface %s Link Is Up Firewall Event System Error Warning Simple Message Interface IP Assignment : Firewall Event Maintenance Info Simple Message Binding and initializing %s Interface IP Assignment changed: Shutting down %s Firewall Event Maintenance Info Simple Message SONICOS LOG EVENT REFERENCE GUIDE 25

26 Interface statistics report GMS --- Info Simple Interface Stats Internet restricted Wireless TCP UDP Warning Unused to authorized users. Dropped packet received in the clear. ICMP Invalid Product Code Upgrade request received: %s Invalid VLAN packet IP address conflict detected from Ethernet address %s Firewall Event --- Error Standard Message Network --- Alert Standard Note Network Maintenance Warning Standard Message IP Header checksum Network TCP UDP Notice Standard error IP spoof detected on packet to Central DHCP Relay Attack Error Standard Note Ethernet Network Gateway, packet IP spoof Intrusion Attack Alert Standard Note Ethernet Network IP type %s packet Network LAN UDP LAN TCP Notice Standard Message IP Comp connection IP Comp Debug Debug Standard interrupt IP Comp packet IP Comp TCP UDP ICMP Notice Standard Note IP Comp packet ; IP Comp Debug Debug Standard waiting for pending IP Comp connection IPS Alert: %s IPS Alert: %s IPS Prevention Alert: %s IPS Prevention Alert: %s IPsec (AH) packet IPsec (AH) packet ; waiting for pending IPsec connection Intrusion Attack Alert Standard IDP Message Intrusion Attack Alert Standard Message Intrusion Attack Alert Standard IDP Message Intrusion Attack Alert Standard Message VPN IPsec TCP UDP Notice Standard Note ICMP VPN IPsec Debug Debug Standard IPsec (ESP) packet VPN IPsec TCP UDP ICMP Notice Standard Note IPsec (ESP) packet ; waiting for pending IPsec connection VPN IPsec Debug Debug Standard IPsec Failed VPN IPsec Attack Error Standard IPsec connection Network Debug Debug Standard interrupt IPsec Decryption Failed VPN IPsec Attack Error Standard 26 SONICOS LOG EVENT REFERENCE GUIDE

27 IPsec packet Network IPsec packet ; Network waiting for pending IPsec connection IPsec packet from an TCP UDP Notice Standard ICMP Debug Debug Standard VPN IPsec Maintenance Info Standard VPN IPsec Attack Error Standard illegal host IPsec packet from or to an illegal host IPsec Replay Detected VPN IPsec Attack Alert Standard Note IPsec SA lifetime expired. VPN IPsec User Activity Info Unused IPsec Tunnel status VPN VPN Tunnel Info Simple changed Status ISDN Driver Firmware Firewall Event Maintenance Info Simple successfully updated Issuer match failed VPN PKI User Activity Alert Simple Java access denied Network Blocked Code Notice Standard Note Blocked L2TP Connect Initiated L2TP Client Maintenance Info Unused by the User L2TP Disconnect Initiated L2TP Client Maintenance Info Unused by the User L2TP enabled but not Unused Maintenance Info Simple ready L2TP LCP Down L2TP Client Maintenance Info Unused L2TP LCP Up L2TP Client Maintenance Info Unused L2TP Max L2TP Client Maintenance Info Simple Retransmission Exceeded L2TP PPP L2TP Client Maintenance Info Simple Failed L2TP PPP Down L2TP Client Maintenance Info Simple L2TP PPP link down L2TP Client Maintenance Info Simple L2TP PPP Negotiation L2TP Client Maintenance Info Simple Started L2TP PPP Session Up L2TP Client Maintenance Info Simple L2TP Server: L2TP Server Maintenance Info Unused from L2TP VPN Client Privilege not enabled for RADIUS Users. L2TP Server : Deleting the L2TP active Session L2TP Server Maintenance Info Standard L2TP Server: Deleting the Tunnel L2TP Server Maintenance Info Standard L2TP Server: L2TP PPP L2TP Server Maintenance Info Unused Session Established. L2TP Server: L2TP Session Established. L2TP Server Maintenance Info Standard L2TP Server: L2TP Tunnel Established. L2TP Server Maintenance Info Standard L2TP Server : Retransmission Timeout, Deleting the Tunnel L2TP Server Maintenance Info Standard SONICOS LOG EVENT REFERENCE GUIDE 27

28 L2TP Server: User Name L2TP Server Maintenance Info Standard authentication Failure locally. L2TP Server: Keep alive L2TP Server Maintenance Info Unused Failure. Closing Tunnel L2TP Server: L2TP L2TP Server Maintenance Info Unused Remote terminated the PPP session L2TP Server: L2TP L2TP Server Maintenance Info Unused Session Disconnect from the Remote. L2TP Server: L2TP L2TP Server Maintenance Info Unused Tunnel Disconnect from the Remote. L2TP Server: Local Failure L2TP Server Maintenance Info Standard L2TP Server: Local Success. L2TP Server Maintenance Info Standard L2TP Server: No IP L2TP Server Maintenance Info Unused address available in the Local IP Pool L2TP Server: RADIUS/ LDAP Success L2TP Server Maintenance Info Standard L2TP Server: RADIUS/ LDAP reports Failure L2TP Server: RADIUS/ LDAP server not assigned IP address L2TP Server Maintenance Info Standard L2TP Server Maintenance Info Standard L2TP Server: Call Disconnect from Remote. L2TP Server Maintenance Info Standard L2TP Server: Tunnel Disconnect from Remote. L2TP Server Maintenance Info Standard L2TP Session Disconnect L2TP Client Maintenance Info Simple from Remote L2TP Session L2TP Client Maintenance Info Simple Established L2TP Session L2TP Client Maintenance Info Simple Negotiation Started L2TP Tunnel Disconnect L2TP Client Maintenance Info Simple from Remote L2TP Tunnel Established L2TP Client Maintenance Info Simple L2TP Tunnel Negotiation L2TP Client Maintenance Info Simple Started LAN Subnet configurations were not upgraded. Firewall Event Maintenance Info Simple Land attack LDAP server does not allow CHAP Intrusion Attack Alert Standard RADIUS User Activity Warning Standard 28 SONICOS LOG EVENT REFERENCE GUIDE

29 LDAP using nonadministrative account - VPN client user will not be able to change passwords License exceeded: Connection because too many IP addresses are in use on your LAN License of HA pair doesn't match: %s RADIUS System Error Warning Simple Note Firewall Event System Error Error Standard High Availability System Error Error Simple Message local range: None --- Debug Unused Local user login allowed User Activity Info Standard Local user login denied - user already logged in User Activity Info Standard Local user login denied due to bad credentials User Activity Info Standard Locked-out user logins allowed - lockout period expired User Activity Info Standard Note Locked-out user logins allowed by administrator User Activity Info Standard Note Log (part None --- Debug Unused Log Cleared Firewall Maintenance Info Simple Logging Log Debug Firewall Event Debug Error Simple Log file from SonicWALL None --- Debug Unused Log full; deactivating Firewall System Error Error Unused SonicWALL Logging Log successfully sent via Firewall Maintenance Info Simple Logging Login screen timed out User Activity Info Standard MAC address collides with Static ARP Entry with Bound MAC address; packet Network --- Notice Standard Note Ethernet Network Machine %s removed from FIN flood blacklist Machine %s removed from RST flood blacklist Machine %s removed from SYN flood blacklist Malformed or unhandled IP packet Maximum events per second threshold exceeded Intrusion Intrusion Intrusion Network Firewall Logging Debug Alert Simple Message Debug Alert Simple Message Debug Alert Simple Message Debug Alert Standard System Error Critical Simple SONICOS LOG EVENT REFERENCE GUIDE 29

30 Maximum number of Bandwidth Managed rules exceeded upon upgrade to this version. Some Bandwidth settings ignored. Maximum sequential failed dial attempts (10) to a single dial-up number: Firewall Event Maintenance Notice Unused PPP Dial Up Attack Error Standard Message %s Maximum syslog data per Firewall System Error Critical Simple second threshold Logging exceeded MTU: None --- Debug Unused Multicast application %s Multicast --- Info Standard not supported Message Multicast packet, Multicast --- Alert Standard Invalid src IP received on Message interface : %s Multicast packet, wrong MAC address received on interface : %s Multicast TCP packet Multicast UDP packet, no state entry Multicast UDP packet, RTCP stateful failed Multicast UDP packet, RTP stateful failed NAT could not remap incoming packet NAT device may not support IPsec AH passthrough NAT Discovery : No NAT/ NAPT device detected between IPsec Security gateways NAT Discovery : Local IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Peer IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Peer IPsec Security Gateway doesn't support VPN NAT Traversal Multicast --- Alert Standard Message Multicast --- Notice Standard Multicast --- Notice Standard Multicast --- Warning Standard Multicast --- Warning Standard Unused System Error Error Unused VPN IPsec Maintenance Info Simple VPN IKE User Activity Info Standard Note VPN IKE User Activity Info Standard Note VPN IKE User Activity Info Standard Note VPN IKE User Activity Info Standard Note 30 SONICOS LOG EVENT REFERENCE GUIDE

31 NAT translated packet exceeds size limit, packet Net Spy attack NetBIOS settings were not upgraded. Use Network>IP Helper to configure NetBIOS support NetBus attack Network for interface %s overlaps with another interface. Network Modem Mode Disabled: re-enabling NAT Network Modem Mode Enabled: turning off NAT Network Monitor: Host %s is offline Network Monitor: Host %s is online Network Debug Debug Standard Intrusion Attack Alert Standard Firewall Event Maintenance Info Simple Intrusion Attack Alert Standard Firewall Event Maintenance Info Simple Message PPP Dial Up Maintenance Info Simple PPP Dial Up Maintenance Info Simple Firewall Event Connection Alert Simple Message Firewall Event Connection Alert Simple Message New firmware available. Firewall Event Maintenance Info Unused New URL List loaded Security Maintenance Info Simple s Newsgroup access Network Blocked Sites Notice Standard Note allowed Blocked Newsgroup access Network Blocked Sites Notice Standard Note denied Blocked No Certificate for VPN PKI User Activity Alert Simple No HOST tag found in Network Debug Debug Unused HTTP request No ICMP redirect sent Unused Debug Debug Unused No new URL List Security Maintenance Info Simple available s No response from ISP PPPoE Maintenance Info Simple Disconnecting PPPoE. No response from PPTP PPTP Maintenance Info Simple server to call requests No response from PPTP PPTP Maintenance Info Simple server to control connection requests No response from server to Echo Requests, disconnecting PPTP Tunnel PPTP Maintenance Info Simple No valid DNS server RBL --- Error Simple specified for RBL lookups Non-config mode GUI administration session started User Activity Info Standard Note SONICOS LOG EVENT REFERENCE GUIDE 31

32 Not all configurations Firewall Event Maintenance Info Simple may have been completely upgraded Not enough memory to hold the CRL VPN PKI User Activity Warning Simple Obtained Relay IP Table DHCP Relay Maintenance Info Standard from Remote Gateway OCSP Failed to Resolve Domain Name. VPN PKI User Activity Error Standard Note OCSP Internal error handling received VPN PKI User Activity Error Standard Note response. OCSP received response VPN PKI User Activity Error Standard Note error. OCSP received response. VPN PKI User Activity Info Standard Note OCSP Resolved Domain VPN PKI User Activity Info Standard Note Name. OCSP send request message failed. VPN PKI User Activity Error Standard Note OCSP sending request. VPN PKI User Activity Info Standard Note OCSP unused/spare Unused --- Debug Unused Outbound connection to RBL --- Notice Standard RBL-listed SMTP server Out-of-order command Network Debug Debug Standard packet Overriding Product Code Firewall Event --- Error Standard Upgrade to: %s Message Packet destination not in VPN list VPN IPsec Attack Error Standard Packet Dropped - IP TTL Network Debug Warning Standard Note expired Packet by WLAN guest check Wireless TCP UDP ICMP Warning Standard Packet by WLAN SSL-VPN enforcement check Wireless TCP UDP ICMP Warning Standard Packet by WLAN vpn traversal check Packet. No firewall rule associated with VPN policy. Packet ; connection limit for this destination IP address has been reached Packet ; connection limit for this source IP address has been reached Wireless TCP UDP ICMP Warning Standard VPN System Error Alert Standard Note Firewall Event System Error Alert Standard Note Firewall Event System Error Alert Standard Note Payload processing failed VPN IKE Debug Error Standard Note 32 SONICOS LOG EVENT REFERENCE GUIDE

33 PC Card inserted. Rebooting. Firewall Hardware --- Alert Simple Message PC Card removed. Rebooting. Firewall Hardware --- Alert Simple Message PC Card: No device detected Firewall Hardware --- Alert Simple Message Peer firewall rebooting (%s) High Availability --- Info Simple Message Physical environment Firewall --- Info Simple normal Hardware Ping of death Intrusion Attack Alert Standard PKI Error: VPN PKI Maintenance Error Unused PKI Failure VPN PKI Maintenance Error Unused PKI Failure: CA VPN PKI Maintenance Error Simple certificates store exceeded. Cannot verify this Local Certificate PKI Failure: Cannot VPN PKI Maintenance Error Simple allocate memory PKI Failure: Certificate's VPN PKI Maintenance Error Simple ID does not match this SonicWALL PKI Failure: Duplicate VPN PKI Maintenance Error Simple local certificate PKI Failure: Duplicate VPN PKI Maintenance Error Simple local certificate name PKI Failure: Import failed VPN PKI Maintenance Error Simple PKI Failure: Improper file VPN PKI Maintenance Error Simple format. Please select PKCS#12 (*.p12) file PKI Failure: Incorrect VPN PKI Maintenance Error Simple admin password PKI Failure: Internal error VPN PKI Maintenance Error Simple PKI Failure: Loaded but VPN PKI Maintenance Error Simple could not verify certificate PKI Failure: Loaded the VPN PKI Maintenance Error Simple certificate but could not verify it's chain PKI Failure: No CA VPN PKI Maintenance Error Simple certificates yet loaded PKI Failure: Output buffer VPN PKI Maintenance Error Simple too small PKI Failure: public-private VPN PKI Maintenance Error Simple key mismatch PKI Failure: Reached the VPN PKI Maintenance Error Simple limit for local certificates, cant load any more PKI Failure: Temporary VPN PKI Maintenance Error Simple memory shortage, try again PKI Failure: The certificate chain has no root VPN PKI Maintenance Error Simple SONICOS LOG EVENT REFERENCE GUIDE 33

34 PKI Failure: The VPN PKI Maintenance Error Simple certificate chain is circular PKI Failure: The VPN PKI Maintenance Error Simple certificate chain is incomplete PKI Failure: The VPN PKI Maintenance Error Simple certificate or a certificate in the chain has a bad signature PKI Failure: The VPN PKI Maintenance Error Simple certificate or a certificate in the chain has a validity period in the future PKI Failure: The VPN PKI Maintenance Error Simple certificate or a certificate in the chain has expired PKI Failure: The VPN PKI Maintenance Error Simple certificate or a certificate in the chain is corrupt Please connect interface Firewall Event Maintenance Info Simple Message %s to another network to function properly Please manually check all system configurations for correctness of Firewall Event Maintenance Info Simple Upgrade Port configured to receive Network IPsec protocol ONLY; drop packet received in the clear Possible FIN Flood on IF Intrusion %s Possible FIN Flood on IF Intrusion %s continues Possible FIN Flood on IF Intrusion %s has ceased Possible port scan Intrusion detected Possible RST Flood on IF Intrusion %s Possible RST Flood on IF Intrusion %s continues Possible RST Flood on IF Intrusion %s has ceased Possible SYN flood Intrusion attack detected Possible SYN flood Intrusion detected on WAN IF %s - switching to connectionproxy mode Possible SYN Flood on IF Intrusion %s Possible SYN Flood on IF Intrusion %s continues TCP UDP ICMP Warning Standard Debug Alert Simple Message Debug Warning Simple Message Debug Alert Simple Message Attack Alert Standard Note Debug Alert Simple Message Debug Warning Simple Message Debug Alert Simple Message Attack Warning Standard Debug Alert Simple Message Debug Alert Simple Message Debug Warning Simple Message 34 SONICOS LOG EVENT REFERENCE GUIDE

35 Possible SYN Flood on IF Intrusion Debug Alert Simple Message %s has ceased Power supply without Firewall --- Error Simple redundancy Hardware PPP Dial-Up: Connect PPP Dial Up User Activity Info Simple request canceled PPP Dial-Up: Connected PPP Dial Up User Activity Info Simple Message at %s bps - starting PPP PPP Dial-Up: Connection PPP Dial Up --- Info Standard disconnected as scheduled. PPP Dial-Up: Dial initiated by %s PPP Dial Up Maintenance Info Standard Message PPP Dial-Up: Dialed PPP Dial Up User Activity Info Simple number did not answer PPP Dial-Up: Dialed PPP Dial Up User Activity Info Simple number is busy PPP Dial-Up: Dialing not allowed by schedule. %s PPP Dial Up --- Info Standard Message PPP Dial-Up: Dialing: %s PPP Dial Up User Activity Info Simple Message PPP Dial-Up: Failed to PPP Dial Up User Activity Info Unused get IP address PPP Dial-Up: Idle time PPP Dial Up User Activity Info Simple limit exceeded - disconnecting PPP Dial-Up: Initialization PPP Dial Up User Activity Info Simple Message : %s PPP Dial-Up: Invalid DNS PPP Dial Up Maintenance Info Simple IP address returned from Dial-Up ISP; overriding using dial-up profile settings PPP Dial-Up: Link carrier PPP Dial Up User Activity Info Simple lost PPP Dial-Up: Manual PPP Dial Up User Activity Info Simple intervention needed. Check Primary Profile or Profile details PPP Dial-Up: Maximum PPP Dial Up User Activity Info Simple connection time exceeded - disconnecting PPP Dial-Up: No dialtone PPP Dial Up User Activity Info Simple detected - check phoneline connection PPP Dial-Up: No link PPP Dial Up User Activity Info Simple carrier detected - check phone number PPP Dial-Up: No peer IP PPP Dial Up Maintenance Info Simple address from Dial-Up ISP, local and remote IPs will be the same PPP Dial-Up: PPP link down PPP Dial Up User Activity Info Simple SONICOS LOG EVENT REFERENCE GUIDE 35

36 PPP Dial-Up: PPP link PPP Dial Up User Activity Info Simple established PPP Dial-Up: PPP PPP Dial Up User Activity Info Unused negotiation failed - disconnecting PPP Dial-Up: Previous session was connected PPP Dial Up User Activity Info Simple Message for %s PPP Dial-Up: Received PPP Dial Up User Activity Info Standard new IP address PPP Dial-Up: Shutting PPP Dial Up User Activity Info Simple down link PPP Dial-Up: Starting PPP PPP Dial Up --- Info Simple Message PPP Dial-Up: Startup PPP Dial Up User Activity Info Unused without Ethernet cable, will try to dial on outbound traffic PPP Dial-Up: The profile PPP Dial Up Maintenance Info Simple in use disabled VPN networking. PPP Dial-Up: Trying to WAN Failover User Activity Info Simple failover but Alternate Profile is manual PPP Dial-Up: Trying to PPP Dial Up User Activity Info Simple failover but Primary Profile is manual PPP Dial-Up: Unknown PPP Dial Up User Activity Info Simple dialing failure PPP Dial-Up: User PPP Dial Up User Activity Info Simple requested connect PPP Dial-Up: User PPP Dial Up User Activity Info Simple requested disconnect PPP Dial-Up: VPN PPP Dial Up Maintenance Info Simple networking restored. PPP message: %s PPP System Environment Info Standard Message PPP: PPP User Activity Info Simple successful PPP: CHAP PPP User Activity Info Simple authentication failed - check username / password PPP: MS-CHAP PPP User Activity Info Simple authentication failed - check username / password PPP: PAP authentication PPP User Activity Info Simple failed - check username / password PPP: Starting CHAP PPP User Activity Info Simple authentication PPP: Starting MS-CHAP authentication PPP User Activity Info Simple 36 SONICOS LOG EVENT REFERENCE GUIDE

37 PPP: Starting PAP PPP User Activity Info Simple authentication PPPoE terminated PPPoE Maintenance Info Simple PPPoE CHAP PPPoE Maintenance Info Unused authentication failed PPPoE Client: Previous session was connected PPPoE Maintenance Info Simple Message for %s PPPoE discovery PPPoE Maintenance Info Simple process complete PPPoE enabled but not PPPoE Maintenance Info Simple ready PPPoE LCP link down PPPoE Maintenance Info Simple PPPoE LCP link up PPPoE Maintenance Info Simple PPPoE network PPPoE Maintenance Info Simple connected PPPoE network PPPoE Maintenance Info Simple disconnected PPPoE PAP PPPoE Maintenance Info Unused authentication Failed PPPoE PAP PPPoE Maintenance Info Unused authentication Failed. Please verify PPPoE username and password PPPoE PAP PPPoE Maintenance Info Unused authentication success. PPPoE password User Activity Info Unused changed by administrator PPPoE starting CHAP PPPoE Maintenance Info Simple authentication PPPoE starting PAP PPPoE Maintenance Info Unused authentication PPPoE user name User Activity Info Unused changed by Administrator PPTP enabled but not PPTP Maintenance Info Simple ready PPTP CHAP PPTP Maintenance Info Unused authentication failed. Please verify PPTP username and password PPTP connect initiated by PPTP Maintenance Info Standard the User PPTP control connection PPTP Maintenance Info Simple Established PPTP control connection PPTP Maintenance Info Simple negotiation started PPTP decode failure PPTP Debug Debug Standard PPTP disconnect initiated PPTP Maintenance Info Standard by the user PPTP LCP down PPTP Maintenance Info Unused PPTP LCP up PPTP Maintenance Info Unused PPTP Max Retransmission Exceeded PPTP Maintenance Info Unused SONICOS LOG EVENT REFERENCE GUIDE 37

38 PPTP packet Network TCP UDP Notice Unused ICMP PPTP PAP authentication PPTP Maintenance Info Unused failed PPTP PAP authentication PPTP Maintenance Info Unused failed. Please verify PPTP username and password PPTP PAP authentication PPTP Maintenance Info Simple success. PPTP PPP authentication PPTP Maintenance Info Unused failed PPTP PPP down PPTP Maintenance Info Simple PPTP PPP link down PPTP Maintenance Info Unused PPTP PPP link down PPTP Maintenance Info Simple PPTP PPP link finished PPTP Maintenance Info Simple PPTP PPP link up PPTP Maintenance Info Simple PPTP PPP negotiation PPTP Maintenance Info Simple started PPTP PPP session up PPTP Maintenance Info Simple PPTP server is not PPTP Maintenance Info Simple responding, check if the server is UP and running. PPTP server rejected PPTP Maintenance Info Simple control connection PPTP server rejected the PPTP Maintenance Info Simple call request PPTP session disconnect PPTP Maintenance Info Simple from Remote PPTP session PPTP Maintenance Info Simple established PPTP session negotiation PPTP Maintenance Info Simple started PPTP starting CHAP PPTP Maintenance Info Simple authentication PPTP starting PAP PPTP Maintenance Info Simple authentication PPTP tunnel disconnect PPTP Maintenance Info Simple from Remote Primary firewall has High Maintenance Info Simple transitioned to Active Availability Primary firewall has High System Error Error Simple transitioned to Idle Availability Primary firewall High System Error Error Simple preempting backup Availability Primary firewall rebooting High --- Info Simple itself as it transitioned Availability from active to idle while preempt Primary missed High System Error Error Simple heartbeats from Backup Primary received error signal from Backup Availability High Availability System Error Error Simple 38 SONICOS LOG EVENT REFERENCE GUIDE

39 Primary received heartbeat from wrong source Primary received reboot signal from Backup Primary WAN link down, Backup going Active Primary WAN link down, Primary going Idle Primary WAN link up, preempting Backup Priority attack High Availability Maintenance Info Unused High Availability System Error Error Simple High System Error Error Unused Availability High Maintenance Info Unused Availability High Maintenance Info Unused Availability Intrusion Attack Alert Standard Probable port scan Intrusion Attack Alert Standard Note detected Probable TCP FIN scan Intrusion Attack Alert Standard Note detected Probable TCP NULL Intrusion Attack Alert Standard Note scan detected Probable TCP XMAS Intrusion Attack Alert Standard Note scan detected Probing failure on %s WAN Failover System Error Alert Standard Message Probing succeeded on WAN Failover System Error Alert Standard %s Message Problem loading the URL Security System Error Error Simple list; Appliance not s registered. Problem loading the URL Security list; check Filter settings s Problem loading the URL Security list; check your DNS s server Problem loading the URL Security list; Flash write failure. s Problem loading the URL Security list; Retrying later. s Problem loading the URL Security list; Subscription expired. s System Error Error Standard Note Code System Error Error Simple System Error Error Simple System Error Error Standard System Error Error Standard Problem loading the URL Security System Error Error Simple list; Try loading it again. s Problem occurred during User Activity Warning Standard Note user group membership retrieval Problem sending log Firewall System Error Warning Simple ; check log settings Logging Protocol: None --- Debug Unused Read-only mode GUI administration session started User Activity Info Standard Note Real time clock battery failure Time values may be incorrect Firewall Hardware System Error Warning Simple RealAudio decode failure Unused Debug Debug Unused SONICOS LOG EVENT REFERENCE GUIDE 39

40 Received a path MTU ICMP message from router/gateway Received a path MTU ICMP message from router/gateway Received Application Security Firewall alert: Your s SonicWALL Application Firewall (AF) subscription has expired. Received AV Alert: %s Security Received AV Alert: Your SonicWALL Network Anti-Virus subscription has expired. %s Received AV Alert: Your SonicWALL Network Anti-Virus subscription Network User Activity Info Standard Note SPI Network User Activity Info Standard Note Mtu s Security s Security s Maintenance Warning Simple Maintenance Warning Simple Message Maintenance Warning Simple Message Maintenance Warning Simple Message will expire in 7 days. %s Received CFS Alert: Your Security Maintenance Warning Simple SonicWALL content s filtering subscription has expired. Received CFS Alert: Your Security Maintenance Warning Simple SonicWALL content s filtering subscription will expire in 7 days. Received DHCP offer DHCP Client Maintenance Info Standard packet has errors Received filter Security Maintenance Warning Simple alert: Your SonicWALL E- s Mail filtering subscription has expired. Received filter alert: Your SonicWALL E- Mail filtering subscription will expire in 7 days. Received fragmented packet or fragmentation needed Received IKE SA delete request Received IPS alert: Your SonicWALL Intrusion Prevention (IDP) subscription has expired. Security s Maintenance Warning Simple Network Debug Debug Standard VPN IKE User Activity Info Standard Note Security Maintenance Warning Simple s Received IPsec SA delete request VPN IKE User Activity Info Standard Received ISAKMP packet VPN IKE Debug UDP Info Standard destined to port %s Message Received LCP Echo Reply PPPoE Maintenance Info Simple 40 SONICOS LOG EVENT REFERENCE GUIDE

41 Received LCP Echo PPPoE Maintenance Info Simple Request Received notify. NO PROPOSAL CHOSEN VPN IKE User Activity Warning Standard Note Received notify: INVALID VPN IKE User Activity Info Standard COOKIES Received notify: INVALID VPN IPsec User Activity Warning Standard Note ID INFO Received notify: INVALID VPN IKE User Activity Error Standard Note PAYLOAD Received notify: INVALID VPN IKE User Activity Info Standard SPI Received notify: ISAKMP VPN IKE User Activity Warning Standard AUTH FAILED Received notify: PAYLOAD MALFORMED VPN IKE User Activity Warning Standard Received notify: RESPONDER LIFETIME VPN IKE User Activity Info Standard Received packet retransmission. Drop VPN IKE User Activity Warning Standard Note duplicate packet Received PPPoE active PPPoE Maintenance Info Simple discovery Offer Received PPPoE active PPPoE Maintenance Info Simple discovery session confirmation Received response packet for DHCP request has errors DHCP Client Maintenance Info Standard Received unencrypted packet in crypto active state Regulatory requirements prohibit %s from being redialed for 30 minutes VPN IKE User Activity Warning Standard Note PPP Dial Up Attack Error Standard Message remote range: None --- Debug Unused Remotely triggered dialout session ended. Valid WAN bound data found. Normal dial-up sequence will commence User Activity Info Simple Remotely triggered dialout session started. Requesting authentication Removed host entry from dynamic address object Request for relay IP table from central gateway Dynamic Address Objects User Activity Info Simple Maintenance Info Standard DHCP Relay Maintenance Info Standard Requesting CRL from VPN PKI User Activity Info Simple SONICOS LOG EVENT REFERENCE GUIDE 41

42 Requesting relay IP table from remote gateway Restarting SonicWALL; dumping log to Retransmitting DHCP discover Retransmitting DHCP request (Rebinding). Retransmitting DHCP request (Rebooting). Retransmitting DHCP request (Renewing). Retransmitting DHCP request (Requesting). Retransmitting DHCP request (Verifying). RIP Broadcasts for LAN Network %s are being broadcast over Dial Upconnection RIP disabled on DMZ interface RIP disabled on interface %s RIP disabled on WAN interface Ripper attack RIPv1 enabled on DMZ interface RIPv1 enabled on interface %s RIPv1 enabled on WAN interface RIPv2 compatibility (broadcast) mode enabled on DMZ interface RIPv2 compatibility (broadcast) mode enabled on interface %s RIPv2 compatibility (broadcast) mode enabled on WAN interface RIPv2 enabled on DMZ interface RIPv2 enabled on interface %s RIPv2 enabled on WAN interface Router IGMP General query received on interface %s DHCP Relay Maintenance Info Standard Firewall Event Maintenance Info Unused DHCP Client Maintenance Info Standard DHCP Client Maintenance Info Standard DHCP Client Maintenance Info Standard DHCP Client Maintenance Info Standard DHCP Client Maintenance Info Standard DHCP Client Maintenance Info Standard Rip Maintenance Info Unused Rip Maintenance Info Unused Rip Maintenance Info Simple Message Rip Maintenance Info Unused Intrusion Attack Alert Standard Rip Maintenance Info Unused Rip Maintenance Info Simple Message Rip Maintenance Info Unused Rip Maintenance Info Unused Rip Maintenance Info Simple Message Rip Maintenance Info Unused Rip Maintenance Info Unused Rip Maintenance Info Simple Message Rip Maintenance Info Unused Multicast --- Debug Standard Message 42 SONICOS LOG EVENT REFERENCE GUIDE

43 Router IGMP membership query received on interface %s RST flood blacklist on IF %s continues RST-flooding machine %s blacklisted Multicast --- Debug Standard Message Intrusion Debug Warning Simple Message Intrusion Debug Alert Simple Message Rule None --- Debug Unused SA is disabled. Check VPN IKE User Activity Info Unused VPN SA settings Sending DHCP discover. DHCP Client Maintenance Info Standard Sending DHCP request DHCP Client Maintenance Info Standard Sending DHCP request (Rebinding). DHCP Client Maintenance Info Standard Sending DHCP request (Rebooting). DHCP Client Maintenance Info Standard Sending DHCP request (Renewing). DHCP Client Maintenance Info Standard Sending DHCP request (Verifying). DHCP Client Maintenance Info Standard Sending DHCP request DHCP Client Maintenance Info Standard Sending LCP echo reply PPPoE Maintenance Info Simple Sending LCP echo PPPoE Maintenance Info Simple request Sending PPPoE Active PPPoE Maintenance Info Simple Discovery Request Senna Spy attack Intrusion Attack Alert Standard Sent relay IP Table to DHCP Relay Maintenance Info Standard central gateway Settings Import: %s Firewall Event --- Info Simple Message SIP register expiration exceeds configured Signaling inactivity time out VOIP VOIP Warning Standard Note SIP request VOIP VOIP Debug Standard Note SIP response VOIP VOIP Debug Standard Note SMTP authentication problem:%s SMTP POP-Before- SMTP authentication failed Firewall Logging Firewall Logging System Error Warning Standard Message System Error Warning Simple SMTP server found on RBL blacklist RBL --- Notice Standard Note Smurf amplification attack Intrusion Attack Alert Standard SonicPoint Provision SonicPoint SonicPoint Info Simple SonicPoint statistics report GMS --- Info Simple SonicPoint Stats SONICOS LOG EVENT REFERENCE GUIDE 43

44 SonicPoint Status SonicPoint SonicPoint Info Simple SonicWALL activated Firewall Event Maintenance Alert Simple SonicWALL initializing Firewall Event Maintenance Info Simple SonicWALL SSO agent returned domain name too long SonicWALL SSO agent returned user name too long CIA User Activity Warning Standard Note CIA User Activity Warning Standard Note Source IP address connection status: %s Firewall Event --- Info Standard Message Source routed IP packet Intrusion Debug Warning Standard Source: None --- Debug Unused Spank attack multicast Intrusion Attack Alert Standard packet SPI: None --- Debug Unused SSL Control: Certificate chain not complete Network Blocked Sites Info Standard Note SSL Control: Certificate with invalid date Network Blocked Sites Info Standard Note SSL Control: Failed to decode Server Hello Network Blocked Sites Info Standard Note SSL Control: HTTPS via SSL2 Network Blocked Sites Info Standard Note SSL Control: Self-signed Network Blocked Sites Info Standard Note certificate SSL Control: Untrusted CA Network Blocked Sites Info Standard Note SSL Control: Weak cipher being used Network Blocked Sites Info Standard Note SSL Control: Website found in blacklist Network Blocked Sites Info Standard Note SSL Control: Website found in whitelist Network Blocked Sites Info Standard Note SSL-VPN enforcement Wireless Maintenance Info Simple Starting IKE negotiation VPN IKE User Activity Info Standard Note Starting PPPoE discovery PPPoE Maintenance Info Simple Status GMS Maintenance Emergenc Simple GMS y Status StrIKEr attack Intrusion Attack Alert Standard Sub seven attack Intrusion Attack Alert Standard Success to reach Interface %s probe High Availability System Error Info Simple Message Successful authentication User Activity Info Simple received for Remotely Triggered Dial-out SYN flood blacklist on IF %s continues SYN flood blacklisting disabled by user Intrusion Intrusion Debug Warning Simple Message Debug Warning Standard 44 SONICOS LOG EVENT REFERENCE GUIDE

45 SYN flood blacklisting Intrusion Debug Warning Standard enabled by user SYN flood ceased or Intrusion Debug Alert Standard flooding machines blacklisted - connection proxy disabled SYN Flood Mode Intrusion Debug Warning Standard changed by user to: Always proxy WAN connections SYN Flood Mode Intrusion Debug Warning Standard changed by user to: Watch and proxy WAN connections when under attack SYN Flood Mode Intrusion Debug Warning Standard changed by user to: Watch and report possible SYN floods SYN unused/spare Unused --- Debug Unused SYN unused/spare Unused --- Debug Unused Synchronizing High Maintenance Info Simple preferences to HA Peer Firewall Availability SYN-Flooding machine %s blacklisted Intrusion Debug Alert Simple Message Syslog Server cannot be Network Maintenance Info Standard reached System clock manually updated Firewall Logging --- Notice Simple Note TCP checksum error Network TCP Notice Standard TCP connection abort received; TCP connection TCP connection Network TCP connection from Network LAN denied TCP connection reject received; TCP connection Network Debug Debug Standard Note TCP Notice Standard Policy LAN TCP Notice Standard Network Debug Debug Standard Note TCP FIN packet Network Debug Debug Standard TCP handshake violation Network --- Notice Standard Note detected; TCP connection TCP packet received on a closing connection; TCP packet TCP packet received on non-existent/closed connection; TCP packet Network Debug Debug Standard Note Network Debug Debug Standard Note SONICOS LOG EVENT REFERENCE GUIDE 45

46 TCP packet received with invalid ACK number; TCP packet TCP packet received with invalid header length; Network Debug Debug Standard Note Network Debug Debug Standard Note TCP packet TCP packet received with Network Debug Debug Standard Note invalid MSS option length; TCP packet TCP packet received with Network Debug Debug Standard Note invalid option length; TCP packet TCP packet received with Network Debug Debug Standard Note invalid SACK option length; TCP packet TCP packet received with Network Debug Debug Standard Note invalid SEQ number; TCP packet TCP packet received with Network Debug Debug Standard Note invalid source port; TCP packet TCP packet received with Network Debug Info Standard Note invalid SYN Flood cookie; TCP packet TCP packet received with Network Debug Debug Standard Note invalid window scale option length; TCP packet TCP packet received with Network Debug Debug Standard Note invalid window scale option value; TCP packet TCP packet received with Network Debug Debug Standard Note non-permitted option; TCP packet TCP packet received with Network Debug Info Standard Note SYN flag on an existing connection; TCP packet TCP packet received without mandatory ACK Network Debug Debug Standard Note flag; TCP packet TCP packet received without mandatory SYN Network Debug Debug Standard Note flag; TCP packet TCP stateful inspection: Network Debug Debug Unused Bad header; TCP packet TCP stateful inspection: Network Debug Info Unused Invalid flag; TCP packet TCP SYN received Intrusion Debug Debug Standard 46 SONICOS LOG EVENT REFERENCE GUIDE

47 TCP Syn/Fin packet Network TCP Xmas Tree Intrusion The cache is full; %u open connections; some will be The current WAN interface is not ready to route packets. The loaded content URL List has expired. The network connection in use is %s The preferences file is too large to be saved in available flash memory Thermal Red Thermal Red Timer Exceeded Thermal Yellow Time of day settings for firewall policies were not upgraded. Too many gratuitous ARPs detected Attack Alert Standard Note Attack Alert Standard Firewall Event System Error Error Standard Message Number Firewall Event System Error Error Unused Security s System Error Error Simple WAN Failover System Error Warning Standard Message Firewall Event System Error Warning Simple Firewall Hardware System Environment Alert Simple Firewall System Alert Simple Hardware Environment Firewall System Alert Simple Hardware Environment Firewall Event Maintenance Info Simple Network --- Warning Simple Type: None --- Debug Unused UDP checksum error Network UDP Notice Standard UDP packet Network UDP Notice Standard Policy UDP packet from LAN Network LAN UDP Notice Standard LAN TCP Unable to download IPS/ GAV/Anti-Spyware Signature database. Firewall must first be restarted to free memory used by downloaded firmware. Unused --- Warning Simple Unable to resolve dynamic address object Dynamic Address Objects Maintenance Info Standard Unable to send message PPP Dial Up System Error Error Simple Message to dial-up task Unknown IPsec SPI VPN IPsec Attack Error Unused Unknown protocol Network Debug Notice Standard Note Unknown reason VPN PKI User Activity Error Simple User logged out User Activity Info Standard SONICOS LOG EVENT REFERENCE GUIDE 47

48 User logged out - inactivity timer expired User Activity Info Standard Note User logged out - max session time exceeded User Activity Info Standard Note User logged out - user disconnect detected User Activity Info Standard Note (heartbeat timer expired) User login denied - insufficient access on RADIUS User Activity Warning Standard LDAP server User login denied - invalid RADIUS User Activity Warning Standard credentials on LDAP server User login denied - LDAP RADIUS User Activity Info Standard authentication failure User login denied - LDAP RADIUS User Activity Warning Standard communication problem User login denied - LDAP RADIUS User Activity Warning Standard directory mismatch User login denied - LDAP RADIUS User Activity Warning Standard schema mismatch User login denied - LDAP RADIUS User Activity Warning Standard server certificate not valid User login denied - LDAP RADIUS User Activity Warning Standard server down or misconfigured User login denied - LDAP server name resolution failed RADIUS User Activity Warning Standard User login denied - LDAP RADIUS User Activity Warning Standard server timeout User login denied - not allowed by policy rule User Activity Warning Standard Note User login denied - not found locally User Activity Warning Standard Note User login denied - password doesn't meet constraints 0 Warning Standard User login denied - password expired User login denied - RADIUS authentication failure User login denied - RADIUS communication problem User login denied - RADIUS configuration error User login denied - RADIUS server name resolution failed User login denied - RADIUS server timeout User Activity Warning Standard RADIUS User Activity Info Standard RADIUS User Activity Warning Standard RADIUS User Activity Info Standard RADIUS User Activity Warning Standard RADIUS User Activity Info Standard 48 SONICOS LOG EVENT REFERENCE GUIDE

49 User login denied - SonicWALL SSO agent communication problem User login denied - SonicWALL SSO agent configuration error User login denied - SonicWALL SSO agent name resolution failed User login denied - SonicWALL SSO agent timeout User login denied - TLS or local certificate problem User login denied - User has no privileges for login from that location User login denied - User has no privileges for WLAN guest service User login denied due to bad credentials User login disabled from %s User login failed - Guest service limit reached User login failure rate exceeded - logins from user IP address denied Using LDAP without TLS highly insecure CIA User Activity Warning Standard CIA User Activity Warning Standard CIA User Activity Warning Standard CIA User Activity Warning Standard RADIUS User Activity Warning Standard User Activity Info Standard User Activity Info Standard User Activity Info Standard Attack Error Standard Message User Activity Info Standard Note Attack Error Standard RADIUS System Error Alert Simple Virtual access point is disabled SonicPoint 80211bmgmt Info Simple Virtual access point is enabled SonicPoint 80211bmgmt Info Simple VLAN unused/spare Unused --- Debug Unused VLAN unused/spare Unused --- Debug Unused VLAN unused/spare Unused --- Debug Unused VOIP %s endpoint added VOIP VOIP Debug Simple Message VOIP %s endpoint not added - configured 'public' endpoint limit reached VOIP VOIP Warning Simple Message VOIP %s endpoint removed VOIP VOIP Debug Simple Message VOIP call connected VOIP VOIP Info Standard Note VOIP call disconnected VOIP VOIP Info Standard Note Voltages out of tolerance Firewall Hardware System Environment Error Simple SONICOS LOG EVENT REFERENCE GUIDE 49

50 VPN Cleanup: Dynamic VPN User Activity Info Standard network settings change VPN client policy provisioning VPN Client User Activity Info Standard VPN disabled by Maintenance Info Simple administrator VPN disabled for active Unused Maintenance Info Simple dial up VPN enabled by Maintenance Info Simple administrator VPN log debug VPN IKE Debug Info Standard Message VPN policy added VPN --- Info Standard Note VPN policy count received exceeds the VPN System Error Error Simple Message limit; %s VPN Policy Deleted VPN --- Info Standard Note VPN Policy Modified VPN --- Info Standard Note VPN TCP FIN VPN VPN Stat Info Unused VPN TCP PSH VPN VPN Stat Info Unused VPN TCP SYN VPN VPN Stat Info Unused VPN zone administrator login allowed User Activity Info Standard VPN zone remote user login allowed User Activity Info Standard WAN Interface not setup Firewall Event Maintenance Info Simple Wan IP Changed Firewall Event System Error Warning Standard WAN node exceeded: Firewall Event System Error Error Standard Connection because too many IP addresses are in use on your LAN WAN not ready Firewall Event Maintenance Info Simple WAN zone administrator login allowed User Activity Info Standard WAN zone remote user login allowed User Activity Info Standard WARNING: Central DHCP Relay Maintenance Info Unused gateway does not have a relay IP Address. DHCP message. WARNING: DHCP lease relayed from central DHCP Relay Maintenance Info Standard gateway conflicts with IP in Static devices list Web access request Network TCP Notice Standard Policy Web management Network User Activity Notice Standard request allowed Web site access allowed Network Blocked Sites Notice Standard Note Blocked 50 SONICOS LOG EVENT REFERENCE GUIDE

51 Web site access denied Network Blocked Sites Error Standard Note Blocked WiFiSec enforcement Maintenance Info Unused disabled by administrator WiFiSec enforcement Maintenance Info Unused enabled by administrator Wireless MAC filter list Maintenance Info Simple disabled by administrator Wireless MAC filter list Maintenance Info Simple enabled by administrator WLAN client null probing WLAN IDS WLAN IDs Warning Standard WLAN disabled by Maintenance Info Simple administrator WLAN disabled by Maintenance Info Simple schedule WLAN drop traffic to deny Network --- Info Standard Note network WLAN enabled by Maintenance Info Simple administrator WLAN enabled by Maintenance Info Simple schedule WLAN firmware image Wireless Maintenance Info Simple has been updated WLAN guest session timeout User Activity Info Standard Note WLAN guest session timeout User Activity Info Standard Note WLAN guest session timeout User Activity Info Standard Note WLAN max concurrent users reached already Network --- Info Standard Note WLAN not in AP mode, Wireless Maintenance Info Simple DHCP server will not provide lease to clients on WLAN WLAN pass traffic to access allow network Network --- Info Standard Note WLAN radio frequency threat detected RF Management --- Warning Simple WLAN reboot Firewall System Error Error Hardware WLAN recovery Wireless Maintenance Info Simple WLAN sequence number WLAN IDS WLAN IDs Warning Simple out of order WLB fail back initiated by WAN Failover System Error Alert Standard %s Message WLB failover in progress WAN Failover System Error Alert Standard WLB resource failed WAN Failover System Error Alert Standard WLB resource is now WAN Failover System Error Alert Standard available WLB SPIll-over started, WAN Failover Maintenance Warning Simple configured threshold exceeded WLB SPIll-over stopped WAN Failover Maintenance Warning Simple SONICOS LOG EVENT REFERENCE GUIDE 51

52 WPA MIC Failure Wireless 80211bmgmt Warning Simple WPA RADIUS Server Timeout Wireless 80211bmgmt Info Simple WWAN %s %s device detected Firewall Hardware System Environment Info Simple Message WWAN Dial-up: %s. PPP Dial Up User Activity Alert Simple Message WWAN Dial-up: data usage limit reached for PPP Dial Up User Activity Alert Simple Message the '%s' billing cycle. Disconnecting the WWAN session. WWAN: No SIM detected Firewall --- Alert Simple Message XAUTH failed with VPN client, failure XAUTH failed with VPN client, Cannot Contact RADIUS Server XAUTH succeeded with VPN client Hardware VPN Client User Activity Error Standard VPN Client User Activity Info Standard VPN Client User Activity Info Standard 52 SONICOS LOG EVENT REFERENCE GUIDE

53 Index of Syslog Tag Field Description This section provides an alphabetical listing of Syslog tags and the associated field description. Tag Field Description <ddd> Syslog message prefix The beginning of each syslog message has a string of the form <ddd> where ddd is a decimal number indicating facility and priority of the message. (See [1] Section 4.1.1) arg URL Used to render a URL: arg represents the URL path name part. bcastrx Interface statistics report Displays the broadcast packets received bcasttx Interface statistics report Displays the broadcast packets transmitted bytesrx Interface statistics report Displays the bytes received bytestx Interface statistics report Displays the bytes transmitted c Message category (legacy only) Indicates the legacy category number (Note: We are not currently sending new category information.) change Configuration change webpage Displays the basename of the firewall web page that performed the last configuration change code Blocking code Indicates the CFS block code category code ICMP type and code Indicates the ICMP code conns Firewall status report Indicates the number of connections in use cpuutil Firewall status report Displays the CPU utilization (not in use) dst IP address, and optionally, port, network interface, and resolved name. dstname URL Displays the URL of web site hit and other legacy destination strings dstname URL Used to render a URL: dstname represents the URL host part dyn Firewall status report Displays the HA and dialup connection state (rendered as h.d where h is n (not enabled), b (backup), or p (primary) and d is 1 (enabled) or 0 (disabled)) fw Firewall WAN IP Indicates the WAN IP Address fwlan Firewall status report Indicates the LAN zone IP address goodrxbytes SonicPoint statistics report Indicates the well formed bytes recevied goodtxbytes SonicPoint statistics report Indicates the well formed bytes transmitted SONICOS LOG EVENT REFERENCE GUIDE 53

54 i Firewall status report Displays the GMS message interval in seconds id=firewall Webtrends prefix Syntactic sugar for WebTrends (and GMS by habit) if Interface statistics report Displays the interface on which statistics are reported ipscat IPS message Displays the IPS category ipspri IPS message Displays the IPS priority lic Firewall status report Indicates the number of licenses for firewalls with limited modes m Message ID Provides the message ID number mac MAC address Provides the MAC address msg Static message Displays the event message (from spreadsheet) msg Dynamically-defined message Displays a dynamically defined message string msg Static message with dynamic string Displays a message using the predefined message string containing a %s and a dynamic string argument. msg Static message with dynamic number Displays a message using the predefined string string containing a %s and a dynamic numeric argument. msg IPS message Displays a message using the predefined message string containing a %s and a dynamic string argument. msg Anti-Spyware message Displays the event message (from spreadsheet) n Message count Indicates the number of times event occurs op HTTP OP code Displays the HTTP operation (GET, POST, etc.) of web site hit pri Message priority Displays the event priority level (0=emergency..7=debug) proto IP protocol Indicates the IP protocol and detail information proto Protocol and service Displays the protocol information (rendered as proto/service ) proto Protocol and service Displays the protocol information (rendered as proto/service ) pt Firewall status report Displays the HTTP/HTTPS management port (rendered as hhh.sss ) radio SonicPoint statistics report Displays the SonicPoint radio on which event occurred ramutil Firewall status report Displays the RAM utilization (not in use) 54 SONICOS LOG EVENT REFERENCE GUIDE

55 rcvd Bytes received Indicates the number of bytes received within connection result HTTP Result code Displays the HTTP result code (200, 403, etc.) of web site hit rule Rule ID Displays the Rule number causing packet drop sent Bytes sent Displays the number of bytes sent within connection sid IPS message Provides the IPS signature ID sid Anti-Spyware message Provides the AntiSpyware signature ID sn Firewall serial number Indicates the device serial number spycat Anti-Spyware message Displays the antispyware category spypri Anti-Spyware message Displays the AntiSpyware priority src Source Indicates the source IP address, and optionally, port, network interface, and resolved name. station SonicPoint statistics report Displays the client (station) on which event occurred time Time Reports the time of event type ICMP type and code Indicates the ICMP type ucastrx Interface statistics report Displays the unicast packets received ucasttx Interface statistics report Displays the unicast packets transmitted unsynched Firewall status report Reports the time since last local change in seconds usesstandbysa Firewall status report Displays whether standby SA is in use ( 1 or 0 ) for GMS management usr (or user) User Displays the user name ( user is the tag used by WebTrends) vpnpolicy VPN policy name Displays the VPN policy name of event SONICOS LOG EVENT REFERENCE GUIDE 55

56 56 SONICOS LOG EVENT REFERENCE GUIDE