SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide with Enhanced Logging 1
Notes, Cautions, and Warnings NOTE: A NOTE indicates important information that helps you make better use of your system. CAUTION: A CAUTION indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING indicates a potential for property damage, personal injury, or death. 2014 Dell Inc. Trademarks: Dell, the DELL logo, SonicWALL, SonicWALL GMS, SonicWALL Analyzer, Reassembly-Free Deep Packet Inspection, Dynamic Security for the Global Network, SonicWALL Clean VPN, SonicWALL Clean Wireless, SonicWALL Comprehensive Gateway Security Suite, SonicWALL Mobile Connect, and all other SonicWALL product and service names and slogans are trademarks of Dell Inc. 2014 09 P/N 232-002657-00 Rev. A
Overview This reference guide lists and describes SonicOS log event messages for SonicOS 5.9, 6.0.5, and 6.2. Reference a log event message by using the alphabetical index from the Log Event Message Index table of this document. This document contains the following sections: Log > Monitor on page 1 Log > Settings on page 1 Index of Log Event Messages on page 2 Log > Syslog on page 169 Index of Syslog Tag Field Descriptions on page 170 Table of Values on page 178 Log > Monitor The Dell SonicWALL security appliance maintains an Event log for tracking potential security threats. This log can be viewed by navigating to the Dashboard > Log Monitor or Log > Log Monitor page, or it can be automatically sent to an email address for convenience and archiving. The log is displayed in a table and can be sorted by column. For more information on configuring the Log Monitor page, refer to the SonicOS Administrator s Guide. Log > Settings The Log > Settings page allows you to categorize and customize the logging functions on your Dell SonicWALL security appliance for troubleshooting and diagnostics. For more information on configuring and managing the Log > Settings page, refer to the SonicOS Administrator s Guide. SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 1
Index of Log Event Messages The following table is the Log Event Message Index, which is a list of log event messages for the SonicOS 5.9, 6.0.5, and 6.2 firmware. Each log event message described in the following table provides the following log event details: Log Event Message ID Number Displays the ID number of the log event message. Firmware Version Displays the SonicOS firmware version the log event message appears on. Legacy Category Displays the category event type. This is the same category as Table 1: Legacy Category on page 178. SonicOS Category Displays the SonicOS category type. This is the same category as Table 2: Expanded Categories on page 179. Priority Level Displays the level of urgency of the log event message. For additional information, you can also reference Table 3: Priority Level on page 182. SNMP Trap Type Displays the SNMP Trap ID number of the log event message. Log Event Messages Displays the name of the event message. ID Firmware Version Legacy Category Category Priority Level 4 5.9.0 Maintenance Firewall Event ALERT 4 6.0.5 Maintenance Firewall Event ALERT SNMP Trap Type Message Network Security Appliance activated Network Security Appliance activated 4 6.2.0 Maintenance Firewall Event ALERT Network Security Appliance activated 5 5.9.0 Maintenance Firewall Logging INFO Log Cleared 5 6.0.5 Maintenance Firewall Logging INFO Log Cleared 5 6.2.0 Maintenance Firewall Logging INFO Log Cleared 6 5.9.0 Maintenance Firewall Logging INFO Log successfully sent via E mail 6 6.0.5 Maintenance Firewall Logging INFO Log successfully sent via E mail 6 6.2.0 Maintenance Firewall Logging INFO Log successfully sent via E mail 10 5.9.0 System Error Security Services ERROR 602 10 6.0.5 System Error Security Services ERROR 602 10 6.2.0 System Error Security Services ERROR 602 12 5.9.0 System Error Firewall Logging WARNING 604 12 6.0.5 System Error Firewall Logging WARNING 604 Problem loading the URL List; check Filter settings Problem loading the URL List; check Filter settings Problem loading the URL List; check Filter settings Problem sending log E mail; check log settings Problem sending log E mail; check log settings 2
12 6.2.0 System Error Firewall Logging WARNING 604 Problem sending log E mail; check log settings 14 5.9.0 Blocked Sites Network Access ERROR 701 Web site access denied 14 6.0.5 Blocked Sites Network Access ERROR 701 Web site access denied 14 6.2.0 Blocked Sites Network Access ERROR 701 Web site access denied 15 5.9.0 Blocked Sites Network Access NOTICE 702 Newsgroup access denied 15 6.0.5 Blocked Sites Network Access NOTICE 702 Newsgroup access denied 15 6.2.0 Blocked Sites Network Access NOTICE 702 Newsgroup access denied 16 5.9.0 Blocked Sites Network Access NOTICE 703 Web site access allowed 16 6.0.5 Blocked Sites Network Access NOTICE 703 Web site access allowed 16 6.2.0 Blocked Sites Network Access NOTICE 703 Web site access allowed 17 5.9.0 Blocked Sites Network Access NOTICE 704 Newsgroup access allowed 17 6.0.5 Blocked Sites Network Access NOTICE 704 Newsgroup access allowed 17 6.2.0 Blocked Sites Network Access NOTICE 704 Newsgroup access allowed 18 5.9.0 Blocked Code Network Access NOTICE ActiveX access denied 18 6.0.5 Blocked Code Network Access NOTICE ActiveX access denied 18 6.2.0 Blocked Code Network Access NOTICE ActiveX access denied 19 5.9.0 Blocked Code Network Access NOTICE Java access denied 19 6.0.5 Blocked Code Network Access NOTICE Java access denied 19 6.2.0 Blocked Code Network Access NOTICE Java access denied 20 5.9.0 Blocked Code Network Access NOTICE 20 6.0.5 Blocked Code Network Access NOTICE ActiveX or Java archive access denied ActiveX or Java archive access denied 20 6.2.0 Blocked Code Network Access NOTICE ActiveX or Java archive access denied 21 5.9.0 Blocked Code Network Access NOTICE Cookie removed 21 6.0.5 Blocked Code Network Access NOTICE Cookie removed 21 6.2.0 Blocked Code Network Access NOTICE Cookie removed 22 5.9.0 Attack 22 6.0.5 Attack 22 6.2.0 Attack 23 5.9.0 Attack ALERT 501 Ping of death dropped ALERT 501 Ping of death dropped ALERT 501 Ping of death dropped ALERT 502 IP spoof dropped SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 3
23 6.0.5 Attack 23 6.2.0 Attack 24 5.9.0 User Activity 24 6.0.5 User Activity 24 6.2.0 User Activity 25 5.9.0 Attack 25 6.0.5 Attack 25 6.2.0 Attack 27 5.9.0 Attack 27 6.0.5 Attack 27 6.2.0 Attack 28 5.9.0 28 6.0.5 28 6.2.0 29 5.9.0 User Activity 29 6.0.5 User Activity 29 6.2.0 User Activity 30 5.9.0 Attack 30 6.0.5 Attack ALERT 502 IP spoof dropped ALERT 502 IP spoof dropped WARNING 503 WARNING 503 WARNING 503 User logged out user disconnect detected User logged out user disconnect detected User logged out user disconnect detected Possible SYN flood attack detected Possible SYN flood attack detected Possible SYN flood attack detected ALERT 505 Land attack dropped ALERT 505 Land attack dropped ALERT 505 Land attack dropped TCP UDP ICMP Network NOTICE Fragmented packet dropped TCP UDP ICMP Network NOTICE Fragmented packet dropped TCP UDP ICMP Network NOTICE Fragmented packet dropped Administrator login allowed Administrator login allowed Administrator login allowed Access ALERT 560 Access ALERT 560 Administrator login denied due to bad credentials Administrator login denied due to bad credentials 4
30 6.2.0 Attack 31 5.9.0 User Activity 31 6.0.5 User Activity 31 6.2.0 User Activity 32 5.9.0 User Activity 32 6.0.5 User Activity 32 6.2.0 User Activity 33 5.9.0 User Activity 33 6.0.5 User Activity 33 6.2.0 User Activity 34 5.9.0 User Activity 34 6.0.5 User Activity 34 6.2.0 User Activity 35 5.9.0 Attack 35 6.0.5 Attack Access ALERT 560 Administrator login denied due to bad credentials User login from an internal zone allowed User login from an internal zone allowed User login from an internal zone allowed User login denied due to bad credentials User login denied due to bad credentials User login denied due to bad credentials User login denied due to bad credentials User login denied due to bad credentials User login denied due to bad credentials Pending login timed out Pending login timed out Pending login timed out Access ALERT Access ALERT 506 Administrator login denied from %s; logins disabled from this interface Administrator login denied from %s; logins disabled from this interface Administrator login denied 35 6.2.0 Attack Access ALERT 506 from %s; logins disabled from this interface 36 5.9.0 TCP Network Access NOTICE TCP connection dropped 36 6.0.5 TCP Network Access NOTICE TCP connection dropped 36 6.2.0 TCP Network Access NOTICE TCP connection dropped 37 5.9.0 UDP Network Access NOTICE UDP packet dropped SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 5
37 6.0.5 UDP Network Access NOTICE UDP packet dropped 37 6.2.0 UDP Network Access NOTICE UDP packet dropped 38 5.9.0 ICMP Network Access NOTICE 38 6.0.5 ICMP Network Access NOTICE ICMP packet dropped due to Policy ICMP packet dropped due to Policy 38 6.2.0 ICMP Network Access NOTICE ICMP packet dropped due to Policy 41 5.9.0 Debug Network Access NOTICE Unknown protocol dropped 41 6.0.5 Debug Network Access NOTICE Unknown protocol dropped 41 6.2.0 Debug Network Access NOTICE Unknown protocol dropped 43 5.9.0 Debug Network Access DEBUG IPsec connection interrupt 43 6.0.5 Debug Network Access DEBUG IPsec connection interrupt 43 6.2.0 Debug Network Access DEBUG IPsec connection interrupt 45 5.9.0 Debug Network DEBUG ARP Timeout 45 6.0.5 Debug Network DEBUG ARP Timeout 45 6.2.0 Debug Network DEBUG ARP Timeout 46 5.9.0 Debug Network Access DEBUG Broadcast packet dropped 46 6.0.5 Debug Network Access DEBUG Broadcast packet dropped 46 6.2.0 Debug Network Access DEBUG Broadcast packet dropped 48 5.9.0 Debug Network Access DEBUG 48 6.0.5 Debug Network Access DEBUG Out of order command packet dropped Out of order command packet dropped 48 6.2.0 Debug Network Access DEBUG Out of order command packet dropped 49 5.9.0 Debug Unused DEBUG Failure to add data channel 49 6.0.5 Debug Unused DEBUG Failure to add data channel 49 6.2.0 Debug Unused DEBUG Failure to add data channel 53 5.9.0 System Error Firewall Event ERROR 607 53 6.0.5 System Error Firewall Event ERROR 607 53 6.2.0 System Error Firewall Event ERROR 607 The cache is full; %u open connections; some will be dropped The cache is full; %u open connections; some will be dropped The cache is full; %u open connections; some will be dropped 6
58 5.9.0 System Error Firewall Event ERROR 608 58 6.0.5 System Error Firewall Event ERROR 608 License exceeded: Connection dropped because too many IP addresses are in use on your LAN License exceeded: Connection dropped because too many IP addresses are in use on your LAN 58 6.2.0 System Error Firewall Event ERROR 608 License exceeded: Connection dropped because too many IP addresses are in use on your LAN 60 5.9.0 Blocked Sites Network Access NOTICE 705 Access to proxy server denied 60 6.0.5 Blocked Sites Network Access NOTICE 705 Access to proxy server denied 60 6.2.0 Blocked Sites Network Access NOTICE 705 Access to proxy server denied 61 5.9.0 System Error VPN IPsec ERROR 609 Diagnostic Code E 61 6.0.5 System Error VPN IPsec ERROR 609 Diagnostic Code E 61 6.2.0 System Error VPN IPsec ERROR 609 Diagnostic Code E 63 5.9.0 Debug Network DEBUG 63 6.0.5 Debug Network DEBUG Received fragmented packet or fragmentation needed Received fragmented packet or fragmentation needed 63 6.2.0 Debug Network DEBUG Received fragmented packet or fragmentation needed 65 5.9.0 User Activity VPN IPsec INFO Illegal IPsec SPI 65 6.0.5 User Activity VPN IPsec INFO Illegal IPsec SPI 65 6.2.0 User Activity VPN IPsec INFO Illegal IPsec SPI 67 5.9.0 Attack VPN IPsec ERROR 508 IPsec Authentication Failed 67 6.0.5 Attack VPN IPsec ERROR 508 IPsec Authentication Failed 67 6.2.0 Attack VPN IPsec ERROR 508 IPsec Authentication Failed 68 5.9.0 Attack VPN IPsec ERROR 509 IPsec Decryption Failed 68 6.0.5 Attack VPN IPsec ERROR 509 IPsec Decryption Failed 68 6.2.0 Attack VPN IPsec ERROR 509 IPsec Decryption Failed 69 5.9.0 User Activity VPN IPsec INFO 69 6.0.5 User Activity VPN IPsec INFO 69 6.2.0 User Activity VPN IPsec INFO Incompatible IPsec Security Association Incompatible IPsec Security Association Incompatible IPsec Security Association SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 7
70 5.9.0 Attack VPN IPsec ERROR 510 70 6.0.5 Attack VPN IPsec ERROR 510 70 6.2.0 Attack VPN IPsec ERROR 510 81 5.9.0 Attack 81 6.0.5 Attack 81 6.2.0 Attack 82 5.9.0 Attack 82 6.0.5 Attack 82 6.2.0 Attack 83 5.9.0 Attack 83 6.0.5 Attack ALERT 520 ALERT 520 ALERT 520 IPsec packet from or to an illegal host IPsec packet from or to an illegal host IPsec packet from or to an illegal host Smurf Amplification attack dropped Smurf Amplification attack dropped Smurf Amplification attack dropped ALERT 521 Possible port scan detected ALERT 521 Possible port scan detected ALERT 521 Possible port scan detected ALERT 522 Probable port scan detected ALERT 522 Probable port scan detected 83 6.2.0 Attack ALERT 522 Probable port scan detected 84 5.9.0 Maintenance Network INFO Failed to resolve name 84 6.0.5 Maintenance Network INFO Failed to resolve name 84 6.2.0 Maintenance Network INFO Failed to resolve name 87 5.9.0 User Activity VPN IKE INFO 87 6.0.5 User Activity VPN IKE INFO 87 6.2.0 User Activity VPN IKE INFO 88 5.9.0 User Activity VPN IKE WARNING 523 88 6.0.5 User Activity VPN IKE WARNING 523 88 6.2.0 User Activity VPN IKE WARNING 523 IKE Responder: Accepting IPsec proposal (Phase 2) IKE Responder: Accepting IPsec proposal (Phase 2) IKE Responder: Accepting IPsec proposal (Phase 2) IKE Responder: IPsec proposal does not match (Phase 2) IKE Responder: IPsec proposal does not match (Phase 2) IKE Responder: IPsec proposal does not match (Phase 2) 8
89 5.9.0 User Activity VPN IKE INFO 89 6.0.5 User Activity VPN IKE INFO IKE negotiation complete. Adding IPsec SA. (Phase 2) IKE negotiation complete. Adding IPsec SA. (Phase 2) 89 6.2.0 User Activity VPN IKE INFO IKE negotiation complete. Adding IPsec SA. (Phase 2) 93 5.9.0 System Error Firewall Hardware ERROR 611 Diagnostic Code A 93 6.0.5 System Error Firewall Hardware ERROR 611 Diagnostic Code A 93 6.2.0 System Error Firewall Hardware ERROR 611 Diagnostic Code A 94 5.9.0 System Error Firewall Hardware ERROR 612 Diagnostic Code B 94 6.0.5 System Error Firewall Hardware ERROR 612 Diagnostic Code B 94 6.2.0 System Error Firewall Hardware ERROR 612 Diagnostic Code B 95 5.9.0 System Error Firewall Hardware ERROR 613 Diagnostic Code C 95 6.0.5 System Error Firewall Hardware ERROR 613 Diagnostic Code C 95 6.2.0 System Error Firewall Hardware ERROR 613 Diagnostic Code C 96 5.9.0 Maintenance GMS INFO Status 96 6.0.5 Maintenance GMS INFO Status 96 6.2.0 Maintenance GMS INFO Status 97 5.9.0 97 6.0.5 Connection Traffic Network Traffic INFO Web site hit Connection Traffic Network Traffic INFO Web site hit Connection 97 6.2.0 Traffic Network Traffic INFO Web site hit 98 5.9.0 Connection Network Traffic INFO Connection Opened 98 6.0.5 Connection Network Traffic INFO Connection Opened 98 6.2.0 Connection Network Traffic INFO Connection Opened 99 5.9.0 Maintenance DHCP Client INFO 99 6.0.5 Maintenance DHCP Client INFO 99 6.2.0 Maintenance DHCP Client INFO 100 5.9.0 Maintenance DHCP Client INFO 100 6.0.5 Maintenance DHCP Client INFO Retransmitting DHCP DIS COVER. Retransmitting DHCP DIS COVER. Retransmitting DHCP DIS COVER. Retransmitting DHCP Request (Requesting). Retransmitting DHCP Request (Requesting). SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 9
100 6.2.0 Maintenance DHCP Client INFO 101 5.9.0 Maintenance DHCP Client INFO 101 6.0.5 Maintenance DHCP Client INFO 101 6.2.0 Maintenance DHCP Client INFO 102 5.9.0 Maintenance DHCP Client INFO 102 6.0.5 Maintenance DHCP Client INFO 102 6.2.0 Maintenance DHCP Client INFO 103 5.9.0 Maintenance DHCP Client INFO 103 6.0.5 Maintenance DHCP Client INFO 103 6.2.0 Maintenance DHCP Client INFO 104 5.9.0 Maintenance DHCP Client INFO 104 6.0.5 Maintenance DHCP Client INFO Retransmitting DHCP Request (Requesting). Retransmitting DHCP Request (Renewing). Retransmitting DHCP Request (Renewing). Retransmitting DHCP Request (Renewing). Retransmitting DHCP Request (Rebinding). Retransmitting DHCP Request (Rebinding). Retransmitting DHCP Request (Rebinding). Retransmitting DHCP Request (Rebooting). Retransmitting DHCP Request (Rebooting). Retransmitting DHCP Request (Rebooting). Retransmitting DHCP Request (Verifying). Retransmitting DHCP Request (Verifying). 104 6.2.0 Maintenance DHCP Client INFO Retransmitting DHCP Request (Verifying). 105 5.9.0 Maintenance DHCP Client INFO Sending DHCP DISCOVER. 105 6.0.5 Maintenance DHCP Client INFO Sending DHCP DISCOVER. 105 6.2.0 Maintenance DHCP Client INFO Sending DHCP DISCOVER. 106 5.9.0 Maintenance DHCP Client INFO 106 6.0.5 Maintenance DHCP Client INFO DHCP Server not available. Did not get any DHCP OFFER. DHCP Server not available. Did not get any DHCP OFFER. 106 6.2.0 Maintenance DHCP Client INFO DHCP Server not available. Did not get any DHCP OFFER. 107 5.9.0 Maintenance DHCP Client INFO Got DHCP OFFER. Selecting. 107 6.0.5 Maintenance DHCP Client INFO Got DHCP OFFER. Selecting. 107 6.2.0 Maintenance DHCP Client INFO Got DHCP OFFER. Selecting. 108 5.9.0 Maintenance DHCP Client INFO Sending DHCP Request. 10
108 6.0.5 Maintenance DHCP Client INFO Sending DHCP Request. 108 6.2.0 Maintenance DHCP Client INFO Sending DHCP Request. 109 5.9.0 Maintenance DHCP Client INFO 109 6.0.5 Maintenance DHCP Client INFO DHCP Client did not get DHCP ACK. DHCP Client did not get DHCP ACK. 109 6.2.0 Maintenance DHCP Client INFO DHCP Client did not get DHCP ACK. 110 5.9.0 Maintenance DHCP Client INFO DHCP Client got NACK. 110 6.0.5 Maintenance DHCP Client INFO DHCP Client got NACK. 110 6.2.0 Maintenance DHCP Client INFO DHCP Client got NACK. 111 5.9.0 Maintenance DHCP Client INFO 111 6.0.5 Maintenance DHCP Client INFO 111 6.2.0 Maintenance DHCP Client INFO 112 5.9.0 Maintenance DHCP Client INFO 112 6.0.5 Maintenance DHCP Client INFO 112 6.2.0 Maintenance DHCP Client INFO 113 5.9.0 Maintenance DHCP Client INFO 113 6.0.5 Maintenance DHCP Client INFO 113 6.2.0 Maintenance DHCP Client INFO 114 5.9.0 Maintenance DHCP Client INFO 114 6.0.5 Maintenance DHCP Client INFO 114 6.2.0 Maintenance DHCP Client INFO 115 5.9.0 Maintenance DHCP Client INFO 115 6.0.5 Maintenance DHCP Client INFO DHCP Client got ACK from server. DHCP Client got ACK from server. DHCP Client got ACK from server. DHCP Client is declining address offered by the server. DHCP Client is declining address offered by the server. DHCP Client is declining address offered by the server. DHCP Client sending Request and going to REBIND state. DHCP Client sending Request and going to REBIND state. DHCP Client sending Request and going to REBIND state. DHCP Client sending Request and going to RENEW state. DHCP Client sending Request and going to RENEW state. DHCP Client sending Request and going to RENEW state. Sending DHCP Request (Renewing). Sending DHCP Request (Renewing). SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 11
115 6.2.0 Maintenance DHCP Client INFO 116 5.9.0 Maintenance DHCP Client INFO 116 6.0.5 Maintenance DHCP Client INFO 116 6.2.0 Maintenance DHCP Client INFO 117 5.9.0 Maintenance DHCP Client INFO 117 6.0.5 Maintenance DHCP Client INFO 117 6.2.0 Maintenance DHCP Client INFO 118 5.9.0 Maintenance DHCP Client INFO 118 6.0.5 Maintenance DHCP Client INFO 118 6.2.0 Maintenance DHCP Client INFO 119 5.9.0 Maintenance DHCP Client INFO 119 6.0.5 Maintenance DHCP Client INFO 119 6.2.0 Maintenance DHCP Client INFO 121 5.9.0 Maintenance DHCP Client INFO 121 6.0.5 Maintenance DHCP Client INFO Sending DHCP Request (Renewing). Sending DHCP Request (Rebinding). Sending DHCP Request (Rebinding). Sending DHCP Request (Rebinding). Sending DHCP Request (Rebooting). Sending DHCP Request (Rebooting). Sending DHCP Request (Rebooting). Sending DHCP Request (Verifying). Sending DHCP Request (Verifying). Sending DHCP Request (Verifying). DHCP Client failed to verify and lease has expired. Go to INIT state. DHCP Client failed to verify and lease has expired. Go to INIT state. DHCP Client failed to verify and lease has expired. Go to INIT state. DHCP Client got a new IP address lease. DHCP Client got a new IP address lease. 121 6.2.0 Maintenance DHCP Client INFO DHCP Client got a new IP address lease. 122 5.9.0 Maintenance DHCP Client INFO Sending DHCP RELEASE. 122 6.0.5 Maintenance DHCP Client INFO Sending DHCP RELEASE. 122 6.2.0 Maintenance DHCP Client INFO Sending DHCP RELEASE. 12
123 5.9.0 Maintenance Security Services INFO 123 6.0.5 Maintenance Security Services INFO 123 6.2.0 Maintenance Security Services INFO 124 5.9.0 Maintenance Security Services INFO 124 6.0.5 Maintenance Security Services INFO Access attempt from host without Anti Virus agent installed Access attempt from host without Anti Virus agent installed Access attempt from host without Anti Virus agent installed Anti Virus agent out of date on host Anti Virus agent out of date on host 124 6.2.0 Maintenance Security Services INFO Anti Virus agent out of date on host 125 5.9.0 Maintenance Security Services WARNING 524 Received AV Alert: %s 125 6.0.5 Maintenance Security Services WARNING 524 Received AV Alert: %s 125 6.2.0 Maintenance Security Services WARNING 524 Received AV Alert: %s 127 5.9.0 Maintenance PPPoE INFO Starting PPPoE discovery 127 6.0.5 Maintenance PPPoE INFO Starting PPPoE discovery 127 6.2.0 Maintenance PPPoE INFO Starting PPPoE discovery 128 5.9.0 Maintenance PPPoE INFO PPPoE LCP Link Up 128 6.0.5 Maintenance PPPoE INFO PPPoE LCP Link Up 128 6.2.0 Maintenance PPPoE INFO PPPoE LCP Link Up 129 5.9.0 Maintenance PPPoE INFO PPPoE LCP Link Down 129 6.0.5 Maintenance PPPoE INFO PPPoE LCP Link Down 129 6.2.0 Maintenance PPPoE INFO PPPoE LCP Link Down 130 5.9.0 Maintenance PPPoE INFO PPPoE terminated 130 6.0.5 Maintenance PPPoE INFO PPPoE terminated 130 6.2.0 Maintenance PPPoE INFO PPPoE terminated 131 5.9.0 Maintenance PPPoE INFO PPPoE Network Connected 131 6.0.5 Maintenance PPPoE INFO PPPoE Network Connected 131 6.2.0 Maintenance PPPoE INFO PPPoE Network Connected 132 5.9.0 Maintenance PPPoE INFO PPPoE Network Disconnected 132 6.0.5 Maintenance PPPoE INFO PPPoE Network Disconnected 132 6.2.0 Maintenance PPPoE INFO PPPoE Network Disconnected 133 5.9.0 Maintenance PPPoE INFO 133 6.0.5 Maintenance PPPoE INFO PPPoE discovery process complete PPPoE discovery process complete SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 13
133 6.2.0 Maintenance PPPoE INFO 134 5.9.0 Maintenance PPPoE INFO 134 6.0.5 Maintenance PPPoE INFO PPPoE discovery process complete PPPoE starting CHAP Authentication PPPoE starting CHAP Authentication 134 6.2.0 Maintenance PPPoE INFO PPPoE starting CHAP Authentication 138 5.9.0 System Error Firewall Event WARNING 636 Wan IP Changed 138 6.0.5 System Error Firewall Event WARNING 636 Wan IP Changed 138 6.2.0 System Error Firewall Event WARNING 636 Wan IP Changed 139 5.9.0 User Activity VPN Client INFO 139 6.0.5 User Activity VPN Client INFO 139 6.2.0 User Activity VPN Client INFO 140 5.9.0 User Activity VPN Client ERROR 140 6.0.5 User Activity VPN Client ERROR 140 6.2.0 User Activity VPN Client ERROR 141 5.9.0 User Activity VPN Client INFO 141 6.0.5 User Activity VPN Client INFO XAUTH Succeeded with VPN client XAUTH Succeeded with VPN client XAUTH Succeeded with VPN client XAUTH Failed with VPN client, Authentication failure XAUTH Failed with VPN client, Authentication failure XAUTH Failed with VPN client, Authentication failure XAUTH Failed with VPN client, Cannot Contact RADIUS Server XAUTH Failed with VPN client, Cannot Contact RADIUS Server 141 6.2.0 User Activity VPN Client INFO XAUTH Failed with VPN client, Cannot Contact RADIUS Server 142 5.9.0 Debug Firewall Event ERROR Log Debug 142 6.0.5 Debug Firewall Event ERROR Log Debug 142 6.2.0 Debug Firewall Event ERROR Log Debug 143 5.9.0 Attack Firewall Event ERROR 525 Add an attack message 143 6.0.5 Attack Firewall Event ERROR 525 Add an attack message 143 6.2.0 Attack Firewall Event ERROR 525 Add an attack message 144 5.9.0 Maintenance High Availability ALERT 6201 144 6.0.5 Maintenance High Availability ALERT Primary firewall has transitioned to Active Primary firewall has transitioned to Active 14
144 6.2.0 Maintenance High Availability ALERT 6201 145 5.9.0 Maintenance High Availability ALERT 6202 145 6.0.5 Maintenance High Availability ALERT 145 6.2.0 Maintenance High Availability ALERT 6202 146 5.9.0 System Error High Availability ALERT 6203 146 6.0.5 System Error High Availability ALERT 614 146 6.2.0 System Error High Availability ALERT 6203 147 5.9.0 Maintenance High Availability ALERT 6204 147 6.0.5 Maintenance High Availability ALERT 6204 147 6.2.0 Maintenance High Availability ALERT 6204 148 5.9.0 System Error High Availability ERROR 615 148 6.0.5 System Error High Availability ERROR 615 148 6.2.0 System Error High Availability ERROR 615 149 5.9.0 System Error High Availability ERROR 616 149 6.0.5 System Error High Availability ERROR 616 149 6.2.0 System Error High Availability ERROR 616 150 5.9.0 System Error High Availability ERROR 617 150 6.0.5 System Error High Availability ERROR 617 150 6.2.0 System Error High Availability ERROR 617 Primary firewall has transitioned to Active Secondary firewall has transitioned to Active Secondary firewall has transitioned to Active Secondary firewall has transitioned to Active Primary firewall has transitioned to Standby Primary firewall has transitioned to Standby Primary firewall has transitioned to Standby Secondary firewall has transitioned to Standby Secondary firewall has transitioned to Standby Secondary firewall has transitioned to Standby Primary missed heartbeats from Secondary Primary missed heartbeats from Secondary Primary missed heartbeats from Secondary Secondary missed heartbeats from Primary Secondary missed heartbeats from Primary Secondary missed heartbeats from Primary Primary received error signal from Secondary Primary received error signal from Secondary Primary received error signal from Secondary SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 15
151 5.9.0 System Error High Availability ERROR 618 151 6.0.5 System Error High Availability ERROR 618 151 6.2.0 System Error High Availability ERROR 618 153 5.9.0 System Error High Availability ERROR 620 153 6.0.5 System Error High Availability ERROR 620 Secondary received error signal from Primary Secondary received error signal from Primary Secondary received error signal from Primary Primary firewall preempting Secondary Primary firewall preempting Secondary 153 6.2.0 System Error High Availability ERROR 620 Primary firewall preempting Secondary 157 5.9.0 Maintenance High Availability INFO HA Peer Firewall Synchronized 157 6.0.5 Maintenance High Availability INFO HA Peer Firewall Synchronized 157 6.2.0 Maintenance High Availability INFO HA Peer Firewall Synchronized 158 5.9.0 System Error High Availability ERROR 662 158 6.0.5 System Error High Availability ERROR 662 158 6.2.0 System Error High Availability ERROR 662 159 5.9.0 Maintenance Security Services WARNING 526 159 6.0.5 Maintenance Security Services WARNING 526 Error synchronizing HA peer firewall (%s) Error synchronizing HA peer firewall (%s) Error synchronizing HA peer firewall (%s) Received AV Alert: Your Network Anti Virus subscription has expired. %s Received AV Alert: Your Network Anti Virus subscription has expired. %s 159 6.2.0 Maintenance Security Services WARNING 526 Received AV Alert: Your Network Anti Virus subscription has expired. %s 162 5.9.0 Maintenance High Availability INFO HA packet processing error 162 6.0.5 Maintenance High Availability INFO HA packet processing error 162 6.2.0 Maintenance High Availability INFO HA packet processing error 164 5.9.0 System Error Firewall Hardware ERROR 621 Diagnostic Code F 164 6.0.5 System Error Firewall Hardware ERROR 621 Diagnostic Code F 164 6.2.0 System Error Firewall Hardware ERROR 621 Diagnostic Code F 165 5.9.0 Attack ALERT 527 Forbidden E Mail attachment disabled 16
165 6.0.5 Attack 165 6.2.0 Attack ALERT 527 ALERT 527 168 5.9.0 Maintenance PPPoE INFO 168 6.0.5 Maintenance PPPoE INFO 168 6.2.0 Maintenance PPPoE INFO 169 5.9.0 Maintenance PPPoE INFO 169 6.0.5 Maintenance PPPoE INFO 169 6.2.0 Maintenance PPPoE INFO 170 5.9.0 System Error High Availability ERROR 622 170 6.0.5 System Error High Availability ERROR 622 Forbidden E Mail attachment disabled Forbidden E Mail attachment disabled Disconnecting PPPoE due to traffic Timeout Disconnecting PPPoE due to traffic Timeout Disconnecting PPPoE due to traffic Timeout No response from ISP Disconnecting PPPoE. No response from ISP Disconnecting PPPoE. No response from ISP Disconnecting PPPoE. Secondary going Active in preempt mode after reboot Secondary going Active in preempt mode after reboot 170 6.2.0 System Error High Availability ERROR 622 Secondary going Active in preempt mode after reboot 171 5.9.0 User Activity VPN IKE DEBUG %s 171 6.0.5 User Activity VPN IKE DEBUG %s 171 6.2.0 User Activity VPN IKE DEBUG %s 173 5.9.0 LAN TCP Network Access NOTICE 173 6.0.5 LAN TCP Network Access NOTICE 173 6.2.0 LAN TCP Network Access NOTICE 174 5.9.0 174 6.0.5 174 6.2.0 175 5.9.0 TCP connection from LAN denied TCP connection from LAN denied TCP connection from LAN denied LAN UDP LAN TCP Network Access NOTICE UDP packet from LAN dropped LAN UDP LAN TCP Network Access NOTICE UDP packet from LAN dropped LAN UDP LAN TCP Network Access NOTICE UDP packet from LAN dropped LAN ICMP LAN TCP Network Access NOTICE ICMP packet from LAN dropped SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 17
175 6.0.5 175 6.2.0 177 5.9.0 Attack 177 6.0.5 Attack 177 6.2.0 Attack 178 5.9.0 Attack 178 6.0.5 Attack 178 6.2.0 Attack 179 5.9.0 Attack 179 6.0.5 Attack LAN ICMP LAN TCP Network Access NOTICE ICMP packet from LAN dropped LAN ICMP LAN TCP Network Access NOTICE ICMP packet from LAN dropped ALERT 528 Probable TCP FIN scan detected ALERT 528 Probable TCP FIN scan detected ALERT 528 Probable TCP FIN scan detected ALERT 529 ALERT 529 ALERT 529 ALERT 530 ALERT 530 Probable TCP XMAS scan detected Probable TCP XMAS scan detected Probable TCP XMAS scan detected Probable TCP NULL scan detected Probable TCP NULL scan detected 179 6.2.0 Attack ALERT 530 Probable TCP NULL scan detected 180 5.9.0 Attack VPN IPsec ALERT 531 IPsec Replay Detected 180 6.0.5 Attack VPN IPsec ALERT 531 IPsec Replay Detected 180 6.2.0 Attack VPN IPsec ALERT 531 IPsec Replay Detected 181 5.9.0 Debug Network DEBUG TCP FIN packet dropped 181 6.0.5 Debug Network DEBUG TCP FIN packet dropped 181 6.2.0 Debug Network DEBUG TCP FIN packet dropped 182 5.9.0 User Activity Network INFO 182 6.0.5 User Activity Network INFO 182 6.2.0 User Activity Network INFO 183 5.9.0 System Error Security Services ERROR 623 183 6.0.5 System Error Security Services ERROR 623 Received a path MTU ICMP message from router/gateway Received a path MTU ICMP message from router/gateway Received a path MTU ICMP message from router/gateway Problem loading the URL List; Appliance not registered. Problem loading the URL List; Appliance not registered. 18
183 6.2.0 System Error Security Services ERROR 623 188 5.9.0 User Activity Network INFO 188 6.0.5 User Activity Network INFO 188 6.2.0 User Activity Network INFO 190 5.9.0 System Error Security Services ERROR 628 190 6.0.5 System Error Security Services ERROR 628 190 6.2.0 System Error Security Services ERROR 628 191 5.9.0 System Error High Availability ERROR 629 191 6.0.5 System Error High Availability ERROR 629 191 6.2.0 System Error High Availability ERROR 629 199 5.9.0 User Activity 199 6.0.5 User Activity 199 6.2.0 User Activity 200 5.9.0 User Activity 200 6.0.5 User Activity 200 6.2.0 User Activity Problem loading the URL List; Appliance not registered. Received a path MTU ICMP message from router/gateway Received a path MTU ICMP message from router/gateway Received a path MTU ICMP message from router/gateway The loaded content URL List has expired. The loaded content URL List has expired. The loaded content URL List has expired. Error setting the IP address of the Secondary, please manually set to Secondary LAN IP Error setting the IP address of the Secondary, please manually set to Secondary LAN IP Error setting the IP address of the Secondary, please manually set to Secondary LAN IP CLI administrator login allowed CLI administrator login allowed CLI administrator login allowed Access WARNING Access WARNING Access WARNING 201 5.9.0 Maintenance L2TP Client INFO 201 6.0.5 Maintenance L2TP Client INFO CLI administrator login denied due to bad credentials CLI administrator login denied due to bad credentials CLI administrator login denied due to bad credentials L2TP Tunnel Negotiation Started L2TP Tunnel Negotiation Started SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 19
201 6.2.0 Maintenance L2TP Client INFO 202 5.9.0 Maintenance L2TP Client INFO 202 6.0.5 Maintenance L2TP Client INFO L2TP Tunnel Negotiation Started L2TP Session Negotiation Started L2TP Session Negotiation Started 202 6.2.0 Maintenance L2TP Client INFO L2TP Session Negotiation Started 204 5.9.0 Maintenance L2TP Client INFO L2TP Tunnel Established 204 6.0.5 Maintenance L2TP Client INFO L2TP Tunnel Established 204 6.2.0 Maintenance L2TP Client INFO L2TP Tunnel Established 205 5.9.0 Maintenance L2TP Client INFO 205 6.0.5 Maintenance L2TP Client INFO L2TP Tunnel Disconnect from Remote L2TP Tunnel Disconnect from Remote 205 6.2.0 Maintenance L2TP Client INFO L2TP Tunnel Disconnect from Remote 206 5.9.0 Maintenance L2TP Client INFO L2TP Session Established 206 6.0.5 Maintenance L2TP Client INFO L2TP Session Established 206 6.2.0 Maintenance L2TP Client INFO L2TP Session Established 207 5.9.0 Maintenance L2TP Client INFO 207 6.0.5 Maintenance L2TP Client INFO L2TP Session Disconnect from Remote L2TP Session Disconnect from Remote 207 6.2.0 Maintenance L2TP Client INFO L2TP Session Disconnect from Remote 208 5.9.0 Maintenance L2TP Client INFO L2TP PPP Negotiation Started 208 6.0.5 Maintenance L2TP Client INFO L2TP PPP Negotiation Started 208 6.2.0 Maintenance L2TP Client INFO L2TP PPP Negotiation Started 210 5.9.0 Maintenance L2TP Client INFO L2TP PPP Session Up 210 6.0.5 Maintenance L2TP Client INFO L2TP PPP Session Up 210 6.2.0 Maintenance L2TP Client INFO L2TP PPP Session Up 211 5.9.0 Maintenance L2TP Client INFO L2TP PPP Down 211 6.0.5 Maintenance L2TP Client INFO L2TP PPP Down 211 6.2.0 Maintenance L2TP Client INFO L2TP PPP Down 212 5.9.0 Maintenance L2TP Client INFO L2TP PPP Authentication Failed 212 6.0.5 Maintenance L2TP Client INFO L2TP PPP Authentication Failed 212 6.2.0 Maintenance L2TP Client INFO L2TP PPP Authentication Failed 20
215 5.9.0 Maintenance L2TP Client INFO 215 6.0.5 Maintenance L2TP Client INFO Disconnecting L2TP Tunnel due to traffic Timeout Disconnecting L2TP Tunnel due to traffic Timeout 215 6.2.0 Maintenance L2TP Client INFO Disconnecting L2TP Tunnel due to traffic Timeout 217 5.9.0 Maintenance L2TP Client INFO L2TP PPP link down 217 6.0.5 Maintenance L2TP Client INFO L2TP PPP link down 217 6.2.0 Maintenance L2TP Client INFO L2TP PPP link down 222 5.9.0 Maintenance DHCP Relay INFO 222 6.0.5 Maintenance DHCP Relay INFO 222 6.2.0 Maintenance DHCP Relay INFO 223 5.9.0 Maintenance DHCP Relay INFO 223 6.0.5 Maintenance DHCP Relay INFO 223 6.2.0 Maintenance DHCP Relay INFO 224 5.9.0 Debug DHCP Relay INFO 224 6.0.5 Debug DHCP Relay INFO 224 6.2.0 Debug DHCP Relay INFO 225 5.9.0 Debug DHCP Relay INFO 225 6.0.5 Debug DHCP Relay INFO 225 6.2.0 Debug DHCP Relay INFO 226 5.9.0 Maintenance DHCP Relay INFO 226 6.0.5 Maintenance DHCP Relay INFO DHCP RELEASE relayed to Central Gateway DHCP RELEASE relayed to Central Gateway DHCP RELEASE relayed to Central Gateway DHCP lease relayed to local device DHCP lease relayed to local device DHCP lease relayed to local device DHCP RELEASE received from remote device DHCP RELEASE received from remote device DHCP RELEASE received from remote device DHCP lease relayed to remote device DHCP lease relayed to remote device DHCP lease relayed to remote device DHCP lease to LAN device conflicts with remote device, deleting remote IP entry DHCP lease to LAN device conflicts with remote device, deleting remote IP entry SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 21
226 6.2.0 Maintenance DHCP Relay INFO 227 5.9.0 Maintenance DHCP Relay INFO 227 6.0.5 Maintenance DHCP Relay INFO 227 6.2.0 Maintenance DHCP Relay INFO 228 5.9.0 Maintenance DHCP Relay WARNING 228 6.0.5 Maintenance DHCP Relay WARNING 228 6.2.0 Maintenance DHCP Relay WARNING 229 5.9.0 Attack DHCP Relay ERROR 533 229 6.0.5 Attack DHCP Relay ERROR 533 229 6.2.0 Attack DHCP Relay ERROR 533 230 5.9.0 Maintenance DHCP Relay INFO 230 6.0.5 Maintenance DHCP Relay INFO 230 6.2.0 Maintenance DHCP Relay INFO 231 5.9.0 Maintenance DHCP Relay INFO 231 6.0.5 Maintenance DHCP Relay INFO DHCP lease to LAN device conflicts with remote device, deleting remote IP entry WARNING: DHCP lease relayed from Central Gateway conflicts with IP in Static Devices list WARNING: DHCP lease relayed from Central Gateway conflicts with IP in Static Devices list WARNING: DHCP lease relayed from Central Gateway conflicts with IP in Static Devices list DHCP lease dropped. Lease from Central Gateway conflicts with Relay IP DHCP lease dropped. Lease from Central Gateway conflicts with Relay IP DHCP lease dropped. Lease from Central Gateway conflicts with Relay IP IP spoof detected on packet to Central Gateway, packet dropped IP spoof detected on packet to Central Gateway, packet dropped IP spoof detected on packet to Central Gateway, packet dropped Request for Relay IP Table from Central Gateway Request for Relay IP Table from Central Gateway Request for Relay IP Table from Central Gateway Requesting Relay IP Table from Remote Gateway Requesting Relay IP Table from Remote Gateway 22
231 6.2.0 Maintenance DHCP Relay INFO 232 5.9.0 Maintenance DHCP Relay INFO 232 6.0.5 Maintenance DHCP Relay INFO 232 6.2.0 Maintenance DHCP Relay INFO 233 5.9.0 Maintenance DHCP Relay INFO 233 6.0.5 Maintenance DHCP Relay INFO 233 6.2.0 Maintenance DHCP Relay INFO 234 5.9.0 System Error DHCP Relay WARNING 632 234 6.0.5 System Error DHCP Relay WARNING 632 234 6.2.0 System Error DHCP Relay WARNING 632 235 5.9.0 User Activity 235 6.0.5 User Activity 235 6.2.0 User Activity 236 5.9.0 User Activity 236 6.0.5 User Activity 236 6.2.0 User Activity 237 5.9.0 User Activity 237 6.0.5 User Activity 237 6.2.0 User Activity Requesting Relay IP Table from Remote Gateway Sent Relay IP Table to Central Gateway Sent Relay IP Table to Central Gateway Sent Relay IP Table to Central Gateway Obtained Relay IP Table from Remote Gateway Obtained Relay IP Table from Remote Gateway Obtained Relay IP Table from Remote Gateway Failed to synchronize Relay IP Table Failed to synchronize Relay IP Table Failed to synchronize Relay IP Table VPN zone administrator login allowed VPN zone administrator login allowed VPN zone administrator login allowed WAN zone administrator login allowed WAN zone administrator login allowed WAN zone administrator login allowed VPN zone remote user login allowed VPN zone remote user login allowed VPN zone remote user login allowed SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 23
238 5.9.0 User Activity 238 6.0.5 User Activity 238 6.2.0 User Activity 239 5.9.0 User Activity VPN IKE INFO 239 6.0.5 User Activity VPN IKE INFO 239 6.2.0 User Activity VPN IKE INFO 240 5.9.0 User Activity VPN IKE INFO 240 6.0.5 User Activity VPN IKE INFO 240 6.2.0 User Activity VPN IKE INFO 241 5.9.0 User Activity VPN IKE INFO 241 6.0.5 User Activity VPN IKE INFO 241 6.2.0 User Activity VPN IKE INFO 242 5.9.0 User Activity VPN IKE INFO 242 6.0.5 User Activity VPN IKE INFO WAN zone remote user login allowed WAN zone remote user login allowed WAN zone remote user login allowed NAT Discovery : Peer IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Peer IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Peer IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Local IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Local IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : Local IPsec Security Gateway behind a NAT/NAPT Device NAT Discovery : No NAT/NAPT device detected between IPsec Security gateways NAT Discovery : No NAT/NAPT device detected between IPsec Security gateways NAT Discovery : No NAT/NAPT device detected between IPsec Security gateways NAT Discovery : Peer IPsec Security Gateway doesn't support VPN NAT Traversal NAT Discovery : Peer IPsec Security Gateway doesn't support VPN NAT Traversal 24
242 6.2.0 User Activity VPN IKE INFO 243 5.9.0 User Activity RADIUS INFO 243 6.0.5 User Activity RADIUS INFO 243 6.2.0 User Activity RADIUS INFO 244 5.9.0 User Activity RADIUS WARNING 244 6.0.5 User Activity RADIUS WARNING 244 6.2.0 User Activity RADIUS WARNING 245 5.9.0 User Activity RADIUS WARNING 245 6.0.5 User Activity RADIUS WARNING 245 6.2.0 User Activity RADIUS WARNING 246 5.9.0 User Activity 246 6.0.5 User Activity NAT Discovery : Peer IPsec Security Gateway doesn't support VPN NAT Traversal User login denied RADIUS authentication failure User login denied RADIUS authentication failure User login denied RADIUS authentication failure User login denied RADIUS server Timeout User login denied RADIUS server Timeout User login denied RADIUS server Timeout User login denied RADIUS configuration error User login denied RADIUS configuration error User login denied RADIUS configuration error User login denied User has no privileges for login from that location User login denied User has no privileges for login from that location User login denied User has no 246 6.2.0 User Activity privileges for login from that location 247 5.9.0 Maintenance VPN IPsec INFO IPsec packet from an illegal host 247 6.0.5 Maintenance VPN IPsec INFO IPsec packet from an illegal host 247 6.2.0 Maintenance VPN IPsec INFO IPsec packet from an illegal host 248 5.9.0 Attack 248 6.0.5 Attack 248 6.2.0 Attack ERROR 534 ERROR 534 ERROR 534 Forbidden E Mail attachment deleted Forbidden E Mail attachment deleted Forbidden E Mail attachment deleted SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 25
249 5.9.0 User Activity VPN IKE WARNING 535 249 6.0.5 User Activity VPN IKE WARNING 535 249 6.2.0 User Activity VPN IKE WARNING 535 250 5.9.0 User Activity VPN IKE WARNING 536 250 6.0.5 User Activity VPN IKE WARNING 536 250 6.2.0 User Activity VPN IKE WARNING 536 251 5.9.0 User Activity VPN IKE WARNING 537 251 6.0.5 User Activity VPN IKE WARNING 537 251 6.2.0 User Activity VPN IKE WARNING 537 252 5.9.0 User Activity VPN IKE WARNING 538 252 6.0.5 User Activity VPN IKE WARNING 538 252 6.2.0 User Activity VPN IKE WARNING 538 253 5.9.0 User Activity VPN IKE WARNING 539 IKE Responder: Mode %s not tunnel mode IKE Responder: Mode %d not tunnel mode IKE Responder: Mode %s not tunnel mode IKE Responder: No matching Phase 1 ID found for proposed remote network IKE Responder: No matching Phase 1 ID found for proposed remote network IKE Responder: No matching Phase 1 ID found for proposed remote network IKE Responder: Proposed remote network is 0.0.0.0 but not DHCP relay nor default route IKE Responder: Proposed remote network is 0.0.0.0 but not DHCP relay nor default route IKE Responder: Proposed remote network is 0.0.0.0 but not DHCP relay nor default route IKE Responder: No match for proposed remote network address IKE Responder: No match for proposed remote network address IKE Responder: No match for proposed remote network address IKE Responder: Default LAN gateway is set but peer is not proposing to use this SA as a default route 26
253 6.0.5 User Activity VPN IKE WARNING 539 253 6.2.0 User Activity VPN IKE WARNING 539 254 5.9.0 User Activity VPN IKE WARNING 540 254 6.0.5 User Activity VPN IKE WARNING 540 254 6.2.0 User Activity VPN IKE WARNING 540 255 5.9.0 User Activity VPN IKE WARNING 541 255 6.0.5 User Activity VPN IKE WARNING 541 255 6.2.0 User Activity VPN IKE WARNING 541 256 5.9.0 User Activity VPN IKE WARNING 542 256 6.0.5 User Activity VPN IKE WARNING 542 256 6.2.0 User Activity VPN IKE WARNING 542 IKE Responder: Default LAN gateway is set but peer is not proposing to use this SA as a default route IKE Responder: Default LAN gateway is set but peer is not proposing to use this SA as a default route IKE Responder: Tunnel terminates outside firewall but proposed local network is not NAT public address IKE Responder: Tunnel terminates outside firewall but proposed local network is not NAT public address IKE Responder: Tunnel terminates outside firewall but proposed local network is not NAT public address IKE Responder: Tunnel terminates inside firewall but proposed local network is not inside firewall IKE Responder: Tunnel terminates inside firewall but proposed local network is not inside firewall IKE Responder: Tunnel terminates inside firewall but proposed local network is not inside firewall IKE Responder: Tunnel terminates on DMZ but proposed local network is on LAN IKE Responder: Tunnel terminates on DMZ but proposed local network is on LAN IKE Responder: Tunnel terminates on DMZ but proposed local network is on LAN SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 27
257 5.9.0 User Activity VPN IKE WARNING 543 257 6.0.5 User Activity VPN IKE WARNING 543 257 6.2.0 User Activity VPN IKE WARNING 543 258 5.9.0 User Activity VPN IKE WARNING 544 258 6.0.5 User Activity VPN IKE WARNING 544 258 6.2.0 User Activity VPN IKE WARNING 544 259 5.9.0 User Activity VPN IKE WARNING 545 259 6.0.5 User Activity VPN IKE WARNING 545 259 6.2.0 User Activity VPN IKE WARNING 545 260 5.9.0 User Activity VPN IKE WARNING 546 260 6.0.5 User Activity VPN IKE WARNING 546 260 6.2.0 User Activity VPN IKE WARNING 546 261 5.9.0 User Activity 261 6.0.5 User Activity 261 6.2.0 User Activity 262 5.9.0 User Activity 262 6.0.5 User Activity 262 6.2.0 User Activity IKE Responder: Tunnel terminates on LAN but proposed local network is on DMZ IKE Responder: Tunnel terminates on LAN but proposed local network is on DMZ IKE Responder: Tunnel terminates on LAN but proposed local network is on DMZ IKE Responder: AH Perfect Forward Secrecy mismatch IKE Responder: AH Perfect Forward Secrecy mismatch IKE Responder: AH Perfect Forward Secrecy mismatch IKE Responder: ESP Perfect Forward Secrecy mismatch IKE Responder: ESP Perfect Forward Secrecy mismatch IKE Responder: ESP Perfect Forward Secrecy mismatch IKE Responder: Algorithms and/ or keys do not match IKE Responder: Algorithms and/ or keys do not match IKE Responder: Algorithms and/ or keys do not match Administrator logged out Administrator logged out Administrator logged out Administrator logged out inactivity timer expired Administrator logged out inactivity timer expired Administrator logged out inactivity timer expired 28
263 5.9.0 User Activity 263 6.0.5 User Activity 263 6.2.0 User Activity 264 5.9.0 User Activity 264 6.0.5 User Activity 264 6.2.0 User Activity 265 5.9.0 User Activity 265 6.0.5 User Activity 265 6.2.0 User Activity User logged out %s User logged out User logged out %s 266 5.9.0 Maintenance VPN IPsec INFO 266 6.0.5 Maintenance VPN IPsec INFO 266 6.2.0 Maintenance VPN IPsec INFO 267 5.9.0 Attack 267 6.0.5 Attack User logged out max session time exceeded User logged out max session time exceeded User logged out max session time exceeded User logged out inactivity timer expired User logged out inactivity timer expired User logged out inactivity timer expired NAT device may not support IPsec AH pass through NAT device may not support IPsec AH pass through NAT device may not support IPsec AH pass through ALERT 547 TCP Xmas Tree dropped ALERT 547 TCP Xmas Tree dropped 267 6.2.0 Attack ALERT 547 TCP Xmas Tree dropped 269 5.9.0 User Activity VPN PKI INFO Requesting CRL from 269 6.0.5 User Activity VPN PKI INFO Requesting CRL from 269 6.2.0 User Activity VPN PKI INFO Requesting CRL from 270 5.9.0 User Activity VPN PKI INFO CRL loaded from 270 6.0.5 User Activity VPN PKI INFO CRL loaded from 270 6.2.0 User Activity VPN PKI INFO CRL loaded from 271 5.9.0 User Activity VPN PKI ALERT Failed to get CRL from 271 6.0.5 User Activity VPN PKI ALERT Failed to get CRL from 271 6.2.0 User Activity VPN PKI ALERT Failed to get CRL from SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 29
272 5.9.0 User Activity VPN PKI WARNING 272 6.0.5 User Activity VPN PKI WARNING Not enough memory to hold the CRL Not enough memory to hold the CRL 272 6.2.0 User Activity VPN PKI WARNING Not enough memory to hold the CRL 273 5.9.0 User Activity VPN PKI ALERT Connection timed out 273 6.0.5 User Activity VPN PKI ALERT Connection timed out 273 6.2.0 User Activity VPN PKI ALERT Connection timed out 274 5.9.0 User Activity VPN PKI ALERT 274 6.0.5 User Activity VPN PKI ALERT Cannot connect to the CRL server Cannot connect to the CRL server 274 6.2.0 User Activity VPN PKI ALERT Cannot connect to the CRL server 275 5.9.0 User Activity VPN PKI ERROR Unknown reason 275 6.0.5 User Activity VPN PKI ERROR Unknown reason 275 6.2.0 User Activity VPN PKI ERROR Unknown reason 276 5.9.0 User Activity VPN PKI ALERT Failed to Process CRL from 276 6.0.5 User Activity VPN PKI ALERT Failed to Process CRL from 276 6.2.0 User Activity VPN PKI ALERT Failed to Process CRL from 277 5.9.0 User Activity VPN PKI ALERT Bad CRL format 277 6.0.5 User Activity VPN PKI ALERT Bad CRL format 277 6.2.0 User Activity VPN PKI ALERT Bad CRL format 278 5.9.0 User Activity VPN PKI ALERT Issuer match failed 278 6.0.5 User Activity VPN PKI ALERT Issuer match failed 278 6.2.0 User Activity VPN PKI ALERT Issuer match failed 279 5.9.0 User Activity VPN PKI ALERT Certificate on Revoked list(crl) 279 6.0.5 User Activity VPN PKI ALERT Certificate on Revoked list(crl) 279 6.2.0 User Activity VPN PKI ALERT Certificate on Revoked list(crl) 280 5.9.0 User Activity VPN PKI ALERT No Certificate for 280 6.0.5 User Activity VPN PKI ALERT No Certificate for 280 6.2.0 User Activity VPN PKI ALERT No Certificate for 281 5.9.0 User Activity PPP Dial Up INFO PPP Dial Up: Dialing: %s 281 6.0.5 User Activity PPP Dial Up INFO PPP Dial Up: Dialing: %s 281 6.2.0 User Activity PPP Dial Up INFO PPP Dial Up: Dialing: %s 30
282 5.9.0 User Activity PPP Dial Up INFO 282 6.0.5 User Activity PPP Dial Up INFO 282 6.2.0 User Activity PPP Dial Up INFO 283 5.9.0 User Activity PPP Dial Up INFO 283 6.0.5 User Activity PPP Dial Up INFO 283 6.2.0 User Activity PPP Dial Up INFO 284 5.9.0 User Activity PPP Dial Up INFO 284 6.0.5 User Activity PPP Dial Up INFO 284 6.2.0 User Activity PPP Dial Up INFO 285 5.9.0 User Activity PPP Dial Up INFO 285 6.0.5 User Activity PPP Dial Up INFO 285 6.2.0 User Activity PPP Dial Up INFO 286 5.9.0 User Activity PPP Dial Up INFO 286 6.0.5 User Activity PPP Dial Up INFO 286 6.2.0 User Activity PPP Dial Up INFO 287 5.9.0 User Activity PPP Dial Up INFO 287 6.0.5 User Activity PPP Dial Up INFO PPP Dial Up: No dial tone detected check phone line connection PPP Dial Up: No dial tone detected check phone line connection PPP Dial Up: No dial tone detected check phone line connection PPP Dial Up: No link carrier detected check phone number PPP Dial Up: No link carrier detected check phone number PPP Dial Up: No link carrier detected check phone number PPP Dial Up: Dialed number is busy PPP Dial Up: Dialed number is busy PPP Dial Up: Dialed number is busy PPP Dial Up: Dialed number did not answer PPP Dial Up: Dialed number did not answer PPP Dial Up: Dialed number did not answer PPP Dial Up: Connected at %s bps starting PPP PPP Dial Up: Connected at %s bps starting PPP PPP Dial Up: Connected at %s bps starting PPP PPP Dial Up: Unknown dialing failure PPP Dial Up: Unknown dialing failure PPP Dial Up: Unknown dialing 287 6.2.0 User Activity PPP Dial Up INFO failure 288 5.9.0 User Activity PPP Dial Up INFO PPP Dial Up: Link carrier lost SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 31
288 6.0.5 User Activity PPP Dial Up INFO PPP Dial Up: Link carrier lost 288 6.2.0 User Activity PPP Dial Up INFO PPP Dial Up: Link carrier lost 289 5.9.0 PPP INFO PPP: Authentication successful 289 6.0.5 PPP INFO PPP: Authentication successful 289 6.2.0 PPP INFO PPP: Authentication successful 290 5.9.0 PPP INFO 290 6.0.5 PPP INFO 290 6.2.0 PPP INFO 291 5.9.0 PPP INFO 291 6.0.5 PPP INFO 291 6.2.0 PPP INFO 292 5.9.0 PPP INFO 292 6.0.5 PPP INFO 292 6.2.0 PPP INFO 293 5.9.0 PPP INFO 293 6.0.5 PPP INFO 293 6.2.0 PPP INFO 294 5.9.0 PPP INFO 294 6.0.5 PPP INFO 294 6.2.0 PPP INFO PPP: PAP Authentication failed check username / password PPP: PAP Authentication failed check username / password PPP: PAP Authentication failed check username / password PPP: CHAP authentication failed check username / password PPP: CHAP authentication failed check username / password PPP: CHAP authentication failed check username / password PPP: MS CHAP authentication failed check username / password PPP: MS CHAP authentication failed check username / password PPP: MS CHAP authentication failed check username / password PPP: Starting MS CHAP authentication PPP: Starting MS CHAP authentication PPP: Starting MS CHAP authentication PPP: Starting CHAP authentication PPP: Starting CHAP authentication PPP: Starting CHAP authentication 32
295 5.9.0 PPP INFO 295 6.0.5 PPP INFO 295 6.2.0 PPP INFO 297 5.9.0 User Activity PPP Dial Up INFO 297 6.0.5 User Activity PPP Dial Up INFO 297 6.2.0 User Activity PPP Dial Up INFO 299 5.9.0 User Activity PPP Dial Up INFO 299 6.0.5 User Activity PPP Dial Up INFO 299 6.2.0 User Activity PPP Dial Up INFO 300 5.9.0 User Activity PPP Dial Up INFO 300 6.0.5 User Activity PPP Dial Up INFO PPP: Starting PAP authentication PPP: Starting PAP authentication PPP: Starting PAP authentication PPP Dial Up: Idle time limit exceeded disconnecting PPP Dial Up: Idle time limit exceeded disconnecting PPP Dial Up: Idle time limit exceeded disconnecting PPP Dial Up: Received new IP address PPP Dial Up: Received new IP address PPP Dial Up: Received new IP address PPP Dial Up: PPP link established PPP Dial Up: PPP link established 300 6.2.0 User Activity PPP Dial Up INFO PPP Dial Up: PPP link established 301 5.9.0 User Activity PPP Dial Up INFO PPP Dial Up: PPP link down 301 6.0.5 User Activity PPP Dial Up INFO PPP Dial Up: PPP link down 301 6.2.0 User Activity PPP Dial Up INFO PPP Dial Up: PPP link down 302 5.9.0 User Activity PPP Dial Up INFO PPP Dial Up: Shutting down link 302 6.0.5 User Activity PPP Dial Up INFO PPP Dial Up: Shutting down link 302 6.2.0 User Activity PPP Dial Up INFO PPP Dial Up: Shutting down link 303 5.9.0 User Activity PPP Dial Up INFO PPP Dial Up: Initialization : %s 303 6.0.5 User Activity PPP Dial Up INFO PPP Dial Up: Initialization : %s 303 6.2.0 User Activity PPP Dial Up INFO PPP Dial Up: Initialization : %s 306 5.9.0 User Activity PPP Dial Up INFO 306 6.0.5 User Activity PPP Dial Up INFO 306 6.2.0 User Activity PPP Dial Up INFO PPP Dial Up: Connect request canceled PPP Dial Up: Connect request canceled PPP Dial Up: Connect request canceled SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 33
307 5.9.0 System Error WAN Failover WARNING 639 307 6.0.5 System Error WAN Failover WARNING 639 307 6.2.0 System Error WAN Failover WARNING 639 308 5.9.0 Maintenance L2TP Server INFO 308 6.0.5 Maintenance L2TP Server INFO 308 6.2.0 Maintenance L2TP Server INFO 309 5.9.0 Maintenance L2TP Server INFO 309 6.0.5 Maintenance L2TP Server INFO 309 6.2.0 Maintenance L2TP Server INFO 311 5.9.0 Maintenance L2TP Server INFO 311 6.0.5 Maintenance L2TP Server INFO 311 6.2.0 Maintenance L2TP Server INFO 312 5.9.0 Maintenance L2TP Server INFO 312 6.0.5 Maintenance L2TP Server INFO 312 6.2.0 Maintenance L2TP Server INFO 318 5.9.0 Maintenance L2TP Server INFO 318 6.0.5 Maintenance L2TP Server INFO 318 6.2.0 Maintenance L2TP Server INFO 319 5.9.0 Maintenance L2TP Server INFO The network connection in use is %s The network connection in use is %s The network connection in use is %s L2TP Server : L2TP Tunnel Established. L2TP Server : L2TP Tunnel Established. L2TP Server : L2TP Tunnel Established. L2TP Server : L2TP Session Established. L2TP Server : L2TP Session Established. L2TP Server : L2TP Session Established. L2TP Server: RADIUS/LDAP reports Authentication Failure L2TP Server: RADIUS/LDAP reports Authentication Failure L2TP Server: RADIUS/LDAP reports Authentication Failure L2TP Server: Local Authentication Failure L2TP Server: Local Authentication Failure L2TP Server: Local Authentication Failure L2TP Server: Local Authentication Success. L2TP Server: Local Authentication Success. L2TP Server: Local Authentication Success. L2TP Server: RADIUS/LDAP Authentication Success 34
319 6.0.5 Maintenance L2TP Server INFO 319 6.2.0 Maintenance L2TP Server INFO 321 5.9.0 User Activity PPP Dial Up INFO 321 6.0.5 User Activity PPP Dial Up INFO 321 6.2.0 User Activity PPP Dial Up INFO 322 5.9.0 User Activity PPP Dial Up INFO 322 6.0.5 User Activity PPP Dial Up INFO L2TP Server: RADIUS/LDAP Authentication Success L2TP Server: RADIUS/LDAP Authentication Success PPP Dial Up: Manual intervention needed. Check Primary Profile or Profile details PPP Dial Up: Manual intervention needed. Check Primary Profile or Profile details PPP Dial Up: Manual intervention needed. Check Primary Profile or Profile details PPP Dial Up: Trying to failover but Primary Profile is manual PPP Dial Up: Trying to failover but Primary Profile is manual 322 6.2.0 User Activity PPP Dial Up INFO PPP Dial Up: Trying to failover but Primary Profile is manual 326 5.9.0 System Error WAN Failover ALERT 637 Probing failure on %s 326 6.0.5 System Error WAN Failover ALERT 637 Probing failure on %s 326 6.2.0 System Error WAN Failover ALERT 637 Probing failure on %s 327 5.9.0 User Activity PPP Dial Up INFO 327 6.0.5 User Activity PPP Dial Up INFO 327 6.2.0 User Activity PPP Dial Up INFO 328 5.9.0 Maintenance 328 6.0.5 Maintenance 328 6.2.0 Maintenance 329 5.9.0 Attack PPP Dial Up: Maximum connection time exceeded disconnecting PPP Dial Up: Maximum connection time exceeded disconnecting PPP Dial Up: Maximum connection time exceeded disconnecting Administrator name changed Administrator name changed Administrator name changed Access ERROR 561 User login failure rate exceeded logins from user IP address denied SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 35
329 6.0.5 Attack 329 6.2.0 Attack Access ERROR 561 Access ERROR 561 330 5.9.0 Maintenance PPP Dial Up INFO 330 6.0.5 Maintenance PPP Dial Up INFO 330 6.2.0 Maintenance PPP Dial Up INFO 331 5.9.0 Maintenance PPP Dial Up INFO 331 6.0.5 Maintenance PPP Dial Up INFO 331 6.2.0 Maintenance PPP Dial Up INFO 335 5.9.0 Maintenance L2TP Server INFO 335 6.0.5 Maintenance L2TP Server INFO 335 6.2.0 Maintenance L2TP Server INFO 336 5.9.0 Maintenance L2TP Server INFO 336 6.0.5 Maintenance L2TP Server INFO 336 6.2.0 Maintenance L2TP Server INFO 337 5.9.0 Maintenance L2TP Server INFO 337 6.0.5 Maintenance L2TP Server INFO 337 6.2.0 Maintenance L2TP Server INFO 338 5.9.0 Maintenance L2TP Server INFO 338 6.0.5 Maintenance L2TP Server INFO User login failure rate exceeded logins from user IP address denied User login failure rate exceeded logins from user IP address denied PPP Dial Up: The profile in use disabled VPN networking. PPP Dial Up: The profile in use disabled VPN networking. PPP Dial Up: The profile in use disabled VPN networking. PPP Dial Up: VPN networking restored. PPP Dial Up: VPN networking restored. PPP Dial Up: VPN networking restored. L2TP Server: Tunnel Disconnect from Remote. L2TP Server: Tunnel Disconnect from Remote. L2TP Server: Tunnel Disconnect from Remote. L2TP Server : Deleting the Tunnel L2TP Server : Deleting the Tunnel L2TP Server : Deleting the Tunnel L2TP Server : Deleting the L2TP active Session L2TP Server : Deleting the L2TP active Session L2TP Server : Deleting the L2TP active Session L2TP Server : Retransmission Timeout, Deleting the Tunnel L2TP Server : Retransmission Timeout, Deleting the Tunnel 36
338 6.2.0 Maintenance L2TP Server INFO 339 5.9.0 Debug Network DEBUG 339 6.0.5 Debug Network DEBUG 339 6.2.0 Debug Network DEBUG 340 5.9.0 Maintenance Firewall Event INFO 340 6.0.5 Maintenance Firewall Event INFO 340 6.2.0 Maintenance Firewall Event INFO 341 5.9.0 Maintenance Firewall Event INFO 341 6.0.5 Maintenance Firewall Event INFO 341 6.2.0 Maintenance Firewall Event INFO 344 5.9.0 Maintenance L2TP Server INFO 344 6.0.5 Maintenance L2TP Server INFO 344 6.2.0 Maintenance L2TP Server INFO 346 5.9.0 User Activity VPN IKE INFO 346 6.0.5 User Activity VPN IKE INFO 346 6.2.0 User Activity VPN IKE INFO 347 5.9.0 347 6.0.5 TCP UDP ICMP Network Access WARNING TCP UDP ICMP Network Access WARNING L2TP Server : Retransmission Timeout, Deleting the Tunnel NAT translated packet exceeds size limit, packet dropped NAT translated packet exceeds size limit, packet dropped NAT translated packet exceeds size limit, packet dropped HTTP management port has changed HTTP management port has changed HTTP management port has changed HTTPS management port has changed HTTPS management port has changed HTTPS management port has changed L2TP Server : User Name authentication Failure locally. L2TP Server : User Name authentication Failure locally. L2TP Server : User Name authentication Failure locally. IKE Initiator: Start Quick Mode (Phase 2). IKE Initiator: Start Quick Mode (Phase 2). IKE Initiator: Start Quick Mode (Phase 2). Port configured to receive IPsec protocol ONLY; drop packet received in the clear Port configured to receive IPsec protocol ONLY; drop packet received in the clear SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 37
347 6.2.0 TCP UDP ICMP Network Access WARNING 348 5.9.0 Maintenance Firewall Event WARNING 348 6.0.5 Maintenance Firewall Event WARNING Port configured to receive IPsec protocol ONLY; drop packet received in the clear Imported VPN SA is invalid disabled Imported VPN SA is invalid disabled 348 6.2.0 Maintenance Firewall Event WARNING Imported VPN SA is invalid disabled 350 5.9.0 User Activity VPN IKE INFO IKE SA lifetime expired. 350 6.0.5 User Activity VPN IKE INFO IKE SA lifetime expired. 350 6.2.0 User Activity VPN IKE INFO IKE SA lifetime expired. 351 5.9.0 User Activity VPN IKE INFO 351 6.0.5 User Activity VPN IKE INFO 351 6.2.0 User Activity VPN IKE INFO 352 5.9.0 User Activity VPN IKE INFO 352 6.0.5 User Activity VPN IKE INFO 352 6.2.0 User Activity VPN IKE INFO 353 5.9.0 User Activity VPN IKE INFO 353 6.0.5 User Activity VPN IKE INFO 353 6.2.0 User Activity VPN IKE INFO 354 5.9.0 User Activity VPN IKE INFO 354 6.0.5 User Activity VPN IKE INFO 354 6.2.0 User Activity VPN IKE INFO 355 5.9.0 User Activity VPN IKE INFO IKE Initiator: Start Main Mode negotiation (Phase 1) IKE Initiator: Start Main Mode negotiation (Phase 1) IKE Initiator: Start Main Mode negotiation (Phase 1) IKE Responder: Received Quick Mode Request (Phase 2) IKE Responder: Received Quick Mode Request (Phase 2) IKE Responder: Received Quick Mode Request (Phase 2) IKE Initiator: Main Mode complete (Phase 1) IKE Initiator: Main Mode complete (Phase 1) IKE Initiator: Main Mode complete (Phase 1) IKE Initiator: Aggressive Mode complete (Phase 1). IKE Initiator: Aggressive Mode complete (Phase 1). IKE Initiator: Aggressive Mode complete (Phase 1). IKE Responder: Received Main Mode Request (Phase 1) 38
355 6.0.5 User Activity VPN IKE INFO 355 6.2.0 User Activity VPN IKE INFO 356 5.9.0 User Activity VPN IKE INFO 356 6.0.5 User Activity VPN IKE INFO 356 6.2.0 User Activity VPN IKE INFO 357 5.9.0 User Activity VPN IKE INFO 357 6.0.5 User Activity VPN IKE INFO 357 6.2.0 User Activity VPN IKE INFO 358 5.9.0 User Activity VPN IKE INFO 358 6.0.5 User Activity VPN IKE INFO IKE Responder: Received Main Mode Request (Phase 1) IKE Responder: Received Main Mode Request (Phase 1) IKE Responder: Received Aggressive Mode Request (Phase 1) IKE Responder: Received Aggressive Mode Request (Phase 1) IKE Responder: Received Aggressive Mode Request (Phase 1) IKE Responder: Main Mode complete (Phase 1) IKE Responder: Main Mode complete (Phase 1) IKE Responder: Main Mode complete (Phase 1) IKE Initiator: Start Aggressive Mode negotiation (Phase 1) IKE Initiator: Start Aggressive Mode negotiation (Phase 1) 358 6.2.0 User Activity VPN IKE INFO IKE Initiator: Start Aggressive Mode negotiation (Phase 1) 360 5.9.0 Maintenance Crypto Test ERROR Crypto DES test failed 360 6.0.5 Maintenance Crypto Test ERROR Crypto DES test failed 360 6.2.0 Maintenance Crypto Test ERROR Crypto DES test failed 361 5.9.0 Maintenance Crypto Test ERROR Crypto DH test failed 361 6.0.5 Maintenance Crypto Test ERROR Crypto DH test failed 361 6.2.0 Maintenance Crypto Test ERROR Crypto DH test failed 362 5.9.0 Maintenance Crypto Test ERROR Crypto Hmac MD5 test failed 362 6.0.5 Maintenance Crypto Test ERROR Crypto Hmac MD5 test failed 362 6.2.0 Maintenance Crypto Test ERROR Crypto Hmac MD5 test failed 363 5.9.0 Maintenance Crypto Test ERROR Crypto Hmac Sha1 test failed 363 6.0.5 Maintenance Crypto Test ERROR Crypto Hmac Sha1 test failed 363 6.2.0 Maintenance Crypto Test ERROR Crypto Hmac Sha1 test failed 364 5.9.0 Maintenance Crypto Test ERROR Crypto RSA test failed 364 6.0.5 Maintenance Crypto Test ERROR Crypto RSA test failed SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 39
364 6.2.0 Maintenance Crypto Test ERROR Crypto RSA test failed 365 5.9.0 Maintenance Crypto Test ERROR Crypto Sha1 test failed 365 6.0.5 Maintenance Crypto Test ERROR Crypto Sha1 test failed 365 6.2.0 Maintenance Crypto Test ERROR Crypto Sha1 test failed 366 5.9.0 Maintenance Crypto Test ERROR Crypto hardware DES test failed 366 6.0.5 Maintenance Crypto Test ERROR Crypto hardware DES test failed 366 6.2.0 Maintenance Crypto Test ERROR Crypto hardware DES test failed 367 5.9.0 Maintenance Crypto Test ERROR 367 6.0.5 Maintenance Crypto Test ERROR 367 6.2.0 Maintenance Crypto Test ERROR 368 5.9.0 Maintenance Crypto Test ERROR 368 6.0.5 Maintenance Crypto Test ERROR 368 6.2.0 Maintenance Crypto Test ERROR 369 5.9.0 Maintenance Crypto Test ERROR 369 6.0.5 Maintenance Crypto Test ERROR Crypto hardware 3DES test failed Crypto hardware 3DES test failed Crypto hardware 3DES test failed Crypto hardware DES with SHA test failed Crypto hardware DES with SHA test failed Crypto hardware DES with SHA test failed Crypto Hardware 3DES with SHA test failed Crypto Hardware 3DES with SHA test failed 369 6.2.0 Maintenance Crypto Test ERROR Crypto Hardware 3DES with SHA test failed 371 5.9.0 User Activity VPN Client INFO VPN Client Policy Provisioning 371 6.0.5 User Activity VPN Client INFO VPN Client Policy Provisioning 371 6.2.0 User Activity VPN Client INFO VPN Client Policy Provisioning 372 5.9.0 User Activity VPN IKE INFO 372 6.0.5 User Activity VPN IKE INFO 372 6.2.0 User Activity VPN IKE INFO 373 5.9.0 User Activity VPN IKE INFO 373 6.0.5 User Activity VPN IKE INFO IKE Initiator: Accepting IPsec proposal (Phase 2) IKE Initiator: Accepting IPsec proposal (Phase 2) IKE Initiator: Accepting IPsec proposal (Phase 2) IKE Responder: Aggressive Mode complete (Phase 1) IKE Responder: Aggressive Mode complete (Phase 1) 40
373 6.2.0 User Activity VPN IKE INFO 375 5.9.0 Maintenance PPTP INFO 375 6.0.5 Maintenance PPTP INFO 375 6.2.0 Maintenance PPTP INFO 376 5.9.0 Maintenance PPTP INFO 376 6.0.5 Maintenance PPTP INFO 376 6.2.0 Maintenance PPTP INFO 378 5.9.0 Maintenance PPTP INFO 378 6.0.5 Maintenance PPTP INFO 378 6.2.0 Maintenance PPTP INFO 379 5.9.0 Maintenance PPTP INFO 379 6.0.5 Maintenance PPTP INFO IKE Responder: Aggressive Mode complete (Phase 1) PPTP Control Connection Negotiation Started PPTP Control Connection Negotiation Started PPTP Control Connection Negotiation Started PPTP Session Negotiation Started PPTP Session Negotiation Started PPTP Session Negotiation Started PPTP Control Connection Established PPTP Control Connection Established PPTP Control Connection Established PPTP Tunnel Disconnect from Remote PPTP Tunnel Disconnect from Remote 379 6.2.0 Maintenance PPTP INFO PPTP Tunnel Disconnect from Remote 380 5.9.0 Maintenance PPTP INFO PPTP Session Established 380 6.0.5 Maintenance PPTP INFO PPTP Session Established 380 6.2.0 Maintenance PPTP INFO PPTP Session Established 381 5.9.0 Maintenance PPTP INFO 381 6.0.5 Maintenance PPTP INFO PPTP Session Disconnect from Remote PPTP Session Disconnect from Remote 381 6.2.0 Maintenance PPTP INFO PPTP Session Disconnect from Remote 382 5.9.0 Maintenance PPTP INFO PPTP PPP Negotiation Started 382 6.0.5 Maintenance PPTP INFO PPTP PPP Negotiation Started 382 6.2.0 Maintenance PPTP INFO PPTP PPP Negotiation Started 384 5.9.0 Maintenance PPTP INFO PPTP PPP Session Up SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 41
384 6.0.5 Maintenance PPTP INFO PPTP PPP Session Up 384 6.2.0 Maintenance PPTP INFO PPTP PPP Session Up 385 5.9.0 Maintenance PPTP INFO PPTP PPP Down 385 6.0.5 Maintenance PPTP INFO PPTP PPP Down 385 6.2.0 Maintenance PPTP INFO PPTP PPP Down 388 5.9.0 Maintenance PPTP INFO 388 6.0.5 Maintenance PPTP INFO 388 6.2.0 Maintenance PPTP INFO 389 5.9.0 Maintenance PPTP INFO 389 6.0.5 Maintenance PPTP INFO 389 6.2.0 Maintenance PPTP INFO 390 5.9.0 Maintenance PPTP INFO 390 6.0.5 Maintenance PPTP INFO 390 6.2.0 Maintenance PPTP INFO 392 5.9.0 Maintenance PPTP INFO 392 6.0.5 Maintenance PPTP INFO 392 6.2.0 Maintenance PPTP INFO 393 5.9.0 Maintenance PPTP INFO 393 6.0.5 Maintenance PPTP INFO 393 6.2.0 Maintenance PPTP INFO 396 5.9.0 Maintenance PPTP INFO 396 6.0.5 Maintenance PPTP INFO PPTP Disconnect Initiated by the User PPTP Disconnect Initiated by the User PPTP Disconnect Initiated by the User Disconnecting PPTP Tunnel due to traffic Timeout Disconnecting PPTP Tunnel due to traffic Timeout Disconnecting PPTP Tunnel due to traffic Timeout PPTP Connect Initiated by the User PPTP Connect Initiated by the User PPTP Connect Initiated by the User PPTP starting CHAP Authentication PPTP starting CHAP Authentication PPTP starting CHAP Authentication PPTP starting PAP Authentication PPTP starting PAP Authentication PPTP starting PAP Authentication PPTP PAP Authentication success. PPTP PAP Authentication success. 42
396 6.2.0 Maintenance PPTP INFO PPTP PAP Authentication success. 398 5.9.0 Maintenance PPTP INFO PPTP PPP Link Up 398 6.0.5 Maintenance PPTP INFO PPTP PPP Link Up 398 6.2.0 Maintenance PPTP INFO PPTP PPP Link Up 399 5.9.0 Maintenance PPTP INFO PPTP PPP Link down 399 6.0.5 Maintenance PPTP INFO PPTP PPP Link down 399 6.2.0 Maintenance PPTP INFO PPTP PPP Link down 400 5.9.0 Maintenance PPTP INFO PPTP PPP Link Finished 400 6.0.5 Maintenance PPTP INFO PPTP PPP Link Finished 400 6.2.0 Maintenance PPTP INFO PPTP PPP Link Finished 401 5.9.0 User Activity VPN IKE WARNING 401 6.0.5 User Activity VPN IKE WARNING 401 6.2.0 User Activity VPN IKE WARNING 402 5.9.0 User Activity VPN IKE WARNING 402 6.0.5 User Activity VPN IKE WARNING 402 6.2.0 User Activity VPN IKE WARNING 403 5.9.0 User Activity VPN IKE INFO 403 6.0.5 User Activity VPN IKE INFO 403 6.2.0 User Activity VPN IKE INFO 404 5.9.0 User Activity VPN IKE WARNING 404 6.0.5 User Activity VPN IKE WARNING Received notify. NO_PROPOSAL_CHOSEN Received notify. NO_PROPOSAL_CHOSEN Received notify. NO_PROPOSAL_CHOSEN IKE Responder: IKE proposal does not match (Phase 1) IKE Responder: IKE proposal does not match (Phase 1) IKE Responder: IKE proposal does not match (Phase 1) IKE negotiation aborted due to Timeout IKE negotiation aborted due to Timeout IKE negotiation aborted due to Timeout Failed payload verification after decryption; possible preshared key mismatch Failed payload verification after decryption; possible preshared key mismatch 404 6.2.0 User Activity VPN IKE WARNING Failed payload verification after decryption; possible preshared key mismatch 405 5.9.0 User Activity VPN IKE WARNING Failed payload validation SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 43
405 6.0.5 User Activity VPN IKE WARNING Failed payload validation 405 6.2.0 User Activity VPN IKE WARNING Failed payload validation 406 5.9.0 User Activity VPN IKE WARNING 406 6.0.5 User Activity VPN IKE WARNING Received packet retransmission. Drop duplicate packet Received packet retransmission. Drop duplicate packet 406 6.2.0 User Activity VPN IKE WARNING Received packet retransmission. Drop duplicate packet 408 5.9.0 Maintenance Security Services INFO Anti Virus Licenses Exceeded 408 6.0.5 Maintenance Security Services INFO Anti Virus Licenses Exceeded 408 6.2.0 Maintenance Security Services INFO Anti Virus Licenses Exceeded 409 5.9.0 User Activity VPN IKE WARNING 409 6.0.5 User Activity VPN IKE WARNING 409 6.2.0 User Activity VPN IKE WARNING 410 5.9.0 User Activity VPN IKE WARNING 410 6.0.5 User Activity VPN IKE WARNING 410 6.2.0 User Activity VPN IKE WARNING 411 5.9.0 User Activity VPN IKE WARNING 411 6.0.5 User Activity VPN IKE WARNING 411 6.2.0 User Activity VPN IKE WARNING 412 5.9.0 User Activity VPN IKE INFO 412 6.0.5 User Activity VPN IKE INFO Received notify: ISAKMP_AUTH_FAILED Received notify: ISAKMP_AUTH_FAILED Received notify: ISAKMP_AUTH_FAILED Computed hash does not match hash received from peer; preshared key mismatch Computed hash does not match hash received from peer; preshared key mismatch Computed hash does not match hash received from peer; preshared key mismatch Received notify: PAYLOAD_MALFORMED Received notify: PAYLOAD_MALFORMED Received notify: PAYLOAD_MALFORMED Received IPsec SA delete request Received IPsec SA delete request Received IPsec SA delete 412 6.2.0 User Activity VPN IKE INFO request 413 5.9.0 User Activity VPN IKE INFO Received IKE SA delete request 44
413 6.0.5 User Activity VPN IKE INFO Received IKE SA delete request 413 6.2.0 User Activity VPN IKE INFO Received IKE SA delete request 414 5.9.0 User Activity VPN IKE INFO 414 6.0.5 User Activity VPN IKE INFO 414 6.2.0 User Activity VPN IKE INFO 415 5.9.0 User Activity VPN IKE INFO 415 6.0.5 User Activity VPN IKE INFO Received notify: INVALID_COOKIES Received notify: INVALID_COOKIES Received notify: INVALID_COOKIES Received notify: RESPONDER_LIFETIME Received notify: RESPONDER_LIFETIME 415 6.2.0 User Activity VPN IKE INFO Received notify: RESPONDER_LIFETIME 416 5.9.0 User Activity VPN IKE INFO Received notify: INVALID_SPI 416 6.0.5 User Activity VPN IKE INFO Received notify: INVALID_SPI 416 6.2.0 User Activity VPN IKE INFO Received notify: INVALID_SPI 419 5.9.0 Maintenance RIP INFO 8401 RIP disabled on interface %s 419 6.0.5 Maintenance RIP INFO 8401 RIP disabled on interface %s 419 6.2.0 Maintenance RIP INFO 8401 RIP disabled on interface %s 420 5.9.0 Maintenance RIP INFO 8402 RIPv1 enabled on interface %s 420 6.0.5 Maintenance RIP INFO 8402 RIPv1 enabled on interface %s 420 6.2.0 Maintenance RIP INFO 8402 RIPv1 enabled on interface %s 421 5.9.0 Maintenance RIP INFO 8403 RIPv2 enabled on interface %s 421 6.0.5 Maintenance RIP INFO 8403 RIPv2 enabled on interface %s 421 6.2.0 Maintenance RIP INFO 8403 RIPv2 enabled on interface %s 422 5.9.0 Maintenance RIP INFO 8404 422 6.0.5 Maintenance RIP INFO 8404 RIPv2 compatibility (broadcast) mode enabled on interface %s RIPv2 compatibility (broadcast) mode enabled on interface %s 422 6.2.0 Maintenance RIP INFO 8404 RIPv2 compatibility (broadcast) mode enabled on interface %s 423 5.9.0 Maintenance RIP INFO 8405 RIP disabled on DMZ interface 423 6.0.5 Maintenance RIP INFO 8405 RIP disabled on DMZ interface 423 6.2.0 Maintenance RIP INFO 8405 RIP disabled on DMZ interface 424 5.9.0 Maintenance RIP INFO 8406 RIPv1 enabled on DMZ interface 424 6.0.5 Maintenance RIP INFO 8406 RIPv1 enabled on DMZ interface 424 6.2.0 Maintenance RIP INFO 8406 RIPv1 enabled on DMZ interface SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 45
425 5.9.0 Maintenance RIP INFO 8407 RIPv2 enabled on DMZ interface 425 6.0.5 Maintenance RIP INFO 8407 RIPv2 enabled on DMZ interface 425 6.2.0 Maintenance RIP INFO 8407 RIPv2 enabled on DMZ interface 426 5.9.0 Maintenance RIP INFO 8408 426 6.0.5 Maintenance RIP INFO 8408 426 6.2.0 Maintenance RIP INFO 8408 427 5.9.0 427 6.0.5 427 6.2.0 428 5.9.0 Debug 428 6.0.5 Debug 428 6.2.0 Debug RIPv2 compatibility (broadcast) mode enabled on DMZ interface RIPv2 compatibility (broadcast) mode enabled on DMZ interface RIPv2 compatibility (broadcast) mode enabled on DMZ interface VPN Tunnel Status VPN INFO 801 IPsec Tunnel status changed VPN Tunnel Status VPN INFO 801 IPsec Tunnel status changed VPN Tunnel Status VPN INFO 801 IPsec Tunnel status changed WARNING WARNING WARNING 429 5.9.0 Maintenance PPTP INFO 429 6.0.5 Maintenance PPTP INFO 429 6.2.0 Maintenance PPTP INFO 430 5.9.0 Maintenance PPTP INFO 430 6.0.5 Maintenance PPTP INFO 430 6.2.0 Maintenance PPTP INFO Source routed IP packet dropped Source routed IP packet dropped Source routed IP packet dropped No response from server to Echo Requests, disconnecting PPTP Tunnel No response from server to Echo Requests, disconnecting PPTP Tunnel No response from server to Echo Requests, disconnecting PPTP Tunnel No response from PPTP server to control connection requests No response from PPTP server to control connection requests No response from PPTP server to control connection requests 46
431 5.9.0 Maintenance PPTP INFO 431 6.0.5 Maintenance PPTP INFO 431 6.2.0 Maintenance PPTP INFO 432 5.9.0 Maintenance PPTP INFO 432 6.0.5 Maintenance PPTP INFO 432 6.2.0 Maintenance PPTP INFO 433 5.9.0 Maintenance PPTP INFO 433 6.0.5 Maintenance PPTP INFO 433 6.2.0 Maintenance PPTP INFO 434 5.9.0 User Activity WAN Failover INFO 434 6.0.5 User Activity WAN Failover INFO No response from PPTP server to call requests No response from PPTP server to call requests No response from PPTP server to call requests PPTP server rejected control connection PPTP server rejected control connection PPTP server rejected control connection PPTP server rejected the call request PPTP server rejected the call request PPTP server rejected the call request PPP Dial Up: Trying to failover but Alternate Profile is manual PPP Dial Up: Trying to failover but Alternate Profile is manual 434 6.2.0 User Activity WAN Failover INFO PPP Dial Up: Trying to failover but Alternate Profile is manual 435 5.9.0 System Error WAN Failover ALERT 652 WLB Failback initiated by %s 435 6.0.5 System Error WAN Failover ALERT 652 WLB Failback initiated by %s 435 6.2.0 System Error WAN Failover ALERT 652 WLB Failback initiated by %s 436 5.9.0 System Error WAN Failover ALERT 638 Probing succeeded on %s 436 6.0.5 System Error WAN Failover ALERT 638 Probing succeeded on %s 436 6.2.0 System Error WAN Failover ALERT 638 Probing succeeded on %s 437 5.9.0 Attack 437 6.0.5 Attack 437 6.2.0 Attack 438 5.9.0 User Activity ERROR 550 E Mail fragment dropped ERROR 550 E Mail fragment dropped ERROR 550 E Mail fragment dropped Locked out user logins allowed lockout period expired SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 47
438 6.0.5 User Activity 438 6.2.0 User Activity 439 5.9.0 User Activity 439 6.0.5 User Activity Locked out user logins allowed lockout period expired Locked out user logins allowed lockout period expired Locked out user logins allowed by %s Locked out user logins allowed by administrator 439 6.2.0 User Activity Locked out user logins allowed by %s 440 5.9.0 User Activity Firewall Rule INFO Access rule added 440 6.0.5 User Activity Firewall Rule INFO Access rule added 440 6.2.0 User Activity Firewall Rule INFO Access rule added 441 5.9.0 User Activity Firewall Rule INFO Access rule modified 441 6.0.5 User Activity Firewall Rule INFO Access rule modified 441 6.2.0 User Activity Firewall Rule INFO Access rule modified 442 5.9.0 User Activity Firewall Rule INFO Access rule deleted 442 6.0.5 User Activity Firewall Rule INFO Access rule deleted 442 6.2.0 User Activity Firewall Rule INFO Access rule deleted 443 5.9.0 User Activity Firewall Rule INFO 443 6.0.5 User Activity Firewall Rule INFO 443 6.2.0 User Activity Firewall Rule INFO 444 5.9.0 Maintenance PPTP INFO 444 6.0.5 Maintenance PPTP INFO 444 6.2.0 Maintenance PPTP INFO 445 5.9.0 User Activity VPN IKE INFO 445 6.0.5 User Activity VPN IKE INFO Access rules restored to defaults Access rules restored to defaults Access rules restored to defaults PPTP Server is not responding, check if the server is UP and running. PPTP Server is not responding, check if the server is UP and running. PPTP Server is not responding, check if the server is UP and running. IKE Initiator: Accepting peer lifetime. (Phase 1) IKE Initiator: Accepting peer lifetime. (Phase 1) 48
445 6.2.0 User Activity VPN IKE INFO 446 5.9.0 Attack 446 6.0.5 Attack 446 6.2.0 Attack ERROR 551 ERROR 551 ERROR 551 448 5.9.0 Maintenance VPN PKI ERROR 448 6.0.5 Maintenance VPN PKI ERROR 448 6.2.0 Maintenance VPN PKI ERROR 449 5.9.0 Maintenance VPN PKI ERROR 449 6.0.5 Maintenance VPN PKI ERROR 449 6.2.0 Maintenance VPN PKI ERROR 450 5.9.0 Maintenance VPN PKI ERROR 450 6.0.5 Maintenance VPN PKI ERROR IKE Initiator: Accepting peer lifetime. (Phase 1) FTP: PASV response spoof attack dropped FTP: PASV response spoof attack dropped FTP: PASV response spoof attack dropped PKI Failure: Output buffer too small PKI Failure: Output buffer too small PKI Failure: Output buffer too small PKI Failure: Cannot alloc memory PKI Failure: Cannot alloc memory PKI Failure: Cannot alloc memory PKI Failure: Reached the limit for local certs, cant load any more PKI Failure: Reached the limit for local certs, cant load any more 450 6.2.0 Maintenance VPN PKI ERROR PKI Failure: Reached the limit for local certs, cant load any more 451 5.9.0 Maintenance VPN PKI ERROR PKI Failure: Import failed 451 6.0.5 Maintenance VPN PKI ERROR PKI Failure: Import failed 451 6.2.0 Maintenance VPN PKI ERROR PKI Failure: Import failed 452 5.9.0 Maintenance VPN PKI ERROR 452 6.0.5 Maintenance VPN PKI ERROR 452 6.2.0 Maintenance VPN PKI ERROR PKI Failure: Incorrect admin password PKI Failure: Incorrect admin password PKI Failure: Incorrect admin password SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 49
453 5.9.0 Maintenance VPN PKI ERROR 453 6.0.5 Maintenance VPN PKI ERROR 453 6.2.0 Maintenance VPN PKI ERROR 454 5.9.0 Maintenance VPN PKI ERROR 454 6.0.5 Maintenance VPN PKI ERROR 454 6.2.0 Maintenance VPN PKI ERROR 455 5.9.0 Maintenance VPN PKI ERROR 455 6.0.5 Maintenance VPN PKI ERROR 455 6.2.0 Maintenance VPN PKI ERROR 456 5.9.0 Maintenance VPN PKI ERROR 456 6.0.5 Maintenance VPN PKI ERROR 456 6.2.0 Maintenance VPN PKI ERROR 457 5.9.0 Maintenance VPN PKI ERROR 457 6.0.5 Maintenance VPN PKI ERROR 457 6.2.0 Maintenance VPN PKI ERROR PKI Failure: CA certificates store exceeded. Cannot verify this Local Certificate PKI Failure: CA certificates store exceeded. Cannot verify this Local Certificate PKI Failure: CA certificates store exceeded. Cannot verify this Local Certificate PKI Failure: Improper file format. Please select PKCS#12 (*.p12) file PKI Failure: Improper file format. Please select PKCS#12 (*.p12) file PKI Failure: Improper file format. Please select PKCS#12 (*.p12) file PKI Failure: Certificate's ID does not match this Network Security Appliance PKI Failure: Certificate's ID does not match this Network Security Appliance PKI Failure: Certificate's ID does not match this Network Security Appliance PKI Failure: public private key mismatch PKI Failure: public private key mismatch PKI Failure: public private key mismatch PKI Failure: Duplicate local certificate name PKI Failure: Duplicate local certificate name PKI Failure: Duplicate local certificate name 50
458 5.9.0 Maintenance VPN PKI ERROR 458 6.0.5 Maintenance VPN PKI ERROR 458 6.2.0 Maintenance VPN PKI ERROR 459 5.9.0 Maintenance VPN PKI ERROR 459 6.0.5 Maintenance VPN PKI ERROR PKI Failure: Duplicate local certificate PKI Failure: Duplicate local certificate PKI Failure: Duplicate local certificate PKI Failure: No CA certificates yet loaded PKI Failure: No CA certificates yet loaded 459 6.2.0 Maintenance VPN PKI ERROR PKI Failure: No CA certificates yet loaded 460 5.9.0 Maintenance VPN PKI ERROR PKI Failure: Internal error 460 6.0.5 Maintenance VPN PKI ERROR PKI Failure: Internal error 460 6.2.0 Maintenance VPN PKI ERROR PKI Failure: Internal error 461 5.9.0 Maintenance VPN PKI ERROR 461 6.0.5 Maintenance VPN PKI ERROR 461 6.2.0 Maintenance VPN PKI ERROR 462 5.9.0 Maintenance VPN PKI ERROR 462 6.0.5 Maintenance VPN PKI ERROR 462 6.2.0 Maintenance VPN PKI ERROR 463 5.9.0 Maintenance VPN PKI ERROR 463 6.0.5 Maintenance VPN PKI ERROR 463 6.2.0 Maintenance VPN PKI ERROR 464 5.9.0 Maintenance VPN PKI ERROR 464 6.0.5 Maintenance VPN PKI ERROR 464 6.2.0 Maintenance VPN PKI ERROR PKI Failure: Temporary memory shortage, try again PKI Failure: Temporary memory shortage, try again PKI Failure: Temporary memory shortage, try again PKI Failure: The certificate chain is circular PKI Failure: The certificate chain is circular PKI Failure: The certificate chain is circular PKI Failure: The certificate chain is incomplete PKI Failure: The certificate chain is incomplete PKI Failure: The certificate chain is incomplete PKI Failure: The certificate chain has no root PKI Failure: The certificate chain has no root PKI Failure: The certificate chain has no root SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 51
465 5.9.0 Maintenance VPN PKI ERROR 465 6.0.5 Maintenance VPN PKI ERROR 465 6.2.0 Maintenance VPN PKI ERROR 466 5.9.0 Maintenance VPN PKI ERROR 466 6.0.5 Maintenance VPN PKI ERROR 466 6.2.0 Maintenance VPN PKI ERROR 467 5.9.0 Maintenance VPN PKI ERROR 467 6.0.5 Maintenance VPN PKI ERROR 467 6.2.0 Maintenance VPN PKI ERROR 468 5.9.0 Maintenance VPN PKI ERROR 468 6.0.5 Maintenance VPN PKI ERROR 468 6.2.0 Maintenance VPN PKI ERROR 469 5.9.0 Maintenance VPN PKI ERROR 469 6.0.5 Maintenance VPN PKI ERROR PKI Failure: The certificate or a certificate in the chain has expired PKI Failure: The certificate or a certificate in the chain has expired PKI Failure: The certificate or a certificate in the chain has expired PKI Failure: The certificate or a certificate in the chain has a validity period in the future PKI Failure: The certificate or a certificate in the chain has a validity period in the future PKI Failure: The certificate or a certificate in the chain has a validity period in the future PKI Failure: The certificate or a certificate in the chain is corrupt PKI Failure: The certificate or a certificate in the chain is corrupt PKI Failure: The certificate or a certificate in the chain is corrupt PKI Failure: The certificate or a certificate in the chain has a bad signature PKI Failure: The certificate or a certificate in the chain has a bad signature PKI Failure: The certificate or a certificate in the chain has a bad signature PKI Failure: Loaded but could not verify certificate PKI Failure: Loaded but could not verify certificate 52
469 6.2.0 Maintenance VPN PKI ERROR 470 5.9.0 Maintenance VPN PKI ERROR 470 6.0.5 Maintenance VPN PKI ERROR 470 6.2.0 Maintenance VPN PKI ERROR 473 5.9.0 Debug DHCP Relay INFO 473 6.0.5 Debug DHCP Relay INFO 473 6.2.0 Debug DHCP Relay INFO 474 5.9.0 Debug DHCP Relay INFO 474 6.0.5 Debug DHCP Relay INFO 474 6.2.0 Debug DHCP Relay INFO 476 5.9.0 Debug DHCP Relay INFO 476 6.0.5 Debug DHCP Relay INFO 476 6.2.0 Debug DHCP Relay INFO 477 5.9.0 Debug DHCP Relay INFO 477 6.0.5 Debug DHCP Relay INFO 477 6.2.0 Debug DHCP Relay INFO 481 5.9.0 Maintenance PPP Dial Up INFO PKI Failure: Loaded but could not verify certificate PKI Failure: Loaded the certificate but could not verify its chain PKI Failure: Loaded the certificate but could not verify its chain PKI Failure: Loaded the certificate but could not verify its chain DHCP REQUEST received from remote device DHCP REQUEST received from remote device DHCP REQUEST received from remote device DHCP DISCOVER received from remote device DHCP DISCOVER received from remote device DHCP DISCOVER received from remote device DHCP OFFER received from server DHCP OFFER received from server DHCP OFFER received from server DHCP NACK received from server DHCP NACK received from server DHCP NACK received from server PPP Dial Up: No peer IP address from Dial Up ISP, local and remote IPs will be the same SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 53
481 6.0.5 Maintenance PPP Dial Up INFO 481 6.2.0 Maintenance PPP Dial Up INFO 482 5.9.0 Maintenance Security Services WARNING 552 482 6.0.5 Maintenance Security Services WARNING 552 482 6.2.0 Maintenance Security Services WARNING 552 483 5.9.0 User Activity VPN IPsec WARNING 483 6.0.5 User Activity VPN IPsec WARNING 483 6.2.0 User Activity VPN IPsec WARNING 484 5.9.0 Maintenance DHCP Relay WARNING 484 6.0.5 Maintenance DHCP Relay WARNING 484 6.2.0 Maintenance DHCP Relay WARNING 486 5.9.0 User Activity 486 6.0.5 User Activity 486 6.2.0 User Activity 488 5.9.0 488 6.0.5 PPP Dial Up: No peer IP address from Dial Up ISP, local and remote IPs will be the same PPP Dial Up: No peer IP address from Dial Up ISP, local and remote IPs will be the same Received AV Alert: Your Network Anti Virus subscription will expire in 7 days. %s Received AV Alert: Your Network Anti Virus subscription will expire in 7 days. %s Received AV Alert: Your Network Anti Virus subscription will expire in 7 days. %s Received notify: INVALID_ID_INFO Received notify: INVALID_ID_INFO Received notify: INVALID_ID_INFO DHCP lease dropped. Lease from Central Gateway conflicts with Remote Management IP DHCP lease dropped. Lease from Central Gateway conflicts with Remote Management IP DHCP lease dropped. Lease from Central Gateway conflicts with Remote Management IP User login denied User has no privileges for guest service User login denied User has no privileges for guest service User login denied User has no privileges for guest service TCP UDP ICMP Network Access WARNING Packet dropped by guest check TCP UDP ICMP Network Access WARNING Packet dropped by guest check 54
488 6.2.0 TCP UDP ICMP Network Access WARNING Packet dropped by guest check 489 5.9.0 Maintenance Security Services WARNING 562 489 6.0.5 Maintenance Security Services WARNING 562 489 6.2.0 Maintenance Security Services WARNING 562 490 5.9.0 Maintenance Security Services WARNING 563 490 6.0.5 Maintenance Security Services WARNING 563 490 6.2.0 Maintenance Security Services WARNING 563 491 5.9.0 Maintenance Security Services WARNING 564 491 6.0.5 Maintenance Security Services WARNING 564 491 6.2.0 Maintenance Security Services WARNING 564 492 5.9.0 Maintenance Security Services WARNING 565 492 6.0.5 Maintenance Security Services WARNING 565 492 6.2.0 Maintenance Security Services WARNING 565 493 5.9.0 Maintenance Firewall Event INFO Received CFS Alert: Your Content Filtering subscription will expire in 7 days. Received CFS Alert: Your Content Filtering subscription will expire in 7 days. Received CFS Alert: Your Content Filtering subscription will expire in 7 days. Received CFS Alert: Your Content Filtering subscription has expired. Received CFS Alert: Your Content Filtering subscription has expired. Received CFS Alert: Your Content Filtering subscription has expired. Received E Mail Filter Alert: Your E Mail Filtering subscription will expire in 7 days. Received E Mail Filter Alert: Your E Mail Filtering subscription will expire in 7 days. Received E Mail Filter Alert: Your E Mail Filtering subscription will expire in 7 days. Received E Mail Filter Alert: Your E Mail Filtering subscription has expired. Received E Mail Filter Alert: Your E Mail Filtering subscription has expired. Received E Mail Filter Alert: Your E Mail Filtering subscription has expired. ISDN Driver Firmware successfully updated SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 55
493 6.0.5 Maintenance Firewall Event INFO 493 6.2.0 Maintenance Firewall Event INFO 494 5.9.0 System Error VPN Client INFO 658 494 6.0.5 System Error VPN Client INFO 658 494 6.2.0 System Error VPN Client INFO 658 496 5.9.0 Maintenance Security Services WARNING 496 6.0.5 Maintenance Security Services WARNING ISDN Driver Firmware successfully updated ISDN Driver Firmware successfully updated Global VPN Client License Exceeded: Connection denied. Global VPN Client License Exceeded: Connection denied. Global VPN Client License Exceeded: Connection denied. Registration Update Needed, Please restore your existing security service subscriptions. Registration Update Needed, Please restore your existing security service subscriptions. 496 6.2.0 Maintenance Security Services WARNING Registration Update Needed, Please restore your existing security service subscriptions. 502 5.9.0 Maintenance Firewall Event INFO WAN not ready 502 6.0.5 Maintenance Firewall Event INFO WAN not ready 502 6.2.0 Maintenance Firewall Event INFO WAN not ready 505 5.9.0 System Error VPN Client ERROR 660 505 6.0.5 System Error VPN Client ERROR 660 505 6.2.0 System Error VPN Client ERROR 660 506 5.9.0 Maintenance 506 6.0.5 Maintenance 506 6.2.0 Maintenance 507 5.9.0 Maintenance 507 6.0.5 Maintenance Blocked Quick Mode for Client using Default KeyId Blocked Quick Mode for Client using Default KeyId Blocked Quick Mode for Client using Default KeyId VPN disabled by administrator VPN disabled by administrator VPN disabled by administrator VPN enabled by administrator VPN enabled by administrator 56
507 6.2.0 Maintenance 508 5.9.0 Maintenance 508 6.0.5 Maintenance 508 6.2.0 Maintenance 509 5.9.0 Maintenance 509 6.0.5 Maintenance 509 6.2.0 Maintenance 518 5.9.0 518 6.0.5 518 6.2.0 520 5.9.0 User Activity 520 6.0.5 User Activity 520 6.2.0 User Activity VPN enabled by administrator WLAN disabled by administrator WLAN disabled by administrator WLAN disabled by administrator WLAN enabled by administrator WLAN enabled by administrator WLAN enabled by administrator 802.11b Management Wireless INFO 802.11 Management 802.11b Management Wireless INFO 802.11 Management 802.11b Management Wireless INFO 802.11 Management 521 5.9.0 Maintenance Firewall Event INFO 521 6.0.5 Maintenance Firewall Event INFO 521 6.2.0 Maintenance Firewall Event INFO CLI administrator logged out CLI administrator logged out CLI administrator logged out 522 5.9.0 Debug Network Access ALERT 554 522 6.0.5 Debug Network Access ALERT 554 Network Security Appliance initializing Network Security Appliance initializing Network Security Appliance initializing Malformed or unhandled IP packet dropped Malformed or unhandled IP packet dropped Malformed or unhandled IP 522 6.2.0 Debug Network Access ALERT 554 packet dropped 523 5.9.0 ICMP Network Access NOTICE ICMP packet dropped no match SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 57
523 6.0.5 ICMP Network Access NOTICE ICMP packet dropped no match 523 6.2.0 ICMP Network Access NOTICE ICMP packet dropped no match 524 5.9.0 TCP Network Access NOTICE Web access Request dropped 524 6.0.5 TCP Network Access NOTICE Web access Request dropped 524 6.2.0 TCP Network Access NOTICE Web access Request dropped 526 5.9.0 User Activity Network Access NOTICE 526 6.0.5 User Activity Network Access NOTICE 526 6.2.0 User Activity Network Access NOTICE 527 5.9.0 Attack 527 6.0.5 Attack 527 6.2.0 Attack 528 5.9.0 Attack 528 6.0.5 Attack 528 6.2.0 Attack ALERT 555 ALERT 555 ALERT 555 ALERT 556 ALERT 556 ALERT 556 529 5.9.0 System Error VPN Client INFO 643 529 6.0.5 System Error VPN Client INFO 643 529 6.2.0 System Error VPN Client INFO 643 533 5.9.0 533 6.0.5 533 6.2.0 Web management request allowed Web management request allowed Web management request allowed FTP: PORT bounce attack dropped. FTP: PORT bounce attack dropped. FTP: PORT bounce attack dropped. FTP: PASV response bounce attack dropped. FTP: PASV response bounce attack dropped. FTP: PASV response bounce attack dropped. Global VPN Client connection is not allowed. Appliance is not registered. Global VPN Client connection is not allowed. Appliance is not registered. Global VPN Client connection is not allowed. Appliance is not registered. TCP UDP ICMP VPN IPsec NOTICE IPsec (ESP) packet dropped TCP UDP ICMP VPN IPsec NOTICE IPsec (ESP) packet dropped TCP UDP ICMP VPN IPsec NOTICE IPsec (ESP) packet dropped 58
534 5.9.0 534 6.0.5 534 6.2.0 TCP UDP ICMP VPN IPsec NOTICE IPsec (AH) packet dropped TCP UDP ICMP VPN IPsec NOTICE IPsec (AH) packet dropped TCP UDP ICMP VPN IPsec NOTICE IPsec (AH) packet dropped 535 5.9.0 Debug VPN IPsec DEBUG 535 6.0.5 Debug VPN IPsec DEBUG 535 6.2.0 Debug VPN IPsec DEBUG 537 5.9.0 537 6.0.5 537 6.2.0 IPsec (ESP) packet dropped; waiting for pending IPsec connection IPsec (ESP) packet dropped; waiting for pending IPsec connection IPsec (ESP) packet dropped; waiting for pending IPsec connection Connection Traffic Network Traffic INFO Connection Closed Connection Traffic Network Traffic INFO Connection Closed Connection Traffic Network Traffic INFO Connection Closed 538 5.9.0 Attack Network Access ALERT 557 538 6.0.5 Attack Network Access ALERT 557 538 6.2.0 Attack Network Access ALERT 557 542 5.9.0 User Activity PPP Dial Up INFO 542 6.0.5 User Activity PPP Dial Up INFO 542 6.2.0 User Activity PPP Dial Up INFO 543 5.9.0 User Activity VPN IKE INFO 543 6.0.5 User Activity VPN IKE INFO 543 6.2.0 User Activity VPN IKE INFO FTP: Data connection from non default port dropped FTP: Data connection from non default port dropped FTP: Data connection from non default port dropped PPP Dial Up: Previous session was connected for %s PPP Dial Up: Previous session was connected for %s PPP Dial Up: Previous session was connected for %s IKE Initiator: Using secondary gateway to negotiate IKE Initiator: Using secondary gateway to negotiate IKE Initiator: Using secondary gateway to negotiate SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 59
544 5.9.0 User Activity VPN IKE INFO 544 6.0.5 User Activity VPN IKE INFO 544 6.2.0 User Activity VPN IKE INFO 545 5.9.0 User Activity VPN IKE INFO 545 6.0.5 User Activity VPN IKE INFO IKE Initiator drop: VPN tunnel end point does not match configured VPN Policy Bound to scope IKE Initiator drop: VPN tunnel end point does not match configured VPN Policy Bound to scope IKE Initiator drop: VPN tunnel end point does not match configured VPN Policy Bound to scope IKE Responder drop: VPN tunnel end point does not match configured VPN Policy Bound to scope IKE Responder drop: VPN tunnel end point does not match configured VPN Policy Bound to scope 545 6.2.0 User Activity VPN IKE INFO IKE Responder drop: VPN tunnel end point does not match configured VPN Policy Bound to scope 546 5.9.0 WLAN IDS WLAN IDS ALERT 901 Found Rogue Access Point 546 6.0.5 WLAN IDS WLAN IDS ALERT 901 Found Rogue Access Point 546 6.2.0 WLAN IDS WLAN IDS ALERT 901 Found Rogue Access Point 548 5.9.0 WLAN IDS WLAN IDS ALERT 903 548 6.0.5 WLAN IDS WLAN IDS ALERT 903 548 6.2.0 WLAN IDS WLAN IDS ALERT 903 549 5.9.0 User Activity 549 6.0.5 User Activity 549 6.2.0 User Activity Association Flood from WLAN station Association Flood from WLAN station Association Flood from WLAN station User login failed Guest service limit reached User login failed Guest service limit reached User login failed Guest service limit reached 60
550 5.9.0 User Activity 550 6.0.5 User Activity 550 6.2.0 User Activity 551 5.9.0 User Activity 551 6.0.5 User Activity 551 6.2.0 User Activity 557 5.9.0 User Activity 557 6.0.5 User Activity 557 6.2.0 User Activity 558 5.9.0 User Activity 558 6.0.5 User Activity 558 6.2.0 User Activity 559 5.9.0 User Activity 559 6.0.5 User Activity 559 6.2.0 User Activity 560 5.9.0 User Activity 560 6.0.5 User Activity 560 6.2.0 User Activity Guest Session Timeout Guest Session Timeout Guest Session Timeout Guest Account Timeout Guest Account Timeout Guest Account Timeout Guest login denied. Guest '%s' is already logged in. Please try again later. Guest login denied. Guest '%s' is already logged in. Please try again later. Guest login denied. Guest '%s' is already logged in. Please try again later. Guest account '%s' created Guest account '%s' created Guest account '%s' created Guest account '%s' deleted Guest account '%s' deleted Guest account '%s' deleted Guest account '%s' disabled Guest account '%s' disabled Guest account '%s' disabled SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 61
561 5.9.0 User Activity 561 6.0.5 User Activity 561 6.2.0 User Activity 562 5.9.0 User Activity 562 6.0.5 User Activity 562 6.2.0 User Activity 563 5.9.0 User Activity 563 6.0.5 User Activity 563 6.2.0 User Activity 564 5.9.0 User Activity 564 6.0.5 User Activity Guest account '%s' re enabled Guest account '%s' re enabled Guest account '%s' re enabled Guest account '%s' pruned Guest account '%s' pruned Guest account '%s' pruned Guest account '%s' re generated Guest account '%s' re generated Guest account '%s' re generated Guest Idle Timeout Guest Idle Timeout 564 6.2.0 User Activity Guest Idle Timeout 565 5.9.0 System Error Firewall Event ALERT 646 Interface %s Link Is Up 565 6.0.5 System Error Firewall Event ALERT 646 Interface %s Link Is Up 565 6.2.0 System Error Firewall Event ALERT 646 Interface %s Link Is Up 566 5.9.0 System Error Firewall Event ALERT 647 Interface %s Link Is Down 566 6.0.5 System Error Firewall Event ALERT 647 Interface %s Link Is Down 566 6.2.0 System Error Firewall Event ALERT 647 Interface %s Link Is Down 567 5.9.0 Maintenance Firewall Event INFO 567 6.0.5 Maintenance Firewall Event INFO 567 6.2.0 Maintenance Firewall Event INFO 568 5.9.0 Maintenance Firewall Event INFO Interface IP Assignment changed: Shutting down %s Interface IP Assignment changed: Shutting down %s Interface IP Assignment changed: Shutting down %s Interface IP Assignment : Binding and initializing %s 62
568 6.0.5 Maintenance Firewall Event INFO 568 6.2.0 Maintenance Firewall Event INFO 569 5.9.0 Maintenance Firewall Event INFO 569 6.0.5 Maintenance Firewall Event INFO 569 6.2.0 Maintenance Firewall Event INFO 570 5.9.0 Maintenance Firewall Event INFO 570 6.0.5 Maintenance Firewall Event INFO 570 6.2.0 Maintenance Firewall Event INFO 573 5.9.0 System Error Firewall Event WARNING 649 573 6.0.5 System Error Firewall Event WARNING 649 573 6.2.0 System Error Firewall Event WARNING 649 574 5.9.0 System Error Firewall Event WARNING 650 574 6.0.5 System Error Firewall Event WARNING 650 574 6.2.0 System Error Firewall Event WARNING 650 575 5.9.0 575 6.0.5 575 6.2.0 Interface IP Assignment : Binding and initializing %s Interface IP Assignment : Binding and initializing %s Network for interface %s overlaps with another interface. Network for interface %s overlaps with another interface. Network for interface %s overlaps with another interface. Please connect interface %s to another network to function properly Please connect interface %s to another network to function properly Please connect interface %s to another network to function properly The preferences file is too large to be saved in available flash memory The preferences file is too large to be saved in available flash memory The preferences file is too large to be saved in available flash memory All preference values have been set to factory default values All preference values have been set to factory default values All preference values have been set to factory default values System Environment Firewall Hardware ERROR 101 Voltages Out of Tolerance System Environment Firewall Hardware ERROR 101 Voltages Out of Tolerance System Environment Firewall Hardware ERROR 101 Voltages Out of Tolerance SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 63
576 5.9.0 576 6.0.5 576 6.2.0 577 5.9.0 577 6.0.5 577 6.2.0 578 5.9.0 578 6.0.5 578 6.2.0 579 5.9.0 579 6.0.5 System Environment Firewall Hardware ALERT 102 Fan Failure System Environment Firewall Hardware ALERT 102 Fan Failure System Environment Firewall Hardware ALERT 102 Fan Failure System Environment Firewall Hardware ALERT 103 Thermal Yellow System Environment Firewall Hardware ALERT 103 Thermal Yellow System Environment Firewall Hardware ALERT 103 Thermal Yellow System Environment Firewall Hardware ALERT 104 Thermal Red System Environment Firewall Hardware ALERT 104 Thermal Red System Environment Firewall Hardware ALERT 104 Thermal Red System Environment Firewall Hardware ALERT 105 Thermal Red Timer Exceeded System Environment Firewall Hardware ALERT 105 Thermal Red Timer Exceeded 579 6.2.0 System Environment Firewall Hardware ALERT 105 Thermal Red Timer Exceeded 580 5.9.0 Attack Network Access ALERT 558 TCP SYN/FIN packet dropped 580 6.0.5 Attack Network Access ALERT 558 TCP SYN/FIN packet dropped 580 6.2.0 Attack Network Access ALERT 558 TCP SYN/FIN packet dropped 581 5.9.0 Maintenance WAN Failover WARNING 581 6.0.5 Maintenance WAN Failover WARNING WLB Spill over started, configured threshold exceeded WLB Spill over started, configured threshold exceeded 581 6.2.0 Maintenance WAN Failover WARNING WLB Spill over started, configured threshold exceeded 582 5.9.0 Maintenance WAN Failover WARNING WLB Spill over stopped 582 6.0.5 Maintenance WAN Failover WARNING WLB Spill over stopped 582 6.2.0 Maintenance WAN Failover WARNING WLB Spill over stopped 583 5.9.0 Attack Access ERROR 559 User login disabled from %s 64
583 6.0.5 Attack Access ERROR 559 User login disabled from %s 583 6.2.0 Attack Access ERROR 559 User login disabled from %s 584 5.9.0 System Error WAN Failover ALERT 651 WLB Failover in progress 584 6.0.5 System Error WAN Failover ALERT 651 WLB Failover in progress 584 6.2.0 System Error WAN Failover ALERT 651 WLB Failover in progress 585 5.9.0 System Error WAN Failover ALERT 653 WLB Resource is now available 585 6.0.5 System Error WAN Failover ALERT 653 WLB Resource is now available 585 6.2.0 System Error WAN Failover ALERT 653 WLB Resource is now available 586 5.9.0 System Error WAN Failover ALERT 654 WLB Resource failed 586 6.0.5 System Error WAN Failover ALERT 654 WLB Resource failed 586 6.2.0 System Error WAN Failover ALERT 654 WLB Resource failed 587 5.9.0 User Activity VPN IKE WARNING Header verification failed 587 6.0.5 User Activity VPN IKE WARNING Header verification failed 587 6.2.0 User Activity VPN IKE WARNING Header verification failed 588 5.9.0 Maintenance DHCP Client INFO 588 6.0.5 Maintenance DHCP Client INFO 588 6.2.0 Maintenance DHCP Client INFO 589 5.9.0 Maintenance DHCP Client INFO 589 6.0.5 Maintenance DHCP Client INFO 589 6.2.0 Maintenance DHCP Client INFO 590 5.9.0 590 6.0.5 Received DHCP offer packet has errors Received DHCP offer packet has errors Received DHCP offer packet has errors Received response packet for DHCP request has errors Received response packet for DHCP request has errors Received response packet for DHCP request has errors LAN UDP LAN TCP Network Access NOTICE IP type %s packet dropped LAN UDP LAN TCP Network Access NOTICE IP type %s packet dropped 590 6.2.0 LAN UDP LAN TCP Network Access NOTICE IP type %s packet dropped 591 5.9.0 Attack PPP Dial Up ERROR 566 Maximum sequential failed dial attempts (10) to a single dial up number: %s SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 65
591 6.0.5 Attack PPP Dial Up ERROR 566 591 6.2.0 Attack PPP Dial Up ERROR 566 592 5.9.0 Attack PPP Dial Up ERROR 567 592 6.0.5 Attack PPP Dial Up ERROR 567 592 6.2.0 Attack PPP Dial Up ERROR 567 593 5.9.0 Maintenance PPPoE INFO 593 6.0.5 Maintenance PPPoE INFO 593 6.2.0 Maintenance PPPoE INFO 594 5.9.0 Maintenance PPPoE INFO 594 6.0.5 Maintenance PPPoE INFO 594 6.2.0 Maintenance PPPoE INFO 595 5.9.0 Maintenance PPPoE INFO 595 6.0.5 Maintenance PPPoE INFO Maximum sequential failed dial attempts (10) to a single dial up number: %s Maximum sequential failed dial attempts (10) to a single dial up number: %s Regulatory requirements prohibit %s from being re dialed for 30 minutes Regulatory requirements prohibit %s from being re dialed for 30 minutes Regulatory requirements prohibit %s from being re dialed for 30 minutes Received PPPoE Active Discovery Offer Received PPPoE Active Discovery Offer Received PPPoE Active Discovery Offer Received PPPoE Active Discovery Session_confirmation Received PPPoE Active Discovery Session_confirmation Received PPPoE Active Discovery Session_confirmation Sending PPPoE Active Discovery Request Sending PPPoE Active Discovery Request 595 6.2.0 Maintenance PPPoE INFO Sending PPPoE Active Discovery Request 596 5.9.0 Debug PPTP DEBUG PPTP decode failure 596 6.0.5 Debug PPTP DEBUG PPTP decode failure 596 6.2.0 Debug PPTP DEBUG PPTP decode failure 597 5.9.0 Debug Network ICMP packet allowed 597 6.0.5 Debug Network ICMP packet allowed 597 6.2.0 Debug Network ICMP packet allowed 66
598 5.9.0 Debug Network ICMP packet from LAN allowed 598 6.0.5 Debug Network ICMP packet from LAN allowed 598 6.2.0 Debug Network ICMP packet from LAN allowed 599 5.9.0 System Error Firewall Hardware ERROR 655 Diagnostic Code G 599 6.0.5 System Error Firewall Hardware ERROR 655 Diagnostic Code G 599 6.2.0 System Error Firewall Hardware ERROR 655 Diagnostic Code G 600 5.9.0 System Error Firewall Hardware ERROR 656 Diagnostic Code H 600 6.0.5 System Error Firewall Hardware ERROR 656 Diagnostic Code H 600 6.2.0 System Error Firewall Hardware ERROR 656 Diagnostic Code H 601 5.9.0 System Error Firewall Hardware ERROR 657 Diagnostic Code I 601 6.0.5 System Error Firewall Hardware ERROR 657 Diagnostic Code I 601 6.2.0 System Error Firewall Hardware ERROR 657 Diagnostic Code I 602 5.9.0 Debug Network DNS packet allowed 602 6.0.5 Debug Network DNS packet allowed 602 6.2.0 Debug Network DNS packet allowed 603 5.9.0 System Error L2TP Server ERROR 661 603 6.0.5 System Error L2TP Server ERROR 661 603 6.2.0 System Error L2TP Server ERROR 661 605 5.9.0 User Activity VPN IKE WARNING 605 6.0.5 User Activity VPN IKE WARNING 605 6.2.0 User Activity VPN IKE WARNING 606 5.9.0 Attack 606 6.0.5 Attack 606 6.2.0 Attack ALERT 568 ALERT 568 ALERT 568 607 5.9.0 Debug UDP VPN IKE INFO 607 6.0.5 Debug UDP VPN IKE INFO Adding L2TP IP pool Address object Failed. Adding L2TP IP pool Address object Failed. Adding L2TP IP pool Address object Failed. Received unencrypted packet in crypto active state Received unencrypted packet in crypto active state Received unencrypted packet in crypto active state Spank attack multicast packet dropped Spank attack multicast packet dropped Spank attack multicast packet dropped Received ISAKMP packet destined to port %s Received ISAKMP packet destined to port %s SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 67
607 6.2.0 Debug UDP VPN IKE INFO 608 5.9.0 Attack 608 6.0.5 Attack 608 6.2.0 Attack 609 5.9.0 Attack 609 6.0.5 Attack Received ISAKMP packet destined to port %s ALERT 569 IPS Detection Alert: %s ALERT 569 IPS Detection Alert: %s ALERT 569 IPS Detection Alert: %s ALERT 570 IPS Prevention Alert: %s ALERT 570 IPS Prevention Alert: %s 609 6.2.0 Attack ALERT 570 IPS Prevention Alert: %s 610 5.9.0 Maintenance Crypto Test ERROR Crypto Hardware AES test failed 610 6.0.5 Maintenance Crypto Test ERROR Crypto Hardware AES test failed 610 6.2.0 Maintenance Crypto Test ERROR Crypto Hardware AES test failed 614 5.9.0 Maintenance Security Services WARNING 571 614 6.0.5 Maintenance Security Services WARNING 571 Received IPS Alert: Your Intrusion Prevention (IDP) subscription has expired. Received IPS Alert: Your Intrusion Prevention (IDP) subscription has expired. 614 6.2.0 Maintenance Security Services WARNING 571 Received IPS Alert: Your Intrusion Prevention (IDP) subscription has expired. 615 5.9.0 WLAN IDS WLAN IDS WARNING 904 WLAN client null probing 615 6.0.5 WLAN IDS WLAN IDS WARNING 904 WLAN client null probing 615 6.2.0 WLAN IDS WLAN IDS WARNING 904 WLAN client null probing 616 5.9.0 Debug VPN IKE ERROR Payload processing failed 616 6.0.5 Debug VPN IKE ERROR Payload processing failed 616 6.2.0 Debug VPN IKE ERROR Payload processing failed 617 5.9.0 Maintenance Wireless INFO 617 6.0.5 Maintenance Wireless INFO WLAN not in AP mode, DHCP server will not provide lease to clients on WLAN WLAN not in AP mode, DHCP server will not provide lease to clients on WLAN 68
617 6.2.0 Maintenance Wireless INFO 618 5.9.0 Debug Bootp DEBUG 618 6.0.5 Debug Bootp DEBUG 618 6.2.0 Debug Bootp DEBUG 619 5.9.0 Maintenance Bootp INFO 619 6.0.5 Maintenance Bootp INFO 619 6.2.0 Maintenance Bootp INFO 620 5.9.0 Maintenance Bootp INFO 620 6.0.5 Maintenance Bootp INFO WLAN not in AP mode, DHCP server will not provide lease to clients on WLAN BOOTP server response relayed to remote device BOOTP server response relayed to remote device BOOTP server response relayed to remote device BOOTP Client IP address on LAN conflicts with remote device IP, deleting IP address from remote table BOOTP Client IP address on LAN conflicts with remote device IP, deleting IP address from remote table BOOTP Client IP address on LAN conflicts with remote device IP, deleting IP address from remote table BOOTP reply relayed to local device BOOTP reply relayed to local device 620 6.2.0 Maintenance Bootp INFO BOOTP reply relayed to local device 622 5.9.0 VoIP VoIP INFO VoIP Call Connected 622 6.0.5 VoIP VoIP INFO VoIP Call Connected 622 6.2.0 VoIP VoIP INFO VoIP Call Connected 623 5.9.0 VoIP VoIP INFO VoIP Call Disconnected 623 6.0.5 VoIP VoIP INFO VoIP Call Disconnected 623 6.2.0 VoIP VoIP INFO VoIP Call Disconnected 624 5.9.0 VoIP VoIP DEBUG H.323/RAS Admission Reject 624 6.0.5 VoIP VoIP DEBUG H.323/RAS Admission Reject 624 6.2.0 VoIP VoIP DEBUG H.323/RAS Admission Reject 625 5.9.0 VoIP VoIP DEBUG H.323/RAS Admission Confirm 625 6.0.5 VoIP VoIP DEBUG H.323/RAS Admission Confirm 625 6.2.0 VoIP VoIP DEBUG H.323/RAS Admission Confirm SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 69
626 5.9.0 VoIP VoIP DEBUG H.323/RAS Admission Request 626 6.0.5 VoIP VoIP DEBUG H.323/RAS Admission Request 626 6.2.0 VoIP VoIP DEBUG H.323/RAS Admission Request 627 5.9.0 VoIP VoIP DEBUG H.323/RAS Bandwidth Reject 627 6.0.5 VoIP VoIP DEBUG H.323/RAS Bandwidth Reject 627 6.2.0 VoIP VoIP DEBUG H.323/RAS Bandwidth Reject 628 5.9.0 VoIP VoIP DEBUG H.323/RAS Disengage Confirm 628 6.0.5 VoIP VoIP DEBUG H.323/RAS Disengage Confirm 628 6.2.0 VoIP VoIP DEBUG H.323/RAS Disengage Confirm 629 5.9.0 VoIP VoIP DEBUG H.323/RAS Gatekeeper Reject 629 6.0.5 VoIP VoIP DEBUG H.323/RAS Gatekeeper Reject 629 6.2.0 VoIP VoIP DEBUG H.323/RAS Gatekeeper Reject 630 5.9.0 VoIP VoIP DEBUG H.323/RAS Location Confirm 630 6.0.5 VoIP VoIP DEBUG H.323/RAS Location Confirm 630 6.2.0 VoIP VoIP DEBUG H.323/RAS Location Confirm 631 5.9.0 VoIP VoIP DEBUG H.323/RAS Location Reject 631 6.0.5 VoIP VoIP DEBUG H.323/RAS Location Reject 631 6.2.0 VoIP VoIP DEBUG H.323/RAS Location Reject 632 5.9.0 VoIP VoIP DEBUG H.323/RAS Registration Reject 632 6.0.5 VoIP VoIP DEBUG H.323/RAS Registration Reject 632 6.2.0 VoIP VoIP DEBUG H.323/RAS Registration Reject 633 5.9.0 VoIP VoIP DEBUG H.323/H.225 Setup 633 6.0.5 VoIP VoIP DEBUG H.323/H.225 Setup 633 6.2.0 VoIP VoIP DEBUG H.323/H.225 Setup 634 5.9.0 VoIP VoIP DEBUG H.323/H.225 Connect 634 6.0.5 VoIP VoIP DEBUG H.323/H.225 Connect 634 6.2.0 VoIP VoIP DEBUG H.323/H.225 Connect 635 5.9.0 VoIP VoIP DEBUG H.323/H.245 Address 635 6.0.5 VoIP VoIP DEBUG H.323/H.245 Address 635 6.2.0 VoIP VoIP DEBUG H.323/H.245 Address 636 5.9.0 VoIP VoIP DEBUG H.323/H.245 End Session 636 6.0.5 VoIP VoIP DEBUG H.323/H.245 End Session 636 6.2.0 VoIP VoIP DEBUG H.323/H.245 End Session 637 5.9.0 VoIP VoIP DEBUG VoIP %s Endpoint added 637 6.0.5 VoIP VoIP DEBUG VoIP %s Endpoint added 637 6.2.0 VoIP VoIP DEBUG VoIP %s Endpoint added 638 5.9.0 VoIP VoIP DEBUG VoIP %s Endpoint removed 70
638 6.0.5 VoIP VoIP DEBUG VoIP %s Endpoint removed 638 6.2.0 VoIP VoIP DEBUG VoIP %s Endpoint removed 639 5.9.0 VoIP VoIP WARNING 639 6.0.5 VoIP VoIP WARNING 639 6.2.0 VoIP VoIP WARNING 640 5.9.0 VoIP VoIP DEBUG 640 6.0.5 VoIP VoIP DEBUG VoIP %s Endpoint not added configured 'public' endpoint limit reached VoIP %s Endpoint not added configured 'public' endpoint limit reached VoIP %s Endpoint not added configured 'public' endpoint limit reached H.323/RAS Unknown Message Response H.323/RAS Unknown Message Response 640 6.2.0 VoIP VoIP DEBUG H.323/RAS Unknown Message Response 641 5.9.0 VoIP VoIP DEBUG H.323/RAS Disengage Reject 641 6.0.5 VoIP VoIP DEBUG H.323/RAS Disengage Reject 641 6.2.0 VoIP VoIP DEBUG H.323/RAS Disengage Reject 642 5.9.0 VoIP VoIP DEBUG 642 6.0.5 VoIP VoIP DEBUG H.323/RAS Unregistration Reject H.323/RAS Unregistration Reject 642 6.2.0 VoIP VoIP DEBUG H.323/RAS Unregistration Reject 643 5.9.0 VoIP VoIP DEBUG SIP Request 643 6.0.5 VoIP VoIP DEBUG SIP Request 643 6.2.0 VoIP VoIP DEBUG SIP Request 644 5.9.0 VoIP VoIP DEBUG SIP Response 644 6.0.5 VoIP VoIP DEBUG SIP Response 644 6.2.0 VoIP VoIP DEBUG SIP Response 645 5.9.0 VoIP VoIP WARNING 645 6.0.5 VoIP VoIP WARNING SIP Register expiration exceeds configured Signaling inactivity time out SIP Register expiration exceeds configured Signaling inactivity time out SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 71
645 6.2.0 VoIP VoIP WARNING 646 5.9.0 System Error Firewall Event ALERT 5238 646 6.0.5 System Error Firewall Event ALERT 5238 646 6.2.0 System Error Firewall Event ALERT 5238 647 5.9.0 System Error Firewall Event ALERT 5239 647 6.0.5 System Error Firewall Event ALERT 5239 647 6.2.0 System Error Firewall Event ALERT 5239 648 5.9.0 Attack VPN IPsec ERROR 572 648 6.0.5 Attack VPN IPsec ERROR 572 SIP Register expiration exceeds configured Signaling inactivity time out Packet dropped; connection limit for this source IP address has been reached Packet dropped; connection limit for this source IP address has been reached Packet dropped; connection limit for this source IP address has been reached Packet dropped; connection limit for this destination IP address has been reached Packet dropped; connection limit for this destination IP address has been reached Packet dropped; connection limit for this destination IP address has been reached Packet destination not in VPN Access list Packet destination not in VPN Access list 648 6.2.0 Attack VPN IPsec ERROR 572 Packet destination not in VPN Access list 651 5.9.0 Debug IPComp DEBUG IPComp connection interrupt 651 6.0.5 Debug IPComp DEBUG IPComp connection interrupt 651 6.2.0 Debug IPComp DEBUG IPComp connection interrupt 652 5.9.0 652 6.0.5 TCP UDP ICMP IPComp NOTICE IPComp packet dropped TCP UDP ICMP IPComp NOTICE IPComp packet dropped 652 6.2.0 TCP UDP ICMP IPComp NOTICE IPComp packet dropped IPComp packet dropped; waiting for pending IPComp connection 653 5.9.0 Debug IPComp DEBUG 72
653 6.0.5 Debug IPComp DEBUG 653 6.2.0 Debug IPComp DEBUG 654 5.9.0 System Error Firewall Logging CRITICAL 654 6.0.5 System Error Firewall Logging CRITICAL 654 6.2.0 System Error Firewall Logging CRITICAL 655 5.9.0 System Error Firewall Logging CRITICAL 655 6.0.5 System Error Firewall Logging CRITICAL 655 6.2.0 System Error Firewall Logging CRITICAL 656 5.9.0 System Error Firewall Logging WARNING 656 6.0.5 System Error Firewall Logging WARNING 656 6.2.0 System Error Firewall Logging WARNING 657 5.9.0 Maintenance Network INFO 657 6.0.5 Maintenance Network INFO 657 6.2.0 Maintenance Network INFO 658 5.9.0 System Error VPN IKE WARNING 658 6.0.5 System Error VPN IKE WARNING 658 6.2.0 System Error VPN IKE WARNING 659 5.9.0 System Error VPN Client ERROR IPComp packet dropped; waiting for pending IPComp connection IPComp packet dropped; waiting for pending IPComp connection Maximum events per second threshold exceeded Maximum events per second threshold exceeded Maximum events per second threshold exceeded Maximum syslog data per second threshold exceeded Maximum syslog data per second threshold exceeded Maximum syslog data per second threshold exceeded SMTP POP Before SMTP authentication failed SMTP POP Before SMTP authentication failed SMTP POP Before SMTP authentication failed Syslog Server cannot be reached Syslog Server cannot be reached Syslog Server cannot be reached IKE Responder: Proposed IKE ID mismatch IKE Responder: Proposed IKE ID mismatch IKE Responder: Proposed IKE ID mismatch IKE Responder: IP Address already exists in the DHCP relay table. Client traffic not allowed. SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 73
659 6.0.5 System Error VPN Client ERROR 659 6.2.0 System Error VPN Client ERROR 660 5.9.0 System Error VPN Client ERROR 660 6.0.5 System Error VPN Client ERROR 660 6.2.0 System Error VPN Client ERROR 661 5.9.0 User Activity VPN IKE ERROR 661 6.0.5 User Activity VPN IKE ERROR 661 6.2.0 User Activity VPN IKE ERROR 662 5.9.0 Attack 662 6.0.5 Attack 662 6.2.0 Attack ERROR 6434 ERROR 6434 ERROR 6434 665 5.9.0 0 PPP Dial Up INFO 665 6.0.5 0 PPP Dial Up INFO 665 6.2.0 0 PPP Dial Up INFO 666 5.9.0 0 PPP Dial Up INFO 666 6.0.5 0 PPP Dial Up INFO IKE Responder: IP Address already exists in the DHCP relay table. Client traffic not allowed. IKE Responder: IP Address already exists in the DHCP relay table. Client traffic not allowed. IKE Responder: %s Policy does not allow static IP for Virtual Adapter. IKE Responder: %s Policy does not allow static IP for Virtual Adapter. IKE Responder: %s Policy does not allow static IP for Virtual Adapter. Received notify: INVALID_PAYLOAD Received notify: INVALID_PAYLOAD Received notify: INVALID_PAYLOAD Drop WLAN traffic from non SonicPoint devices Drop WLAN traffic from non SonicPoint devices Drop WLAN traffic from non SonicPoint devices PPP Dial Up: Dialing not allowed by schedule. %s PPP Dial Up: Dialing not allowed by schedule. %s PPP Dial Up: Dialing not allowed by schedule. %s PPP Dial Up: Connection disconnected as scheduled. PPP Dial Up: Connection disconnected as scheduled. PPP Dial Up: Connection disconnected 666 6.2.0 0 PPP Dial Up INFO as scheduled. 667 5.9.0 SonicPoint SonicPoint INFO SonicPoint Status 74
667 6.0.5 SonicPoint SonicPoint INFO SonicPoint Status 667 6.2.0 SonicPoint SonicPoint INFO SonicPoint Status 668 5.9.0 Maintenance High Availability INFO HA Peer Firewall Rebooted 668 6.0.5 Maintenance High Availability INFO HA Peer Firewall Rebooted 668 6.2.0 Maintenance High Availability INFO HA Peer Firewall Rebooted 669 5.9.0 System Error High Availability ERROR 663 669 6.0.5 System Error High Availability ERROR 663 669 6.2.0 System Error High Availability ERROR 663 670 5.9.0 System Error High Availability ERROR 664 670 6.0.5 System Error High Availability ERROR 664 670 6.2.0 System Error High Availability ERROR 664 671 5.9.0 System Error High Availability ERROR 665 671 6.0.5 System Error High Availability ERROR 665 671 6.2.0 System Error High Availability ERROR 665 672 5.9.0 System Error High Availability ERROR 666 672 6.0.5 System Error High Availability ERROR 666 672 6.2.0 System Error High Availability ERROR 666 674 5.9.0 System Error High Availability INFO 674 6.0.5 System Error High Availability INFO 674 6.2.0 System Error High Availability INFO 675 5.9.0 System Error High Availability ERROR 6234 675 6.0.5 System Error High Availability ERROR 6234 Error Rebooting HA Peer Firewall Error Rebooting HA Peer Firewall Error Rebooting HA Peer Firewall License of HA pair doesn't match: %s License of HA pair doesn't match: %s License of HA pair doesn't match: %s Primary received reboot signal from Secondary Primary received reboot signal from Secondary Primary received reboot signal from Secondary Secondary received reboot signal from Primary Secondary received reboot signal from Primary Secondary received reboot signal from Primary Success to reach Interface %s probe Success to reach Interface %s probe Success to reach Interface %s probe Failure to reach Interface %s probe Failure to reach Interface %s probe SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 75
675 6.2.0 System Error High Availability ERROR 6234 676 5.9.0 Multicast INFO 676 6.0.5 Multicast INFO 676 6.2.0 Multicast INFO 677 5.9.0 Multicast INFO 677 6.0.5 Multicast INFO 677 6.2.0 Multicast INFO 682 5.9.0 Multicast INFO 682 6.0.5 Multicast INFO 682 6.2.0 Multicast INFO 683 5.9.0 Multicast NOTICE 683 6.0.5 Multicast NOTICE 683 6.2.0 Multicast NOTICE 690 5.9.0 Multicast NOTICE 690 6.0.5 Multicast NOTICE 690 6.2.0 Multicast NOTICE 694 5.9.0 Multicast WARNING 694 6.0.5 Multicast WARNING Failure to reach Interface %s probe IGMP V2 client joined multicast Group : %s IGMP V2 client joined multicast Group : %s IGMP V2 client joined multicast Group : %s IGMP V3 client joined multicast Group : %s IGMP V3 client joined multicast Group : %s IGMP V3 client joined multicast Group : %s IGMP Leave group message Received on interface %s IGMP Leave group message Received on interface %s IGMP Leave group message Received on interface %s IGMP packet dropped, wrong checksum received on interface %s IGMP packet dropped, wrong checksum received on interface %s IGMP packet dropped, wrong checksum received on interface %s Multicast UDP packet dropped, no state entry Multicast UDP packet dropped, no state entry Multicast UDP packet dropped, no state entry Multicast UDP packet dropped, RTP stateful failed Multicast UDP packet dropped, RTP stateful failed 76
694 6.2.0 Multicast WARNING 701 5.9.0 Multicast DEBUG 701 6.0.5 Multicast DEBUG 701 6.2.0 Multicast DEBUG 706 5.9.0 Network Monitor ALERT 14005 706 6.0.5 Network Monitor ALERT 14005 706 6.2.0 Network Monitor ALERT 14005 707 5.9.0 Network Monitor ALERT 14006 707 6.0.5 Network Monitor ALERT 14006 707 6.2.0 Network Monitor ALERT 14006 708 5.9.0 Debug Network DEBUG 708 6.0.5 Debug Network DEBUG 708 6.2.0 Debug Network DEBUG 709 5.9.0 Debug Network DEBUG 709 6.0.5 Debug Network DEBUG 709 6.2.0 Debug Network DEBUG 712 5.9.0 Debug Network DEBUG Multicast UDP packet dropped, RTP stateful failed IGMP querier Router detected on interface %s IGMP querier Router detected on interface %s IGMP querier Router detected on interface %s Network Monitor: Host %s is offline Network Monitor: Host %s is offline Network Monitor: Host %s is offline Network Monitor: Host %s is online Network Monitor: Host %s is online Network Monitor: Host %s is online TCP packet received with invalid SEQ number; TCP packet dropped TCP packet received with invalid SEQ number; TCP packet dropped TCP packet received with invalid SEQ number; TCP packet dropped TCP packet received with invalid ACK number; TCP packet dropped TCP packet received with invalid ACK number; TCP packet dropped TCP packet received with invalid ACK number; TCP packet dropped TCP connection reject received; TCP connection dropped SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 77
712 6.0.5 Debug Network DEBUG 712 6.2.0 Debug Network DEBUG 713 5.9.0 Debug Network DEBUG 713 6.0.5 Debug Network DEBUG TCP connection reject received; TCP connection dropped TCP connection reject received; TCP connection dropped TCP connection abort received; TCP connection dropped TCP connection abort received; TCP connection dropped 713 6.2.0 Debug Network DEBUG TCP connection abort received; TCP connection dropped 714 5.9.0 Debug Network Access NOTICE EIGRP packet dropped 714 6.0.5 Debug Network Access NOTICE EIGRP packet dropped 714 6.2.0 Debug Network Access NOTICE EIGRP packet dropped 719 5.9.0 System Error VPN ERROR 719 6.0.5 System Error VPN ERROR VPN policy count received exceeds the limit; %s VPN policy count received exceeds the limit; %s 719 6.2.0 System Error VPN ERROR VPN policy count received exceeds the limit; %s 720 5.9.0 Maintenance PPPoE INFO Sending LCP Echo Request 720 6.0.5 Maintenance PPPoE INFO Sending LCP Echo Request 720 6.2.0 Maintenance PPPoE INFO Sending LCP Echo Request 721 5.9.0 Maintenance PPPoE INFO Received LCP Echo Request 721 6.0.5 Maintenance PPPoE INFO Received LCP Echo Request 721 6.2.0 Maintenance PPPoE INFO Received LCP Echo Request 722 5.9.0 Maintenance PPPoE INFO Sending LCP Echo Reply 722 6.0.5 Maintenance PPPoE INFO Sending LCP Echo Reply 722 6.2.0 Maintenance PPPoE INFO Sending LCP Echo Reply 723 5.9.0 Maintenance PPPoE INFO Received LCP Echo Reply 723 6.0.5 Maintenance PPPoE INFO Received LCP Echo Reply 723 6.2.0 Maintenance PPPoE INFO Received LCP Echo Reply 724 5.9.0 Network 724 6.0.5 Network 724 6.2.0 Network Guest Services drop traffic to deny network Guest Services drop traffic to deny network Guest Services drop traffic to deny network 78
725 5.9.0 Network 725 6.0.5 Network 725 6.2.0 Network 726 5.9.0 Network 726 6.0.5 Network Guest Services pass traffic to access allow network Guest Services pass traffic to access allow network Guest Services pass traffic to access allow network WLAN max concurrent users reached already WLAN max concurrent users reached already 726 6.2.0 Network WLAN max concurrent users reached already 727 5.9.0 SonicPoint SonicPoint INFO SonicPoint Provision 727 6.0.5 SonicPoint SonicPoint INFO SonicPoint Provision 727 6.2.0 SonicPoint SonicPoint INFO SonicPoint Provision 728 5.9.0 Maintenance 728 6.0.5 Maintenance 728 6.2.0 Maintenance 729 5.9.0 Maintenance 729 6.0.5 Maintenance 729 6.2.0 Maintenance 732 5.9.0 732 6.0.5 WLAN disabled by schedule WLAN disabled by schedule WLAN disabled by schedule WLAN enabled by schedule WLAN enabled by schedule WLAN enabled by schedule TCP UDP ICMP Wireless WARNING TCP UDP ICMP Wireless WARNING Packet dropped by WLAN SSL VPN enforcement check Packet dropped by WLAN SSL VPN enforcement check 732 6.2.0 TCP UDP ICMP Wireless WARNING Packet dropped by WLAN SSL VPN enforcement check 733 5.9.0 Maintenance Wireless INFO SSL VPN enforcement 733 6.0.5 Maintenance Wireless INFO SSL VPN enforcement 733 6.2.0 Maintenance Wireless INFO SSL VPN enforcement 734 5.9.0 Firewall Event INFO Source IP address connection status: %s SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 79
734 6.0.5 Firewall Event INFO 734 6.2.0 Firewall Event INFO 735 5.9.0 Firewall Event INFO 735 6.0.5 Firewall Event INFO 735 6.2.0 Firewall Event INFO 737 5.9.0 System Error Firewall Logging WARNING 737 6.0.5 System Error Firewall Logging WARNING 737 6.2.0 System Error Firewall Logging WARNING 738 5.9.0 Maintenance PPPoE INFO 738 6.0.5 Maintenance PPPoE INFO 738 6.2.0 Maintenance PPPoE INFO 744 5.9.0 User Activity RADIUS WARNING 744 6.0.5 User Activity RADIUS WARNING 744 6.2.0 User Activity RADIUS WARNING 745 5.9.0 User Activity RADIUS INFO 745 6.0.5 User Activity RADIUS INFO 745 6.2.0 User Activity RADIUS INFO 746 5.9.0 User Activity RADIUS WARNING 746 6.0.5 User Activity RADIUS WARNING Source IP address connection status: %s Source IP address connection status: %s Destination IP address connection status: %s Destination IP address connection status: %s Destination IP address connection status: %s SMTP authentication problem:%s SMTP authentication problem:%s SMTP authentication problem:%s PPPoE Client: Previous session was connected for %s PPPoE Client: Previous session was connected for %s PPPoE Client: Previous session was connected for %s User login denied RADIUS communication problem User login denied RADIUS communication problem User login denied RADIUS communication problem User login denied LDAP authentication failure User login denied LDAP authentication failure User login denied LDAP authentication failure User login denied LDAP server Timeout User login denied LDAP server Timeout 80
746 6.2.0 User Activity RADIUS WARNING 747 5.9.0 User Activity RADIUS WARNING 747 6.0.5 User Activity RADIUS WARNING 747 6.2.0 User Activity RADIUS WARNING 748 5.9.0 User Activity RADIUS WARNING 748 6.0.5 User Activity RADIUS WARNING 748 6.2.0 User Activity RADIUS WARNING 749 5.9.0 User Activity RADIUS WARNING 749 6.0.5 User Activity RADIUS WARNING 749 6.2.0 User Activity RADIUS WARNING 750 5.9.0 User Activity RADIUS WARNING 750 6.0.5 User Activity RADIUS WARNING 750 6.2.0 User Activity RADIUS WARNING 751 5.9.0 User Activity RADIUS WARNING 751 6.0.5 User Activity RADIUS WARNING 751 6.2.0 User Activity RADIUS WARNING 752 5.9.0 User Activity RADIUS WARNING 752 6.0.5 User Activity RADIUS WARNING 752 6.2.0 User Activity RADIUS WARNING User login denied LDAP server Timeout User login denied LDAP server down or misconfigured User login denied LDAP server down or misconfigured User login denied LDAP server down or misconfigured User login denied LDAP communication problem User login denied LDAP communication problem User login denied LDAP communication problem User login denied invalid credentials on LDAP server User login denied invalid credentials on LDAP server User login denied invalid credentials on LDAP server User login denied insufficient access on LDAP server User login denied insufficient access on LDAP server User login denied insufficient access on LDAP server User login denied LDAP schema mismatch User login denied LDAP schema mismatch User login denied LDAP schema mismatch Allowed LDAP server certificate with wrong host name Allowed LDAP server certificate with wrong host name Allowed LDAP server certificate with wrong host name SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 81
753 5.9.0 User Activity RADIUS WARNING 753 6.0.5 User Activity RADIUS WARNING 753 6.2.0 User Activity RADIUS WARNING 754 5.9.0 User Activity RADIUS WARNING 754 6.0.5 User Activity RADIUS WARNING 754 6.2.0 User Activity RADIUS WARNING 755 5.9.0 User Activity RADIUS WARNING 755 6.0.5 User Activity RADIUS WARNING 755 6.2.0 User Activity RADIUS WARNING 756 5.9.0 User Activity RADIUS WARNING 756 6.0.5 User Activity RADIUS WARNING 756 6.2.0 User Activity RADIUS WARNING 757 5.9.0 User Activity RADIUS WARNING 757 6.0.5 User Activity RADIUS WARNING 757 6.2.0 User Activity RADIUS WARNING 758 5.9.0 User Activity RADIUS WARNING 758 6.0.5 User Activity RADIUS WARNING 758 6.2.0 User Activity RADIUS WARNING 759 5.9.0 User Activity User login denied LDAP server name resolution failed User login denied LDAP server name resolution failed User login denied LDAP server name resolution failed User login denied RADIUS server name resolution failed User login denied RADIUS server name resolution failed User login denied RADIUS server name resolution failed User login denied LDAP server certificate not valid User login denied LDAP server certificate not valid User login denied LDAP server certificate not valid User login denied TLS or local certificate problem User login denied TLS or local certificate problem User login denied TLS or local certificate problem User login denied LDAP directory mismatch User login denied LDAP directory mismatch User login denied LDAP directory mismatch LDAP server does not allow CHAP LDAP server does not allow CHAP LDAP server does not allow CHAP User login denied user already logged in 82
759 6.0.5 User Activity 759 6.2.0 User Activity 760 5.9.0 Network Access NOTICE 760 6.0.5 Network Access NOTICE 760 6.2.0 Network Access NOTICE 761 5.9.0 Maintenance Security Services INFO 761 6.0.5 Maintenance Security Services INFO User login denied user already logged in User login denied user already logged in TCP handshake violation detected; TCP connection dropped TCP handshake violation detected; TCP connection dropped TCP handshake violation detected; TCP connection dropped Access attempt from host out of compliance with GSC Policy Access attempt from host out of compliance with GSC Policy 761 6.2.0 Maintenance Security Services INFO Access attempt from host out of compliance with GSC Policy 762 5.9.0 Maintenance Security Services INFO GSC Policy out of date on host 762 6.0.5 Maintenance Security Services INFO GSC Policy out of date on host 762 6.2.0 Maintenance Security Services INFO GSC Policy out of date on host 763 5.9.0 Maintenance Security Services INFO 8627 763 6.0.5 Maintenance Security Services INFO 8627 763 6.2.0 Maintenance Security Services INFO 8627 766 5.9.0 Maintenance Security Services WARNING 8628 766 6.0.5 Maintenance Security Services WARNING 8628 Access attempt from host without GSC installed Access attempt from host without GSC installed Access attempt from host without GSC installed Failed to synchronize license information with Licensing Server. %s Failed to synchronize license information with Licensing Server. %s 766 6.2.0 Maintenance Security Services WARNING 8628 Failed to synchronize license information with Licensing Server. %s 773 5.9.0 System Error DDNS ERROR DDNS Failure: Provider %s 773 6.0.5 System Error DDNS ERROR DDNS Failure: Provider %s SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 83
773 6.2.0 System Error DDNS ERROR DDNS Failure: Provider %s 774 5.9.0 System Error DDNS ERROR DDNS Failure: Provider %s 774 6.0.5 System Error DDNS ERROR DDNS Failure: Provider %s 774 6.2.0 System Error DDNS ERROR DDNS Failure: Provider %s 776 5.9.0 Maintenance DDNS INFO 776 6.0.5 Maintenance DDNS INFO DDNS Update success for domain %s DDNS Update success for domain %s 776 6.2.0 Maintenance DDNS INFO DDNS Update success for domain %s 777 5.9.0 System Error DDNS WARNING DDNS Warning: Provider %s 777 6.0.5 System Error DDNS WARNING DDNS Warning: Provider %s 777 6.2.0 System Error DDNS WARNING DDNS Warning: Provider %s 778 5.9.0 Maintenance DDNS INFO 778 6.0.5 Maintenance DDNS INFO DDNS association %s taken Offline locally DDNS association %s taken Offline locally 778 6.2.0 Maintenance DDNS INFO DDNS association %s taken Offline locally 779 5.9.0 Maintenance DDNS INFO DDNS association %s added 779 6.0.5 Maintenance DDNS INFO DDNS association %s added 779 6.2.0 Maintenance DDNS INFO DDNS association %s added 780 5.9.0 Maintenance DDNS INFO DDNS association %s enabled 780 6.0.5 Maintenance DDNS INFO DDNS association %s enabled 780 6.2.0 Maintenance DDNS INFO DDNS association %s enabled 781 5.9.0 Maintenance DDNS INFO DDNS association %s disabled 781 6.0.5 Maintenance DDNS INFO DDNS association %s disabled 781 6.2.0 Maintenance DDNS INFO DDNS association %s disabled 782 5.9.0 Maintenance DDNS INFO 782 6.0.5 Maintenance DDNS INFO 782 6.2.0 Maintenance DDNS INFO 783 5.9.0 Maintenance DDNS INFO 783 6.0.5 Maintenance DDNS INFO DDNS Association %s put on line DDNS Association %s put on line DDNS Association %s put on line All DDNS associations have been deleted All DDNS associations have been deleted 84
783 6.2.0 Maintenance DDNS INFO 784 5.9.0 Maintenance DDNS INFO 784 6.0.5 Maintenance DDNS INFO All DDNS associations have been deleted DDNS association %s deactivated DDNS association %s deactivated 784 6.2.0 Maintenance DDNS INFO DDNS association %s deactivated 785 5.9.0 Maintenance DDNS INFO DDNS association %s deleted 785 6.0.5 Maintenance DDNS INFO DDNS association %s deleted 785 6.2.0 Maintenance DDNS INFO DDNS association %s deleted 786 5.9.0 DDNS INFO DDNS association %s updated 786 6.0.5 DDNS INFO DDNS association %s updated 786 6.2.0 DDNS INFO DDNS association %s updated 789 5.9.0 Attack 789 6.0.5 Attack 789 6.2.0 Attack 790 5.9.0 Attack 790 6.0.5 Attack ALERT 6435 IPS Detection Alert: %s ALERT 6435 IPS Detection Alert: %s ALERT 6435 IPS Detection Alert: %s ALERT 6436 IPS Prevention Alert: %s ALERT 6436 IPS Prevention Alert: %s 790 6.2.0 Attack ALERT 6436 IPS Prevention Alert: %s 791 5.9.0 DPI SSL INFO DPI SSL: %s 791 6.0.5 Network Access DPI SSL INFO DPI SSL: %s 791 6.2.0 DPI SSL INFO DPI SSL: %s 793 5.9.0 User Activity 793 6.0.5 User Activity 793 6.2.0 User Activity 794 5.9.0 Attack 794 6.0.5 Attack Application Firewall ALERT 13201 Application Firewall Alert: %s Application Firewall ALERT 13201 Application Firewall Alert: %s Application Firewall ALERT 13201 Application Firewall Alert: %s ALERT 6437 ALERT 6437 Anti Spyware Prevention Alert: %s Anti Spyware Prevention Alert: %s SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 85
794 6.2.0 Attack 795 5.9.0 Attack 795 6.0.5 Attack ALERT 6437 ALERT 6438 ALERT 6438 Anti Spyware Prevention Alert: %s Anti Spyware Detection Alert: %s Anti Spyware Detection Alert: %s 795 6.2.0 Attack ALERT 6438 Anti Spyware Detection Alert: %s 796 5.9.0 Maintenance Security Services WARNING 8631 Anti Spyware Service Expired 796 6.0.5 Maintenance Security Services WARNING 8631 Anti Spyware Service Expired 796 6.2.0 Maintenance Security Services WARNING 8631 Anti Spyware Service Expired 797 5.9.0 RBL NOTICE 797 6.0.5 RBL NOTICE 797 6.2.0 RBL NOTICE 798 5.9.0 RBL NOTICE 798 6.0.5 RBL NOTICE 798 6.2.0 RBL NOTICE 799 5.9.0 RBL NOTICE 799 6.0.5 RBL NOTICE 799 6.2.0 RBL NOTICE 800 5.9.0 RBL ERROR 800 6.0.5 RBL ERROR 800 6.2.0 RBL ERROR Outbound connection to RBLlisted SMTP server dropped Outbound connection to RBLlisted SMTP server dropped Outbound connection to RBLlisted SMTP server dropped Inbound connection from RBLlisted SMTP server dropped Inbound connection from RBLlisted SMTP server dropped Inbound connection from RBLlisted SMTP server dropped SMTP server found on RBL blacklist SMTP server found on RBL blacklist SMTP server found on RBL blacklist No valid DNS server specified for RBL lookups No valid DNS server specified for RBL lookups No valid DNS server specified for RBL lookups 805 5.9.0 GMS INFO Interface statistics report 805 6.0.5 GMS INFO Interface statistics report 805 6.2.0 GMS INFO Interface statistics report 806 5.9.0 GMS INFO SonicPoint statistics report 86
806 6.0.5 GMS INFO SonicPoint statistics report 806 6.2.0 GMS INFO SonicPoint statistics report 809 5.9.0 Attack Security Services ALERT 8632 Gateway Anti Virus Alert: %s 809 6.0.5 Attack Security Services ALERT 8632 Gateway Anti Virus Alert: %s 809 6.2.0 Attack Security Services ALERT 8632 Gateway Anti Virus Alert: %s 810 5.9.0 Maintenance Security Services WARNING 8633 810 6.0.5 Maintenance Security Services WARNING 8633 810 6.2.0 Maintenance Security Services WARNING 8633 811 5.9.0 Maintenance PPP Dial Up INFO 811 6.0.5 Maintenance PPP Dial Up INFO 811 6.2.0 Maintenance PPP Dial Up INFO 815 5.9.0 Network WARNING 815 6.0.5 Network WARNING 815 6.2.0 Network WARNING 817 5.9.0 User Activity 817 6.0.5 User Activity 817 6.2.0 User Activity Gateway Anti Virus Service expired Gateway Anti Virus Service expired Gateway Anti Virus Service expired PPP Dial Up: Invalid DNS IP address returned from Dial Up ISP; overriding using dial up profile settings PPP Dial Up: Invalid DNS IP address returned from Dial Up ISP; overriding using dial up profile settings PPP Dial Up: Invalid DNS IP address returned from Dial Up ISP; overriding using dial up profile settings Too many gratuitous ARPs detected Too many gratuitous ARPs detected Too many gratuitous ARPs detected Incoming call received for Remotely Triggered Dial out session Incoming call received for Remotely Triggered Dial out session Incoming call received for Remotely Triggered Dial out session SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 87
818 5.9.0 User Activity 818 6.0.5 User Activity 818 6.2.0 User Activity 819 5.9.0 User Activity 819 6.0.5 User Activity 819 6.2.0 User Activity 820 5.9.0 User Activity 820 6.0.5 User Activity 820 6.2.0 User Activity 821 5.9.0 User Activity 821 6.0.5 User Activity 821 6.2.0 User Activity 822 5.9.0 User Activity Remotely Triggered Dial out session started. Requesting authentication Remotely Triggered Dial out session started. Requesting authentication Remotely Triggered Dial out session started. Requesting authentication Incorrect authentication received for Remotely Triggered Dial out Incorrect authentication received for Remotely Triggered Dial out Incorrect authentication received for Remotely Triggered Dial out Successful authentication received for Remotely Triggered Dial out Successful authentication received for Remotely Triggered Dial out Successful authentication received for Remotely Triggered Dial out Authentication Timeout during Remotely Triggered Dial out session Authentication Timeout during Remotely Triggered Dial out session Authentication Timeout during Remotely Triggered Dial out session Remotely Triggered Dial out session ended. Valid WAN bound data found. Normal dialup sequence will commence 88
822 6.0.5 User Activity 822 6.2.0 User Activity 823 5.9.0 System Error High Availability ERROR 823 6.0.5 System Error High Availability ERROR 823 6.2.0 System Error High Availability ERROR 824 5.9.0 System Error High Availability ERROR 824 6.0.5 System Error High Availability ERROR Remotely Triggered Dial out session ended. Valid WAN bound data found. Normal dialup sequence will commence Remotely Triggered Dial out session ended. Valid WAN bound data found. Normal dialup sequence will commence Secondary will be shut down in %s minutes Secondary will be shut down in %s minutes Secondary will be shut down in %s minutes Secondary shut down because license is expired Secondary shut down because license is expired 824 6.2.0 System Error High Availability ERROR Secondary shut down because license is expired 825 5.9.0 System Error High Availability INFO Secondary active 825 6.0.5 System Error High Availability INFO Secondary active 825 6.2.0 System Error High Availability INFO Secondary active 826 5.9.0 High Availability ERROR %s 826 6.0.5 High Availability ERROR %s 826 6.2.0 High Availability ERROR %s 828 5.9.0 High Availability INFO %s 828 6.0.5 High Availability INFO %s 828 6.2.0 High Availability INFO %s 829 5.9.0 High Availability ALERT %s 829 6.0.5 High Availability ALERT %s 829 6.2.0 High Availability ALERT %s 830 5.9.0 High Availability NOTICE %s 830 6.0.5 High Availability NOTICE %s 830 6.2.0 High Availability NOTICE %s 832 5.9.0 DHCP Server INFO DHCP Scopes altered automatically due to change in network settings for interface %s SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 89
832 6.0.5 DHCP Server INFO 832 6.2.0 DHCP Server INFO 833 5.9.0 System Error DHCP Server WARNING 833 6.0.5 System Error DHCP Server WARNING 833 6.2.0 System Error DHCP Server WARNING 834 5.9.0 System Error DHCP Server WARNING 834 6.0.5 System Error DHCP Server WARNING DHCP Scopes altered automatically due to change in network settings for interface %s DHCP Scopes altered automatically due to change in network settings for interface %s DHCP lease file in the storage is corrupted; read failed DHCP lease file in the storage is corrupted; read failed DHCP lease file in the storage is corrupted; read failed Failed to write DHCP leases to storage Failed to write DHCP leases to storage 834 6.2.0 System Error DHCP Server WARNING Failed to write DHCP leases to storage 835 5.9.0 Maintenance DHCP Server INFO DHCP leases written to storage 835 6.0.5 Maintenance DHCP Server INFO DHCP leases written to storage 835 6.2.0 Maintenance DHCP Server INFO DHCP leases written to storage 840 5.9.0 ARS INFO %s 840 6.0.5 ARS INFO %s 840 6.2.0 ARS INFO %s 841 5.9.0 ARS NOTICE %s 841 6.0.5 DHCP Server NOTICE %s 841 6.2.0 DHCP Server NOTICE %s 842 5.9.0 ARS DEBUG %s 842 6.0.5 ARS DEBUG %s 842 6.2.0 ARS DEBUG %s 847 5.9.0 Maintenance Network WARNING 847 6.0.5 Maintenance Network WARNING IP address conflict detected from Ethernet address %s IP address conflict detected from Ethernet address %s 847 6.2.0 Maintenance Network WARNING IP address conflict detected from Ethernet address %s 848 5.9.0 User Activity VPN PKI INFO OCSP sending request. 848 6.0.5 User Activity VPN PKI INFO OCSP sending request. 90
848 6.2.0 User Activity VPN PKI INFO OCSP sending request. 849 5.9.0 User Activity VPN PKI ERROR 849 6.0.5 User Activity VPN PKI ERROR OCSP send request message failed. OCSP send request message failed. 849 6.2.0 User Activity VPN PKI ERROR OCSP send request message failed. 850 5.9.0 User Activity VPN PKI INFO OCSP received response. 850 6.0.5 User Activity VPN PKI INFO OCSP received response. 850 6.2.0 User Activity VPN PKI INFO OCSP received response. 852 5.9.0 User Activity VPN PKI INFO OCSP Resolved Domain Name. 852 6.0.5 User Activity VPN PKI INFO OCSP Resolved Domain Name. 852 6.2.0 User Activity VPN PKI INFO OCSP Resolved Domain Name. 853 5.9.0 User Activity VPN PKI ERROR 853 6.0.5 User Activity VPN PKI ERROR 853 6.2.0 User Activity VPN PKI ERROR 854 5.9.0 User Activity VPN PKI ERROR 854 6.0.5 User Activity VPN PKI ERROR 854 6.2.0 User Activity VPN PKI ERROR 856 5.9.0 Attack 856 6.0.5 Debug 856 6.2.0 Attack 857 5.9.0 Attack WARNING WARNING WARNING WARNING OCSP Failed to Resolve Domain Name. OCSP Failed to Resolve Domain Name. OCSP Failed to Resolve Domain Name. OCSP Internal error handling received response. OCSP Internal error handling received response. OCSP Internal error handling received response. SYN Flood Mode changed by user to: Watch and report possible SYN floods SYN Flood Mode changed by user to: Watch and report possible SYN floods SYN Flood Mode changed by user to: Watch and report possible SYN floods SYN Flood Mode changed by user to: Watch and proxy WAN connections when under attack SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 91
857 6.0.5 Debug 857 6.2.0 Attack 858 5.9.0 Attack 858 6.0.5 Debug 858 6.2.0 Attack 859 5.9.0 Attack 859 6.0.5 Debug 859 6.2.0 Attack 860 5.9.0 Attack 860 6.0.5 Debug 860 6.2.0 Attack 861 5.9.0 Attack 861 6.0.5 Debug 861 6.2.0 Attack WARNING WARNING WARNING WARNING WARNING ALERT ALERT ALERT SYN Flood Mode changed by user to: Watch and proxy WAN connections when under attack SYN Flood Mode changed by user to: Watch and proxy WAN connections when under attack SYN Flood Mode changed by user to: Always proxy WAN connections SYN Flood Mode changed by user to: Always proxy WAN connections SYN Flood Mode changed by user to: Always proxy WAN connections Possible SYN flood detected on WAN IF %s switching to connection proxy mode Possible SYN flood detected on WAN IF %s switching to connection proxy mode Possible SYN flood detected on WAN IF %s switching to connection proxy mode ALERT Possible SYN Flood on IF %s ALERT Possible SYN Flood on IF %s ALERT Possible SYN Flood on IF %s ALERT ALERT ALERT SYN flood ceased or flooding machines blacklisted connection proxy disabled SYN flood ceased or flooding machines blacklisted connection proxy disabled SYN flood ceased or flooding machines blacklisted connection proxy disabled 92
862 5.9.0 Attack 862 6.0.5 Debug 862 6.2.0 Attack 863 5.9.0 Attack 863 6.0.5 Debug 863 6.2.0 Attack 864 5.9.0 Attack 864 6.0.5 Debug 864 6.2.0 Attack 865 5.9.0 Attack 865 6.0.5 Debug 865 6.2.0 Attack 866 5.9.0 Attack 866 6.0.5 Debug 866 6.2.0 Attack 867 5.9.0 Attack 867 6.0.5 Debug 867 6.2.0 Attack 868 5.9.0 Attack WARNING WARNING WARNING WARNING WARNING WARNING ALERT ALERT ALERT ALERT ALERT ALERT WARNING WARNING WARNING ALERT ALERT ALERT WARNING SYN Flood blacklisting enabled by user SYN Flood blacklisting enabled by user SYN Flood blacklisting enabled by user SYN Flood blacklisting disabled by user SYN Flood blacklisting disabled by user SYN Flood blacklisting disabled by user SYN Flooding machine %s blacklisted SYN Flooding machine %s blacklisted SYN Flooding machine %s blacklisted Machine %s removed from SYN flood blacklist Machine %s removed from SYN flood blacklist Machine %s removed from SYN flood blacklist Possible SYN Flood on IF %s continues Possible SYN Flood on IF %s continues Possible SYN Flood on IF %s continues Possible SYN Flood on IF %s has ceased Possible SYN Flood on IF %s has ceased Possible SYN Flood on IF %s has ceased SYN Flood Blacklist on IF %s continues SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 93
868 6.0.5 Debug 868 6.2.0 Attack 869 5.9.0 Attack 869 6.0.5 Debug WARNING WARNING SYN Flood Blacklist on IF %s continues SYN Flood Blacklist on IF %s continues DEBUG TCP SYN received DEBUG TCP SYN received 869 6.2.0 Attack DEBUG TCP SYN received 872 5.9.0 User Activity Security Services NOTICE %s 872 6.0.5 User Activity Security Services NOTICE %s 872 6.2.0 User Activity Security Services NOTICE %s 874 5.9.0 User Activity VPN PKI ALERT CRL has expired 874 6.0.5 User Activity VPN PKI ALERT CRL has expired 874 6.2.0 User Activity VPN PKI ALERT CRL has expired 875 5.9.0 User Activity VPN PKI ALERT Failed to find certificate 875 6.0.5 User Activity VPN PKI ALERT Failed to find certificate 875 6.2.0 User Activity VPN PKI ALERT Failed to find certificate 876 5.9.0 User Activity VPN PKI ALERT 876 6.0.5 User Activity VPN PKI ALERT 876 6.2.0 User Activity VPN PKI ALERT 877 5.9.0 User Activity VPN PKI ALERT 877 6.0.5 User Activity VPN PKI ALERT CRL missing Issuer requires CRL checking. CRL missing Issuer requires CRL checking. CRL missing Issuer requires CRL checking. CRL validation failure for Root Certificate CRL validation failure for Root Certificate 877 6.2.0 User Activity VPN PKI ALERT CRL validation failure for Root Certificate 878 5.9.0 User Activity VPN PKI ALERT Cannot Validate Issuer Path 878 6.0.5 User Activity VPN PKI ALERT Cannot Validate Issuer Path 878 6.2.0 User Activity VPN PKI ALERT Cannot Validate Issuer Path 879 5.9.0 RF Management WARNING 879 6.0.5 RF Management WARNING WLAN radio frequency threat detected WLAN radio frequency threat detected 94
879 6.2.0 RF Management WARNING 880 5.9.0 Maintenance 880 6.0.5 Maintenance Dynamic Address Objects INFO Dynamic Address Objects INFO WLAN radio frequency threat detected Unable to resolve dynamic address object Unable to resolve dynamic address object 880 6.2.0 Maintenance Dynamic Address Objects INFO Unable to resolve dynamic address object 881 5.9.0 Firewall Logging NOTICE System clock manually updated 881 6.0.5 Firewall Logging NOTICE System clock manually updated 881 6.2.0 Firewall Logging NOTICE System clock manually updated 882 5.9.0 TCP Network Access DEBUG 882 6.0.5 TCP Network Access DEBUG 882 6.2.0 TCP Network Access DEBUG 883 5.9.0 TCP UDP Network Access NOTICE 883 6.0.5 TCP UDP Network Access NOTICE 883 6.2.0 TCP UDP Network Access NOTICE 884 5.9.0 TCP Network Access NOTICE 884 6.0.5 TCP Network Access NOTICE 884 6.2.0 TCP Network Access NOTICE 885 5.9.0 UDP Network Access NOTICE 885 6.0.5 UDP Network Access NOTICE 885 6.2.0 UDP Network Access NOTICE 886 5.9.0 UDP Network Access NOTICE 886 6.0.5 UDP Network Access NOTICE HTTP method detected; examining stream for host header HTTP method detected; examining stream for host header HTTP method detected; examining stream for host header IP Header checksum error; packet dropped IP Header checksum error; packet dropped IP Header checksum error; packet dropped TCP checksum error; packet dropped TCP checksum error; packet dropped TCP checksum error; packet dropped UDP checksum error; packet dropped UDP checksum error; packet dropped UDP checksum error; packet dropped ICMP checksum error; packet dropped ICMP checksum error; packet dropped SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 95
886 6.2.0 UDP Network Access NOTICE 887 5.9.0 Debug Network DEBUG 887 6.0.5 Debug Network DEBUG 887 6.2.0 Debug Network DEBUG 888 5.9.0 Debug Network DEBUG 888 6.0.5 Debug Network DEBUG 888 6.2.0 Debug Network DEBUG 889 5.9.0 Debug Network DEBUG 889 6.0.5 Debug Network DEBUG 889 6.2.0 Debug Network DEBUG 890 5.9.0 Debug Network DEBUG 890 6.0.5 Debug Network DEBUG 890 6.2.0 Debug Network DEBUG ICMP checksum error; packet dropped TCP packet received with invalid header length; TCP packet dropped TCP packet received with invalid header length; TCP packet dropped TCP packet received with invalid header length; TCP packet dropped TCP packet received on nonexistent/closed connection; TCP packet dropped TCP packet received on nonexistent/closed connection; TCP packet dropped TCP packet received on nonexistent/closed connection; TCP packet dropped TCP packet received without mandatory SYN flag; TCP packet dropped TCP packet received without mandatory SYN flag; TCP packet dropped TCP packet received without mandatory SYN flag; TCP packet dropped TCP packet received without mandatory ACK flag; TCP packet dropped TCP packet received without mandatory ACK flag; TCP packet dropped TCP packet received without mandatory ACK flag; TCP packet dropped 96
891 5.9.0 Debug Network DEBUG 891 6.0.5 Debug Network DEBUG 891 6.2.0 Debug Network DEBUG 892 5.9.0 Debug Network INFO 892 6.0.5 Debug Network INFO 892 6.2.0 Debug Network INFO 893 5.9.0 Debug Network DEBUG 893 6.0.5 Debug Network DEBUG 893 6.2.0 Debug Network DEBUG 894 5.9.0 Debug Network DEBUG 894 6.0.5 Debug Network DEBUG 894 6.2.0 Debug Network DEBUG 895 5.9.0 Debug Network DEBUG TCP packet received on a closing connection; TCP packet dropped TCP packet received on a closing connection; TCP packet dropped TCP packet received on a closing connection; TCP packet dropped TCP packet received with SYN flag on an existing connection; TCP packet dropped TCP packet received with SYN flag on an existing connection; TCP packet dropped TCP packet received with SYN flag on an existing connection; TCP packet dropped TCP packet received with invalid SACK option length; TCP packet dropped TCP packet received with invalid SACK option length; TCP packet dropped TCP packet received with invalid SACK option length; TCP packet dropped TCP packet received with invalid MSS option length; TCP packet dropped TCP packet received with invalid MSS option length; TCP packet dropped TCP packet received with invalid MSS option length; TCP packet dropped TCP packet received with invalid option length; TCP packet dropped SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 97
895 6.0.5 Debug Network DEBUG 895 6.2.0 Debug Network DEBUG 896 5.9.0 Debug Network DEBUG 896 6.0.5 Debug Network DEBUG 896 6.2.0 Debug Network DEBUG 897 5.9.0 Attack Network INFO 897 6.0.5 Debug Network INFO 897 6.2.0 Attack Network INFO 898 5.9.0 Attack 898 6.0.5 Debug 898 6.2.0 Attack 899 5.9.0 Attack 899 6.0.5 Debug 899 6.2.0 Attack 900 5.9.0 Attack 900 6.0.5 Debug ALERT ALERT ALERT WARNING WARNING WARNING ALERT ALERT TCP packet received with invalid option length; TCP packet dropped TCP packet received with invalid option length; TCP packet dropped TCP packet received with invalid source port; TCP packet dropped TCP packet received with invalid source port; TCP packet dropped TCP packet received with invalid source port; TCP packet dropped TCP packet received with invalid SYN Flood cookie; TCP packet dropped TCP packet received with invalid SYN Flood cookie; TCP packet dropped TCP packet received with invalid SYN Flood cookie; TCP packet dropped RST Flooding machine %s blacklisted RST Flooding machine %s blacklisted RST Flooding machine %s blacklisted RST Flood Blacklist on IF %s continues RST Flood Blacklist on IF %s continues RST Flood Blacklist on IF %s continues Machine %s removed from RST flood blacklist Machine %s removed from RST flood blacklist 98
900 6.2.0 Attack 901 5.9.0 Attack 901 6.0.5 Debug 901 6.2.0 Attack 902 5.9.0 Attack 902 6.0.5 Debug 902 6.2.0 Attack 903 5.9.0 Attack 903 6.0.5 Debug 903 6.2.0 Attack 904 5.9.0 Attack 904 6.0.5 Debug 904 6.2.0 Attack 905 5.9.0 Attack 905 6.0.5 Debug 905 6.2.0 Attack 906 5.9.0 Attack 906 6.0.5 Debug 906 6.2.0 Attack ALERT ALERT ALERT ALERT WARNING WARNING WARNING ALERT ALERT ALERT Machine %s removed from RST flood blacklist FIN Flooding machine %s blacklisted FIN Flooding machine %s blacklisted FIN Flooding machine %s blacklisted FIN Flood Blacklist on IF %s continues FIN Flood Blacklist on IF %s continues FIN Flood Blacklist on IF %s continues Machine %s removed from FIN flood blacklist Machine %s removed from FIN flood blacklist Machine %s removed from FIN flood blacklist ALERT Possible RST Flood on IF %s ALERT Possible RST Flood on IF %s ALERT Possible RST Flood on IF %s ALERT Possible FIN Flood on IF %s ALERT Possible FIN Flood on IF %s ALERT Possible FIN Flood on IF %s ALERT ALERT ALERT Possible RST Flood on IF %s has ceased Possible RST Flood on IF %s has ceased Possible RST Flood on IF %s has ceased SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 99
907 5.9.0 Attack 907 6.0.5 Debug 907 6.2.0 Attack 908 5.9.0 Attack 908 6.0.5 Debug 908 6.2.0 Attack 909 5.9.0 Attack 909 6.0.5 Debug ALERT ALERT ALERT WARNING WARNING WARNING WARNING WARNING Possible FIN Flood on IF %s has ceased Possible FIN Flood on IF %s has ceased Possible FIN Flood on IF %s has ceased Possible RST Flood on IF %s continues Possible RST Flood on IF %s continues Possible RST Flood on IF %s continues Possible FIN Flood on IF %s continues Possible FIN Flood on IF %s continues 909 6.2.0 Attack WARNING Possible FIN Flood on IF %s continues 910 5.9.0 Debug Network WARNING Packet Dropped IP TTL expired 910 6.0.5 Debug Network WARNING Packet Dropped IP TTL expired 910 6.2.0 Debug Network WARNING Packet Dropped IP TTL expired 911 5.9.0 Maintenance 911 6.0.5 Maintenance 911 6.2.0 Maintenance 912 5.9.0 Maintenance 912 6.0.5 Maintenance 912 6.2.0 Maintenance Dynamic Address Objects INFO Dynamic Address Objects INFO Dynamic Address Objects INFO Dynamic Address Objects INFO Dynamic Address Objects INFO Dynamic Address Objects INFO 913 5.9.0 User Activity VPN IKE WARNING 913 6.0.5 User Activity VPN IKE WARNING Added host entry to dynamic address object Added host entry to dynamic address object Added host entry to dynamic address object Removed host entry from dynamic address object Removed host entry from dynamic address object Removed host entry from dynamic address object IKE Responder: Phase 1 Authentication Method does not match IKE Responder: Phase 1 Authentication Method does not match 100
913 6.2.0 User Activity VPN IKE WARNING 914 5.9.0 User Activity VPN IKE WARNING 914 6.0.5 User Activity VPN IKE WARNING 914 6.2.0 User Activity VPN IKE WARNING 915 5.9.0 User Activity VPN IKE WARNING 915 6.0.5 User Activity VPN IKE WARNING 915 6.2.0 User Activity VPN IKE WARNING 916 5.9.0 User Activity VPN IKE WARNING 916 6.0.5 User Activity VPN IKE WARNING 916 6.2.0 User Activity VPN IKE WARNING 917 5.9.0 User Activity VPN IKE WARNING 917 6.0.5 User Activity VPN IKE WARNING 917 6.2.0 User Activity VPN IKE WARNING 918 5.9.0 User Activity VPN IKE WARNING 918 6.0.5 User Activity VPN IKE WARNING IKE Responder: Phase 1 Authentication Method does not match IKE Responder: Phase 1 encryption algorithm does not match IKE Responder: Phase 1 encryption algorithm does not match IKE Responder: Phase 1 encryption algorithm does not match IKE Responder: Phase 1 encryption algorithm keylength does not match IKE Responder: Phase 1 encryption algorithm keylength does not match IKE Responder: Phase 1 encryption algorithm keylength does not match IKE Responder: Phase 1 hash algorithm does not match IKE Responder: Phase 1 hash algorithm does not match IKE Responder: Phase 1 hash algorithm does not match IKE Responder: Phase 1 XAUTH required but Policy has no user name IKE Responder: Phase 1 XAUTH required but Policy has no user name IKE Responder: Phase 1 XAUTH required but Policy has no user name IKE Responder: Phase 1 XAUTH required but Policy has no user password IKE Responder: Phase 1 XAUTH required but Policy has no user password SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 101
918 6.2.0 User Activity VPN IKE WARNING 919 5.9.0 User Activity VPN IKE WARNING 919 6.0.5 User Activity VPN IKE WARNING 919 6.2.0 User Activity VPN IKE WARNING 920 5.9.0 User Activity VPN IKE WARNING 920 6.0.5 User Activity VPN IKE WARNING 920 6.2.0 User Activity VPN IKE WARNING 921 5.9.0 User Activity VPN IKE WARNING 921 6.0.5 User Activity VPN IKE WARNING 921 6.2.0 User Activity VPN IKE WARNING 922 5.9.0 User Activity VPN IKE WARNING 922 6.0.5 User Activity VPN IKE WARNING 922 6.2.0 User Activity VPN IKE WARNING 923 5.9.0 User Activity VPN IKE WARNING 923 6.0.5 User Activity VPN IKE WARNING 923 6.2.0 User Activity VPN IKE WARNING 924 5.9.0 User Activity VPN IKE WARNING 924 6.0.5 User Activity VPN IKE WARNING 924 6.2.0 User Activity VPN IKE WARNING IKE Responder: Phase 1 XAUTH required but Policy has no user password IKE Responder: Phase 1 DH Group does not match IKE Responder: Phase 1 DH Group does not match IKE Responder: Phase 1 DH Group does not match IKE Responder: AH authentication algorithm does not match IKE Responder: AH authentication algorithm does not match IKE Responder: AH authentication algorithm does not match IKE Responder: ESP encryption algorithm does not match IKE Responder: ESP encryption algorithm does not match IKE Responder: ESP encryption algorithm does not match IKE Responder: ESP authentication algorithm does not match IKE Responder: ESP authentication algorithm does not match IKE Responder: ESP authentication algorithm does not match IKE Responder: AH authentication key length does not match IKE Responder: AH authentication key length does not match IKE Responder: AH authentication key length does not match IKE Responder: ESP encryption key length does not match IKE Responder: ESP encryption key length does not match IKE Responder: ESP encryption key length does not match 102
925 5.9.0 User Activity VPN IKE WARNING 925 6.0.5 User Activity VPN IKE WARNING 925 6.2.0 User Activity VPN IKE WARNING 926 5.9.0 User Activity VPN IKE WARNING 926 6.0.5 User Activity VPN IKE WARNING 926 6.2.0 User Activity VPN IKE WARNING 927 5.9.0 User Activity VPN IKE WARNING 927 6.0.5 User Activity VPN IKE WARNING 927 6.2.0 User Activity VPN IKE WARNING 928 5.9.0 User Activity VPN IKE WARNING 928 6.0.5 User Activity VPN IKE WARNING 928 6.2.0 User Activity VPN IKE WARNING 930 5.9.0 User Activity VPN IKE INFO 930 6.0.5 User Activity VPN IKE INFO 930 6.2.0 User Activity VPN IKE INFO 931 5.9.0 User Activity VPN IKE INFO 931 6.0.5 User Activity VPN IKE INFO IKE Responder: ESP authentication key length does not match IKE Responder: ESP authentication key length does not match IKE Responder: ESP authentication key length does not match IKE Responder: AH authentication key rounds does not match IKE Responder: AH authentication key rounds does not match IKE Responder: AH authentication key rounds does not match IKE Responder: ESP encryption key rounds does not match IKE Responder: ESP encryption key rounds does not match IKE Responder: ESP encryption key rounds does not match IKE Responder: ESP authentication key rounds does not match IKE Responder: ESP authentication key rounds does not match IKE Responder: ESP authentication key rounds does not match IKE Initiator: Remote party Timeout Retransmitting IKE Request. IKE Initiator: Remote party Timeout Retransmitting IKE Request. IKE Initiator: Remote party Timeout Retransmitting IKE Request. IKE Responder: Remote party Timeout Retransmitting IKE Request. IKE Responder: Remote party Timeout Retransmitting IKE Request. SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 103
931 6.2.0 User Activity VPN IKE INFO 932 5.9.0 User Activity VPN IKE WARNING 932 6.0.5 User Activity VPN IKE WARNING 932 6.2.0 User Activity VPN IKE WARNING 933 5.9.0 User Activity VPN IKE WARNING 933 6.0.5 User Activity VPN IKE WARNING 933 6.2.0 User Activity VPN IKE WARNING 934 5.9.0 User Activity VPN IKE WARNING 934 6.0.5 User Activity VPN IKE WARNING 934 6.2.0 User Activity VPN IKE WARNING 935 5.9.0 User Activity VPN IKE WARNING 935 6.0.5 User Activity VPN IKE WARNING 935 6.2.0 User Activity VPN IKE WARNING 936 5.9.0 User Activity VPN IKE WARNING 936 6.0.5 User Activity VPN IKE WARNING 936 6.2.0 User Activity VPN IKE WARNING IKE Responder: Remote party Timeout Retransmitting IKE Request. IKE Responder: IPsec protocol mismatch IKE Responder: IPsec protocol mismatch IKE Responder: IPsec protocol mismatch IKE Initiator: Proposed IKE ID mismatch IKE Initiator: Proposed IKE ID mismatch IKE Initiator: Proposed IKE ID mismatch IKE Responder: Peer's local network does not match VPN Policy's [Destination ] IKE Responder: Peer's local network does not match VPN Policy's [Destination ] IKE Responder: Peer's local network does not match VPN Policy's [Destination ] IKE Responder: Peer's destination network does not match VPN Policy's [Local Network] IKE Responder: Peer's destination network does not match VPN Policy's [Local Network] IKE Responder: Peer's destination network does not match VPN Policy's [Local Network] IKE Responder: Route table overrides VPN Policy IKE Responder: Route table overrides VPN Policy IKE Responder: Route table overrides VPN Policy 104
937 5.9.0 User Activity VPN IKE WARNING 937 6.0.5 User Activity VPN IKE WARNING 937 6.2.0 User Activity VPN IKE WARNING 938 5.9.0 User Activity VPN IKE INFO 938 6.0.5 User Activity VPN IKE INFO 938 6.2.0 User Activity VPN IKE INFO 939 5.9.0 User Activity VPN IKE INFO 939 6.0.5 User Activity VPN IKE INFO 939 6.2.0 User Activity VPN IKE INFO 940 5.9.0 User Activity VPN IKE INFO 940 6.0.5 User Activity VPN IKE INFO 940 6.2.0 User Activity VPN IKE INFO 941 5.9.0 User Activity VPN IKE INFO 941 6.0.5 User Activity VPN IKE INFO IKE Initiator: IKE proposal does not match (Phase 1) IKE Initiator: IKE proposal does not match (Phase 1) IKE Initiator: IKE proposal does not match (Phase 1) IKEv2 Initiator: Send IKE_SA_INIT Request IKEv2 Initiator: Send IKE_SA_INIT Request IKEv2 Initiator: Send IKE_SA_INIT Request IKEv2 Responder: Received IKE_SA_INIT Request IKEv2 Responder: Received IKE_SA_INIT Request IKEv2 Responder: Received IKE_SA_INIT Request IKEv2 Initiator: Send IKE_AUTH Request IKEv2 Initiator: Send IKE_AUTH Request IKEv2 Initiator: Send IKE_AUTH Request IKEv2 Responder: Received IKE_AUTH Request IKEv2 Responder: Received IKE_AUTH Request 941 6.2.0 User Activity VPN IKE INFO IKEv2 Responder: Received IKE_AUTH Request 942 5.9.0 User Activity VPN IKE INFO IKEv2 Authentication successful 942 6.0.5 User Activity VPN IKE INFO IKEv2 Authentication successful 942 6.2.0 User Activity VPN IKE INFO IKEv2 Authentication successful 943 5.9.0 User Activity VPN IKE INFO IKEv2 Accept IKE SA Proposal 943 6.0.5 User Activity VPN IKE INFO IKEv2 Accept IKE SA Proposal 943 6.2.0 User Activity VPN IKE INFO IKEv2 Accept IKE SA Proposal 944 5.9.0 User Activity VPN IKE INFO IKEv2 Accept IPsec SA Proposal 944 6.0.5 User Activity VPN IKE INFO IKEv2 Accept IPsec SA Proposal 944 6.2.0 User Activity VPN IKE INFO IKEv2 Accept IPsec SA Proposal SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 105
945 5.9.0 User Activity VPN IKE INFO 945 6.0.5 User Activity VPN IKE INFO 945 6.2.0 User Activity VPN IKE INFO 946 5.9.0 User Activity VPN IKE INFO 946 6.0.5 User Activity VPN IKE INFO 946 6.2.0 User Activity VPN IKE INFO 947 5.9.0 User Activity VPN IKE INFO 947 6.0.5 User Activity VPN IKE INFO 947 6.2.0 User Activity VPN IKE INFO 948 5.9.0 User Activity VPN IKE INFO 948 6.0.5 User Activity VPN IKE INFO 948 6.2.0 User Activity VPN IKE INFO 949 5.9.0 User Activity VPN IKE INFO 949 6.0.5 User Activity VPN IKE INFO 949 6.2.0 User Activity VPN IKE INFO 950 5.9.0 User Activity VPN IKE INFO 950 6.0.5 User Activity VPN IKE INFO 950 6.2.0 User Activity VPN IKE INFO 951 5.9.0 User Activity VPN IKE INFO IKEv2 Initiator: Send CREATE_CHILD_SA Request IKEv2 Initiator: Send CREATE_CHILD_SA Request IKEv2 Initiator: Send CREATE_CHILD_SA Request IKEv2 Responder: Received CREATE_CHILD_SA Request IKEv2 Responder: Received CREATE_CHILD_SA Request IKEv2 Responder: Received CREATE_CHILD_SA Request IKEv2 Send delete IKE SA Request IKEv2 Send delete IKE SA Request IKEv2 Send delete IKE SA Request IKEv2 Received delete IKE SA Request IKEv2 Received delete IKE SA Request IKEv2 Received delete IKE SA Request IKEv2 Send delete IPsec SA Request IKEv2 Send delete IPsec SA Request IKEv2 Send delete IPsec SA Request IKEv2 Received delete IPsec SA Request IKEv2 Received delete IPsec SA Request IKEv2 Received delete IPsec SA Request IKEv2 Responder: Peer's destination network does not match VPN Policy's [Local Network] 106
951 6.0.5 User Activity VPN IKE INFO 951 6.2.0 User Activity VPN IKE INFO 952 5.9.0 User Activity VPN IKE INFO 952 6.0.5 User Activity VPN IKE INFO IKEv2 Responder: Peer's destination network does not match VPN Policy's [Local Network] IKEv2 Responder: Peer's destination network does not match VPN Policy's [Local Network] IKEv2 Responder: Peer's local network does not match VPN Policy's [Destination Network] IKEv2 Responder: Peer's local network does not match VPN Policy's [Destination Network] 952 6.2.0 User Activity VPN IKE INFO IKEv2 Responder: Peer's local network does not match VPN Policy's [Destination Network] 953 5.9.0 User Activity VPN IKE WARNING IKEv2 Payload processing error 953 6.0.5 User Activity VPN IKE WARNING IKEv2 Payload processing error 953 6.2.0 User Activity VPN IKE WARNING IKEv2 Payload processing error 954 5.9.0 User Activity VPN IKE WARNING 954 6.0.5 User Activity VPN IKE WARNING 954 6.2.0 User Activity VPN IKE WARNING 955 5.9.0 User Activity VPN IKE WARNING 955 6.0.5 User Activity VPN IKE WARNING 955 6.2.0 User Activity VPN IKE WARNING 956 5.9.0 User Activity VPN IKE WARNING 956 6.0.5 User Activity VPN IKE WARNING 956 6.2.0 User Activity VPN IKE WARNING IKEv2 Initiator: Negotiations failed. Extra payloads present. IKEv2 Initiator: Negotiations failed. Extra payloads present. IKEv2 Initiator: Negotiations failed. Extra payloads present. IKEv2 Initiator: Negotiations failed. Missing required payloads. IKEv2 Initiator: Negotiations failed. Missing required payloads. IKEv2 Initiator: Negotiations failed. Missing required payloads. IKEv2 Initiator: Negotiations failed. Invalid input state. IKEv2 Initiator: Negotiations failed. Invalid input state. IKEv2 Initiator: Negotiations failed. Invalid input state. SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 107
957 5.9.0 User Activity VPN IKE WARNING 957 6.0.5 User Activity VPN IKE WARNING IKEv2 Initiator: Negotiations failed. Invalid output state. IKEv2 Initiator: Negotiations failed. Invalid output state. 957 6.2.0 User Activity VPN IKE WARNING IKEv2 Initiator: Negotiations failed. Invalid output state. 958 5.9.0 User Activity VPN IKE WARNING IKEv2 Payload validation failed. 958 6.0.5 User Activity VPN IKE WARNING IKEv2 Payload validation failed. 958 6.2.0 User Activity VPN IKE WARNING IKEv2 Payload validation failed. 959 5.9.0 User Activity VPN IKE WARNING IKEv2 Unable to find IKE SA 959 6.0.5 User Activity VPN IKE WARNING IKEv2 Unable to find IKE SA 959 6.2.0 User Activity VPN IKE WARNING IKEv2 Unable to find IKE SA 960 5.9.0 User Activity VPN IKE WARNING IKEv2 Decrypt packet failed 960 6.0.5 User Activity VPN IKE WARNING IKEv2 Decrypt packet failed 960 6.2.0 User Activity VPN IKE WARNING IKEv2 Decrypt packet failed 961 5.9.0 User Activity VPN IKE WARNING IKEv2 Out of memory 961 6.0.5 User Activity VPN IKE WARNING IKEv2 Out of memory 961 6.2.0 User Activity VPN IKE WARNING IKEv2 Out of memory 962 5.9.0 User Activity VPN IKE ERROR 962 6.0.5 User Activity VPN IKE ERROR 962 6.2.0 User Activity VPN IKE ERROR 963 5.9.0 User Activity VPN IKE WARNING 963 6.0.5 User Activity VPN IKE WARNING IKEv2 Responder: Policy for remote IKE ID not found IKEv2 Responder: Policy for remote IKE ID not found IKEv2 Responder: Policy for remote IKE ID not found IKEv2 Process Message queue failed IKEv2 Process Message queue failed 963 6.2.0 User Activity VPN IKE WARNING IKEv2 Process Message queue failed 964 5.9.0 User Activity VPN IKE WARNING IKEv2 Invalid state 964 6.0.5 User Activity VPN IKE WARNING IKEv2 Invalid state 964 6.2.0 User Activity VPN IKE WARNING IKEv2 Invalid state 965 5.9.0 System Error VPN IKE ERROR IKE Responder: Client Policy has no VPN Access Networks assigned. Check Configuration. 108
965 6.0.5 System Error VPN IKE ERROR IKE Responder: Client Policy has no VPN Access Networks assigned. Check Configuration. 965 6.2.0 System Error VPN IKE ERROR IKE Responder: Client Policy has no VPN Access Networks assigned. Check Configuration. 966 5.9.0 User Activity VPN IKE WARNING IKEv2 Invalid SPI size 966 6.0.5 User Activity VPN IKE WARNING IKEv2 Invalid SPI size 966 6.2.0 User Activity VPN IKE WARNING IKEv2 Invalid SPI size 967 5.9.0 User Activity VPN IKE WARNING IKEv2 VPN Policy not found 967 6.0.5 User Activity VPN IKE WARNING IKEv2 VPN Policy not found 967 6.2.0 User Activity VPN IKE WARNING IKEv2 VPN Policy not found 968 5.9.0 User Activity VPN IKE WARNING 968 6.0.5 User Activity VPN IKE WARNING IKEv2 IPsec proposal does not match IKEv2 IPsec proposal does not match 968 6.2.0 User Activity VPN IKE WARNING IKEv2 IPsec proposal does not match 969 5.9.0 User Activity VPN IKE WARNING IKEv2 IPsec attribute not found 969 6.0.5 User Activity VPN IKE WARNING IKEv2 IPsec attribute not found 969 6.2.0 User Activity VPN IKE WARNING IKEv2 IPsec attribute not found 970 5.9.0 User Activity VPN IKE WARNING IKEv2 IKE attribute not found 970 6.0.5 User Activity VPN IKE WARNING IKEv2 IKE attribute not found 970 6.2.0 User Activity VPN IKE WARNING IKEv2 IKE attribute not found 971 5.9.0 User Activity VPN IKE WARNING 971 6.0.5 User Activity VPN IKE WARNING 971 6.2.0 User Activity VPN IKE WARNING 972 5.9.0 User Activity VPN IKE INFO 972 6.0.5 User Activity VPN IKE INFO 972 6.2.0 User Activity VPN IKE INFO IKEv2 Peer is not responding. Negotiation aborted. IKEv2 Peer is not responding. Negotiation aborted. IKEv2 Peer is not responding. Negotiation aborted. IKEv2 Initiator: Remote party Timeout Retransmitting IKEv2 Request. IKEv2 Initiator: Remote party Timeout Retransmitting IKEv2 Request. IKEv2 Initiator: Remote party Timeout Retransmitting IKEv2 Request. SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 109
973 5.9.0 User Activity VPN IKE INFO 973 6.0.5 User Activity VPN IKE INFO 973 6.2.0 User Activity VPN IKE INFO 974 5.9.0 User Activity VPN IKE INFO 974 6.0.5 User Activity VPN IKE INFO 974 6.2.0 User Activity VPN IKE INFO 975 5.9.0 User Activity VPN IKE INFO 975 6.0.5 User Activity VPN IKE INFO 975 6.2.0 User Activity VPN IKE INFO 976 5.9.0 User Activity VPN IKE INFO 976 6.0.5 User Activity VPN IKE INFO 976 6.2.0 User Activity VPN IKE INFO 977 5.9.0 User Activity VPN IKE INFO 977 6.0.5 User Activity VPN IKE INFO IKEv2 Initiator: Received IKE_SA_INT response IKEv2 Initiator: Received IKE_SA_INT response IKEv2 Initiator: Received IKE_SA_INT response IKEv2 Initiator: Received IKE_AUTH response IKEv2 Initiator: Received IKE_AUTH response IKEv2 Initiator: Received IKE_AUTH response IKEv2 Initiator: Received CREATE_CHILD_SA response IKEv2 Initiator: Received CREATE_CHILD_SA response IKEv2 Initiator: Received CREATE_CHILD_SA response IKEv2 Responder: Send IKE_SA_INIT response IKEv2 Responder: Send IKE_SA_INIT response IKEv2 Responder: Send IKE_SA_INIT response IKEv2 Responder: Send IKE_AUTH response IKEv2 Responder: Send IKE_AUTH response 977 6.2.0 User Activity VPN IKE INFO IKEv2 Responder: Send IKE_AUTH response 978 5.9.0 User Activity VPN IKE INFO IKEv2 negotiation complete 978 6.0.5 User Activity VPN IKE INFO IKEv2 negotiation complete 978 6.2.0 User Activity VPN IKE INFO IKEv2 negotiation complete 979 5.9.0 User Activity VPN IKE ERROR 979 6.0.5 User Activity VPN IKE ERROR 979 6.2.0 User Activity VPN IKE ERROR IKEv2 Function sendto() failed to transmit packet. IKEv2 Function sendto() failed to transmit packet. IKEv2 Function sendto() failed to transmit packet. 110
980 5.9.0 User Activity VPN IKE WARNING 980 6.0.5 User Activity VPN IKE WARNING 980 6.2.0 User Activity VPN IKE WARNING 981 5.9.0 User Activity VPN IKE WARNING 981 6.0.5 User Activity VPN IKE WARNING 981 6.2.0 User Activity VPN IKE WARNING 982 5.9.0 User Activity VPN IKE INFO 982 6.0.5 User Activity VPN IKE INFO 982 6.2.0 User Activity VPN IKE INFO 983 5.9.0 User Activity VPN IKE WARNING 983 6.0.5 User Activity VPN IKE WARNING 983 6.2.0 User Activity VPN IKE WARNING 984 5.9.0 User Activity VPN IKE INFO 984 6.0.5 User Activity VPN IKE INFO 984 6.2.0 User Activity VPN IKE INFO 985 5.9.0 User Activity VPN IKE INFO 985 6.0.5 User Activity VPN IKE INFO 985 6.2.0 User Activity VPN IKE INFO 986 5.9.0 User Activity IKEv2 Initiator: Proposed IKE ID mismatch IKEv2 Initiator: Proposed IKE ID mismatch IKEv2 Initiator: Proposed IKE ID mismatch IKEv2 IKE proposal does not match IKEv2 IKE proposal does not match IKEv2 IKE proposal does not match IKEv2 Received notify status payload IKEv2 Received notify status payload IKEv2 Received notify status payload IKEv2 Received notify error payload IKEv2 Received notify error payload IKEv2 Received notify error payload IKEv2 No NAT device detected between negotiating peers IKEv2 No NAT device detected between negotiating peers IKEv2 No NAT device detected between negotiating peers IKEv2 NAT device detected between negotiating peers IKEv2 NAT device detected between negotiating peers IKEv2 NAT device detected between negotiating peers User login denied not allowed by Policy rule SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 111
986 6.0.5 User Activity 986 6.2.0 User Activity 987 5.9.0 User Activity 987 6.0.5 User Activity 987 6.2.0 User Activity 988 5.9.0 User Activity 988 6.0.5 User Activity 988 6.2.0 User Activity 989 5.9.0 User Activity 989 6.0.5 User Activity 989 6.2.0 User Activity 990 5.9.0 User Activity 990 6.0.5 User Activity 990 6.2.0 User Activity 991 5.9.0 User Activity 991 6.0.5 User Activity 991 6.2.0 User Activity Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING 992 5.9.0 User Activity CIA WARNING 992 6.0.5 User Activity CIA WARNING User login denied not allowed by Policy rule User login denied not allowed by Policy rule User login denied not found locally User login denied not found locally User login denied not found locally User login denied SSO agent Timeout User login denied SSO agent Timeout User login denied SSO agent Timeout User login denied SSO agent configuration error User login denied SSO agent configuration error User login denied SSO agent configuration error User login denied SSO agent communication problem User login denied SSO agent communication problem User login denied SSO agent communication problem User login denied SSO agent name resolution failed User login denied SSO agent name resolution failed User login denied SSO agent name resolution failed SSO agent returned user name too long SSO agent returned user name too long 112
992 6.2.0 User Activity CIA WARNING 993 5.9.0 User Activity CIA WARNING 993 6.0.5 User Activity CIA WARNING 993 6.2.0 User Activity CIA WARNING 994 5.9.0 User Activity 994 6.0.5 User Activity 994 6.2.0 User Activity 995 5.9.0 User Activity 995 6.0.5 User Activity 995 6.2.0 User Activity 996 5.9.0 User Activity 996 6.0.5 User Activity 996 6.2.0 User Activity 997 5.9.0 User Activity 997 6.0.5 User Activity 997 6.2.0 User Activity 998 5.9.0 User Activity 998 6.0.5 User Activity 998 6.2.0 User Activity SSO agent returned user name too long SSO agent returned domain name too long SSO agent returned domain name too long SSO agent returned domain name too long Configuration mode administration session started Configuration mode administration session started Configuration mode administration session started Configuration mode administration session ended Configuration mode administration session ended Configuration mode administration session ended Read only mode GUI administration session started Read only mode GUI administration session started Read only mode GUI administration session started Non config mode GUI administration session started Non config mode GUI administration session started Non config mode GUI administration session started GUI administration session ended GUI administration session ended GUI administration session ended SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 113
999 5.9.0 Blocked Sites Network 999 6.0.5 Blocked Sites Network 999 6.2.0 Blocked Sites Network 1000 5.9.0 Blocked Sites Network 1000 6.0.5 Blocked Sites Network SSL Control: Website found in blacklist SSL Control: Website found in blacklist SSL Control: Website found in blacklist SSL Control: Website found in whitelist SSL Control: Website found in whitelist 1000 6.2.0 Blocked Sites Network SSL Control: Website found in whitelist 1001 5.9.0 Blocked Sites Network SSL Control: HTTPS via SSL2 1001 6.0.5 Blocked Sites Network SSL Control: HTTPS via SSL2 1001 6.2.0 Blocked Sites Network SSL Control: HTTPS via SSL2 1002 5.9.0 Blocked Sites Network 1002 6.0.5 Blocked Sites Network 1002 6.2.0 Blocked Sites Network 1003 5.9.0 Blocked Sites Network 1003 6.0.5 Blocked Sites Network 1003 6.2.0 Blocked Sites Network 1004 5.9.0 Blocked Sites Network 1004 6.0.5 Blocked Sites Network SSL Control: Certificate with invalid date SSL Control: Certificate with invalid date SSL Control: Certificate with invalid date SSL Control: Self signed certificate SSL Control: Self signed certificate SSL Control: Self signed certificate SSL Control: Weak cipher being used SSL Control: Weak cipher being used 1004 6.2.0 Blocked Sites Network SSL Control: Weak cipher being used 1005 5.9.0 Blocked Sites Network SSL Control: Untrusted CA 1005 6.0.5 Blocked Sites Network SSL Control: Untrusted CA 1005 6.2.0 Blocked Sites Network SSL Control: Untrusted CA 1006 5.9.0 Blocked Sites Network SSL Control: Certificate chain not complete 114
1006 6.0.5 Blocked Sites Network 1006 6.2.0 Blocked Sites Network 1007 5.9.0 Blocked Sites Network 1007 6.0.5 Blocked Sites Network 1007 6.2.0 Blocked Sites Network 1008 5.9.0 User Activity 1008 6.0.5 User Activity SSL Control: Certificate chain not complete SSL Control: Certificate chain not complete SSL Control: Failed to decode Server Hello SSL Control: Failed to decode Server Hello SSL Control: Failed to decode Server Hello User logged out logout detected by SSO User logged out logout detected by SSO 1008 6.2.0 User Activity User logged out logout detected by SSO 1009 5.9.0 System Error RADIUS ERROR Bind to LDAP server failed 1009 6.0.5 System Error RADIUS ERROR Bind to LDAP server failed 1009 6.2.0 System Error RADIUS ERROR Bind to LDAP server failed 1010 5.9.0 System Error RADIUS ALERT 1010 6.0.5 System Error RADIUS ALERT 1010 6.2.0 System Error RADIUS ALERT 1011 5.9.0 System Error RADIUS WARNING 1011 6.0.5 System Error RADIUS WARNING 1011 6.2.0 System Error RADIUS WARNING 1012 5.9.0 User Activity VPN IKE INFO Using LDAP without TLS highly insecure Using LDAP without TLS highly insecure Using LDAP without TLS highly insecure LDAP using non administrative account VPN client user will not be able to change passwords LDAP using non administrative account VPN client user will not be able to change passwords LDAP using non administrative account VPN client user will not be able to change passwords IKEv2 Responder: Send CREATE_CHILD_SA response SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 115
1012 6.0.5 User Activity VPN IKE INFO 1012 6.2.0 User Activity VPN IKE INFO 1013 5.9.0 User Activity VPN IKE INFO 1013 6.0.5 User Activity VPN IKE INFO 1013 6.2.0 User Activity VPN IKE INFO 1014 5.9.0 User Activity VPN IKE INFO 1014 6.0.5 User Activity VPN IKE INFO 1014 6.2.0 User Activity VPN IKE INFO 1015 5.9.0 User Activity VPN IKE INFO 1015 6.0.5 User Activity VPN IKE INFO 1015 6.2.0 User Activity VPN IKE INFO 1016 5.9.0 User Activity VPN IKE INFO 1016 6.0.5 User Activity VPN IKE INFO 1016 6.2.0 User Activity VPN IKE INFO 1017 5.9.0 1017 6.0.5 IKEv2 Responder: Send CREATE_CHILD_SA response IKEv2 Responder: Send CREATE_CHILD_SA response IKEv2 Send delete IKE SA response IKEv2 Send delete IKE SA response IKEv2 Send delete IKE SA response IKEv2 Send delete IPsec SA response IKEv2 Send delete IPsec SA response IKEv2 Send delete IPsec SA response IKEv2 Received delete IKE SA response IKEv2 Received delete IKE SA response IKEv2 Received delete IKE SA response IKEv2 Received delete IPsec SA response IKEv2 Received delete IPsec SA response IKEv2 Received delete IPsec SA response System Environment Firewall Hardware INFO 3G/4G %s device detected System Environment Firewall Hardware INFO 3G/4G %s device detected 1017 6.2.0 System Environment Firewall Hardware INFO 3G/4G %s device detected 1018 5.9.0 PPP INFO PPP message: %s 1018 6.0.5 PPP INFO PPP message: %s 1018 6.2.0 PPP INFO PPP message: %s 1019 5.9.0 User Activity PPP Dial Up INFO Chat started 1019 6.0.5 User Activity PPP Dial Up INFO Chat started 116
1019 6.2.0 User Activity PPP Dial Up INFO Chat started 1020 5.9.0 User Activity PPP Dial Up INFO Chat completed 1020 6.0.5 User Activity PPP Dial Up INFO Chat completed 1020 6.2.0 User Activity PPP Dial Up INFO Chat completed 1021 5.9.0 User Activity PPP Dial Up INFO Chat wrote '%s' 1021 6.0.5 User Activity PPP Dial Up INFO Chat wrote '%s' 1021 6.2.0 User Activity PPP Dial Up INFO Chat wrote '%s' 1022 5.9.0 User Activity PPP Dial Up INFO Chat %s 1022 6.0.5 User Activity PPP Dial Up INFO Chat %s 1022 6.2.0 User Activity PPP Dial Up INFO Chat %s 1023 5.9.0 User Activity PPP Dial Up INFO Chat failed: %s 1023 6.0.5 User Activity PPP Dial Up INFO Chat failed: %s 1023 6.2.0 User Activity PPP Dial Up INFO Chat failed: %s 1024 5.9.0 System Error PPP Dial Up ERROR 1024 6.0.5 System Error PPP Dial Up ERROR Unable to send message to dialup task Unable to send message to dialup task 1024 6.2.0 System Error PPP Dial Up ERROR Unable to send message to dialup task 1026 5.9.0 User Activity PPP Dial Up ALERT 3G/4G Dial up: %s. 1026 6.0.5 User Activity PPP Dial Up ALERT 3G/4G Dial up: %s. 1026 6.2.0 User Activity PPP Dial Up ALERT 3G/4G Dial up: %s. 1027 5.9.0 User Activity PPP Dial Up ALERT 7643 1027 6.0.5 User Activity PPP Dial Up ALERT 7643 1027 6.2.0 User Activity PPP Dial Up ALERT 7643 1028 5.9.0 System Error PPP Dial Up ALERT 3G/4G Dial up: data usage limit reached for the '%s' billing cycle. Disconnecting the session. 3G/4G Dial up: data usage limit reached for the '%s' billing cycle. Disconnecting the session. 3G/4G Dial up: data usage limit reached for the '%s' billing cycle. Disconnecting the session. %s auto dial failed: Current Connection Model is configured as Ethernet Only SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 117
1028 6.0.5 System Error PPP Dial Up ALERT 1028 6.2.0 System Error PPP Dial Up ALERT 1029 5.9.0 Debug Network DEBUG 1029 6.0.5 Debug Network DEBUG 1029 6.2.0 Debug Network DEBUG 1030 5.9.0 Debug Network DEBUG 1030 6.0.5 Debug Network DEBUG 1030 6.2.0 Debug Network DEBUG 1031 5.9.0 Debug Network DEBUG 1031 6.0.5 Debug Network DEBUG 1031 6.2.0 Debug Network DEBUG 1033 5.9.0 User Activity 1033 6.0.5 User Activity 1033 6.2.0 User Activity Access WARNING Access WARNING Access WARNING %s auto dial failed: Current Connection Model is configured as Ethernet Only %s auto dial failed: Current Connection Model is configured as Ethernet Only TCP packet received with nonpermitted option; TCP packet dropped TCP packet received with nonpermitted option; TCP packet dropped TCP packet received with nonpermitted option; TCP packet dropped TCP packet received with invalid Window Scale option length; TCP packet dropped TCP packet received with invalid Window Scale option length; TCP packet dropped TCP packet received with invalid Window Scale option length; TCP packet dropped TCP packet received with invalid Window Scale option value; TCP packet dropped TCP packet received with invalid Window Scale option value; TCP packet dropped TCP packet received with invalid Window Scale option value; TCP packet dropped Problem occurred during user group membership retrieval Problem occurred during user group membership retrieval Problem occurred during user group membership retrieval 118
1035 5.9.0 User Activity 1035 6.0.5 User Activity 1035 6.2.0 User Activity 1036 5.9.0 User Activity VPN IKE ERROR 1036 6.0.5 User Activity VPN IKE ERROR User login denied password expired User login denied password expired User login denied password expired IKE Responder: IKE Phase 1 exchange does not match IKE Responder: IKE Phase 1 exchange does not match 1036 6.2.0 User Activity VPN IKE ERROR IKE Responder: IKE Phase 1 exchange does not match 1037 5.9.0 PPP Dial Up INFO PPP Dial Up: Starting PPP 1037 6.0.5 PPP Dial Up INFO PPP Dial Up: Starting PPP 1037 6.2.0 PPP Dial Up INFO PPP Dial Up: Starting PPP 1038 5.9.0 PPP Dial Up INFO 1038 6.0.5 PPP Dial Up INFO 1038 6.2.0 PPP Dial Up INFO 1039 5.9.0 PPP Dial Up INFO 1039 6.0.5 PPP Dial Up INFO 1039 6.2.0 PPP Dial Up INFO 1040 5.9.0 DHCP Server ALERT 1040 6.0.5 DHCP Server ALERT 1040 6.2.0 DHCP Server ALERT 1041 5.9.0 DHCP Server ALERT 1041 6.0.5 DHCP Server ALERT 1041 6.2.0 DHCP Server ALERT Dial up: Traffic generated by '%s' Dial up: Traffic generated by '%s' Dial up: Traffic generated by '%s' Dial up: Session initiated by data packet Dial up: Session initiated by data packet Dial up: Session initiated by data packet DHCP Server: IP conflict detected DHCP Server: IP conflict detected DHCP Server: IP conflict detected DHCP Server: Received DHCP decline from client DHCP Server: Received DHCP decline from client DHCP Server: Received DHCP decline from client SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 119
1043 5.9.0 Firewall Hardware ERROR 5425 1043 6.0.5 Firewall Hardware ERROR 5425 Power supply without redundancy Power supply without redundancy 1043 6.2.0 Firewall Hardware ERROR 5425 Power supply without redundancy 1044 5.9.0 High Availability INFO Discovered HA %s Firewall 1044 6.0.5 High Availability INFO Discovered HA %s Firewall 1044 6.2.0 High Availability INFO Discovered HA %s Firewall 1045 5.9.0 Firewall Event INFO 1045 6.0.5 Firewall Event INFO 1045 6.2.0 Firewall Event INFO 1046 5.9.0 Firewall Event INFO 1046 6.0.5 Firewall Event INFO 1046 6.2.0 Firewall Event INFO 1047 5.9.0 Firewall Event INFO 1047 6.0.5 Firewall Event INFO 1047 6.2.0 Firewall Event INFO 1048 5.9.0 1048 6.0.5 Diagnostic Auto restart scheduled for %s minutes from now Diagnostic Auto restart scheduled for %s minutes from now Diagnostic Auto restart scheduled for %s minutes from now Diagnostic Auto restart canceled Diagnostic Auto restart canceled Diagnostic Auto restart canceled As per Diagnostic Auto restart configuration Request, restarting system As per Diagnostic Auto restart configuration Request, restarting system As per Diagnostic Auto restart configuration Request, restarting system User login denied password doesn't meet constraints User login denied password doesn't meet constraints 1048 6.2.0 User login denied password doesn't meet constraints 1050 5.9.0 User Activity VPN INFO VPN policy %s is added 1050 6.0.5 VPN INFO VPN Policy Added 1050 6.2.0 User Activity VPN INFO VPN policy %s is added 120
1051 5.9.0 User Activity VPN INFO VPN policy %s is deleted 1051 6.0.5 VPN INFO VPN Policy Deleted 1051 6.2.0 User Activity VPN INFO VPN policy %s is deleted 1052 5.9.0 User Activity VPN INFO VPN policy %s is modified 1052 6.0.5 VPN INFO VPN Policy Modified 1052 6.2.0 User Activity VPN INFO VPN policy %s is modified 1053 5.9.0 Firewall Hardware ALERT 5418 PC Card removed. 1053 6.0.5 Firewall Hardware ALERT 5418 PC Card removed. 1053 6.2.0 Firewall Hardware ALERT 5418 PC Card removed. 1054 5.9.0 Firewall Hardware ALERT 5419 PC Card inserted. 1054 6.0.5 Firewall Hardware ALERT 5419 PC Card inserted. 1054 6.2.0 Firewall Hardware ALERT 5419 PC Card inserted. 1055 5.9.0 Firewall Hardware ALERT 3G/4G: No SIM detected 1055 6.0.5 Firewall Hardware ALERT 3G/4G: No SIM detected 1055 6.2.0 Firewall Hardware ALERT 3G/4G: No SIM detected 1057 5.9.0 High Availability INFO Peer firewall rebooting (%s) 1057 6.0.5 High Availability INFO Peer firewall rebooting (%s) 1057 6.2.0 High Availability INFO Peer firewall rebooting (%s) 1058 5.9.0 High Availability INFO 1058 6.0.5 High Availability INFO 1058 6.2.0 High Availability INFO 1059 5.9.0 High Availability INFO 1059 6.0.5 High Availability INFO 1059 6.2.0 High Availability INFO Primary firewall rebooting itself as it transitioned from Active to Standby while Preempt Primary firewall rebooting itself as it transitioned from Active to Standby while Preempt Primary firewall rebooting itself as it transitioned from Active to Standby while Preempt Secondary firewall rebooting itself as it transitioned from Active to Standby while Preempt Secondary firewall rebooting itself as it transitioned from Active to Standby while Preempt Secondary firewall rebooting itself as it transitioned from Active to Standby while Preempt SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 121
1060 5.9.0 Crypto Test ERROR 1060 6.0.5 Crypto Test ERROR 1060 6.2.0 Crypto Test ERROR 1065 5.9.0 Maintenance Firewall Event INFO 1065 6.0.5 Maintenance Firewall Event INFO 1065 6.2.0 Maintenance Firewall Event INFO 1066 5.9.0 Maintenance Firewall Event INFO 1066 6.0.5 Maintenance Firewall Event INFO 1066 6.2.0 Maintenance Firewall Event INFO 1068 5.9.0 DHCP Server WARNING 1068 6.0.5 DHCP Server WARNING 1068 6.2.0 DHCP Server WARNING 1070 5.9.0 Firewall Event INFO 1070 6.0.5 Firewall Event INFO 1070 6.2.0 Firewall Event INFO 1071 5.9.0 Firewall Event CRITICAL 1071 6.0.5 Firewall Event CRITICAL 1071 6.2.0 Firewall Event CRITICAL 1072 5.9.0 Firewall Event CRITICAL Crypto SHA1 based DRNG KAT test failed Crypto SHA1 based DRNG KAT test failed Crypto SHA1 based DRNG KAT test failed Successfully sent %s file to remote backup server Successfully sent %s file to remote backup server Successfully sent %s file to remote backup server Failed to send file to remote backup server, Error: %s Failed to send file to remote backup server, Error: %s Failed to send file to remote backup server, Error: %s Multiple DHCP Servers are detected on network Multiple DHCP Servers are detected on network Multiple DHCP Servers are detected on network Invalid DNS Server will not be accepted by the dynamic client Invalid DNS Server will not be accepted by the dynamic client Invalid DNS Server will not be accepted by the dynamic client DHCP Server sanity check passed %s DHCP Server sanity check passed %s DHCP Server sanity check passed %s DHCP Server sanity check failed %s 122
1072 6.0.5 Firewall Event CRITICAL DHCP Server sanity check failed %s 1072 6.2.0 Firewall Event CRITICAL DHCP Server sanity check failed %s 1073 5.9.0 User Activity CIA WARNING SSO agent returned error 1073 6.0.5 User Activity CIA WARNING SSO agent returned error 1073 6.2.0 User Activity CIA WARNING SSO agent returned error 1074 5.9.0 L2TP Client INFO L2TP Tunnel Negotiation %s 1074 6.0.5 L2TP Client INFO L2TP Tunnel Negotiation %s 1074 6.2.0 L2TP Client INFO L2TP Tunnel Negotiation %s 1075 5.9.0 User Activity CIA ALERT SSO agent is down 1075 6.0.5 User Activity CIA ALERT SSO agent is down 1075 6.2.0 User Activity CIA ALERT SSO agent is down 1076 5.9.0 User Activity CIA ALERT SSO agent is up 1076 6.0.5 User Activity CIA ALERT SSO agent is up 1076 6.2.0 User Activity CIA ALERT SSO agent is up 1077 5.9.0 SonicPoint N INFO SonicPoint N Status 1077 6.0.5 SonicPoint N INFO SonicPoint N Status 1077 6.2.0 SonicPoint N INFO SonicPoint N Status 1078 5.9.0 SonicPoint N INFO SonicPoint N Provision 1078 6.0.5 SonicPoint N INFO SonicPoint N Provision 1078 6.2.0 SonicPoint N INFO SonicPoint N Provision 1079 5.9.0 SSL VPN INFO %s 1079 6.0.5 SSL VPN INFO %s 1079 6.2.0 SSL VPN INFO %s 1080 5.9.0 1080 6.0.5 1080 6.2.0 1081 5.9.0 Blocked Sites Network 1081 6.0.5 Blocked Sites Network SSL VPN zone remote user login allowed SSL VPN zone remote user login allowed SSL VPN zone remote user login allowed SSL Control: Certificate with MD5 Digest Signature Algorithm SSL Control: Certificate with MD5 Digest Signature Algorithm SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 123
1081 6.2.0 Blocked Sites Network SSL Control: Certificate with MD5 Digest Signature Algorithm 1082 5.9.0 Anti Spam WARNING 13801 %s is operational. 1082 6.0.5 Anti Spam WARNING 13801 %s is operational. 1082 6.2.0 Anti Spam WARNING 13801 %s is operational. 1083 5.9.0 Anti Spam WARNING 13802 %s is unavailable. 1083 6.0.5 Anti Spam WARNING 13802 %s is unavailable. 1083 6.2.0 Anti Spam WARNING 13802 %s is unavailable. 1084 5.9.0 Anti Spam INFO 13803 1084 6.0.5 Anti Spam INFO 13803 1084 6.2.0 Anti Spam INFO 13803 1085 5.9.0 Anti Spam INFO 13804 1085 6.0.5 Anti Spam INFO 13804 1085 6.2.0 Anti Spam INFO 13804 1086 5.9.0 Anti Spam WARNING 13805 1086 6.0.5 Anti Spam WARNING 13805 1086 6.2.0 Anti Spam WARNING 13805 1087 5.9.0 Anti Spam WARNING 13806 1087 6.0.5 Anti Spam WARNING 13806 Anti Spam service is enabled by administrator. Anti Spam service is enabled by administrator. Anti Spam service is enabled by administrator. Anti Spam service is disabled by administrator. Anti Spam service is disabled by administrator. Anti Spam service is disabled by administrator. Your Anti Spam Service subscription has expired. Your Anti Spam Service subscription has expired. Your Anti Spam Service subscription has expired. SMTP connection limit is reached. Connection is dropped. SMTP connection limit is reached. Connection is dropped. 1087 6.2.0 Anti Spam WARNING 13806 SMTP connection limit is reached. Connection is dropped. 1088 5.9.0 Anti Spam WARNING 13807 Anti Spam Startup Failure %s 1088 6.0.5 Anti Spam WARNING 13807 Anti Spam Startup Failure %s 1088 6.2.0 Anti Spam WARNING 13807 Anti Spam Startup Failure %s 124
1089 5.9.0 Anti Spam WARNING 13808 1089 6.0.5 Anti Spam WARNING 13808 1089 6.2.0 Anti Spam WARNING 13808 1090 5.9.0 DHCP Server NOTICE 1090 6.0.5 DHCP Server NOTICE 1090 6.2.0 DHCP Server NOTICE 1091 5.9.0 Anti Spam NOTICE 13809 1091 6.0.5 Anti Spam NOTICE 13809 1091 6.2.0 Anti Spam NOTICE 13809 1092 5.9.0 Anti Spam NOTICE 13810 1092 6.0.5 Anti Spam NOTICE 13810 1092 6.2.0 Anti Spam NOTICE 13810 1093 5.9.0 Anti Spam NOTICE 13811 1093 6.0.5 Anti Spam NOTICE 13811 1093 6.2.0 Anti Spam NOTICE 13811 1094 5.9.0 Anti Spam ERROR 13812 1094 6.0.5 Anti Spam ERROR 13812 1094 6.2.0 Anti Spam ERROR 13812 Anti Spam Teardown Failure %s Anti Spam Teardown Failure %s Anti Spam Teardown Failure %s DHCP Server: Received DHCP message from untrusted relay agent DHCP Server: Received DHCP message from untrusted relay agent DHCP Server: Received DHCP message from untrusted relay agent Outbound connection to GRIDlisted SMTP server dropped Outbound connection to GRIDlisted SMTP server dropped Outbound connection to GRIDlisted SMTP server dropped Inbound connection from GRIDlisted SMTP server dropped Inbound connection from GRIDlisted SMTP server dropped Inbound connection from GRIDlisted SMTP server dropped SMTP server found on Reject List SMTP server found on Reject List SMTP server found on Reject List No valid DNS server specified for GRID lookups No valid DNS server specified for GRID lookups No valid DNS server specified for GRID lookups SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 125
1095 5.9.0 Anti Spam INFO 13813 1095 6.0.5 Anti Spam INFO 13813 Unprocessed E mail received from MTA on Inbound SMTP port Unprocessed E mail received from MTA on Inbound SMTP port 1095 6.2.0 Anti Spam INFO 13813 Unprocessed E mail received from MTA on Inbound SMTP port 1097 5.9.0 VPN PKI NOTICE SCEP Client: %s 1097 6.0.5 VPN PKI NOTICE SCEP Client: %s 1097 6.2.0 VPN PKI NOTICE SCEP Client: %s 1098 5.9.0 1098 6.0.5 1098 6.2.0 1099 5.9.0 1099 6.0.5 1099 6.2.0 ALERT 6465 ALERT 6465 ALERT 6465 Possible DNS rebind attack detected Possible DNS rebind attack detected Possible DNS rebind attack detected ALERT 6466 DNS rebind attack blocked ALERT 6466 DNS rebind attack blocked ALERT 6466 DNS rebind attack blocked 1100 5.9.0 Network Monitor ALERT 14001 1100 6.0.5 Network Monitor ALERT 14001 1100 6.2.0 Network Monitor ALERT 14001 1101 5.9.0 Network Monitor ALERT 14002 1101 6.0.5 Network Monitor ALERT 14002 1101 6.2.0 Network Monitor ALERT 14002 1102 5.9.0 Network Monitor ALERT 14003 Network Monitor: Policy %s status is UP Network Monitor: Policy %s status is UP Network Monitor: Policy %s status is UP Network Monitor: Policy %s status is DOWN Network Monitor: Policy %s status is DOWN Network Monitor: Policy %s status is DOWN Network Monitor: Policy %s status is UNKNOWN 126
1102 6.0.5 Network Monitor ALERT 14003 1102 6.2.0 Network Monitor ALERT 14003 1103 5.9.0 Network Monitor ALERT 14004 1103 6.0.5 Network Monitor ALERT 14004 1103 6.2.0 Network Monitor ALERT 14004 1104 5.9.0 Network Monitor INFO 1104 6.0.5 Network Monitor INFO 1104 6.2.0 Network Monitor INFO 1105 5.9.0 Network Monitor INFO 1105 6.0.5 Network Monitor INFO 1105 6.2.0 Network Monitor INFO 1106 5.9.0 Network Monitor INFO 1106 6.0.5 Network Monitor INFO Network Monitor: Policy %s status is UNKNOWN Network Monitor: Policy %s status is UNKNOWN Network Monitor: Host %s status is UNKNOWN Network Monitor: Host %s status is UNKNOWN Network Monitor: Host %s status is UNKNOWN Network Monitor Policy %s Added Network Monitor Policy %s Added Network Monitor Policy %s Added Network Monitor Policy %s Deleted Network Monitor Policy %s Deleted Network Monitor Policy %s Deleted Network Monitor Policy %s Modified Network Monitor Policy %s Modified 1106 6.2.0 Network Monitor INFO Network Monitor Policy %s Modified 1107 5.9.0 System Error Firewall Event ALERT %s 1107 6.0.5 System Error Firewall Event ALERT %s 1107 6.2.0 System Error Firewall Event ALERT %s 1108 5.9.0 Anti Spam INFO 1108 6.0.5 Anti Spam INFO Message blocked by Real Time E mail Scanner Message blocked by Real Time E mail Scanner 1108 6.2.0 Anti Spam INFO Message blocked by Real Time E mail Scanner 1109 5.9.0 VPN PKI INFO CSR Generation: %s 1109 6.0.5 VPN PKI INFO CSR Generation: %s SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 127
1109 6.2.0 VPN PKI INFO CSR Generation: %s 1110 5.9.0 DHCP Server INFO Assigned IP address %s 1110 6.0.5 DHCP Server INFO Assigned IP address %s 1110 6.2.0 DHCP Server INFO Assigned IP address %s 1111 5.9.0 DHCP Server INFO Released IP address %s 1111 6.0.5 DHCP Server INFO Released IP address %s 1111 6.2.0 DHCP Server INFO Released IP address %s 1112 5.9.0 FTP DEBUG 1112 6.0.5 FTP DEBUG FTP server accepted the connection FTP server accepted the connection 1112 6.2.0 FTP DEBUG FTP server accepted the connection 1113 5.9.0 FTP DEBUG FTP client user name was sent 1113 6.0.5 FTP DEBUG FTP client user name was sent 1113 6.2.0 FTP DEBUG FTP client user name was sent 1114 5.9.0 FTP DEBUG 1114 6.0.5 FTP DEBUG FTP client user logged in successfully FTP client user logged in successfully 1114 6.2.0 FTP DEBUG FTP client user logged in successfully 1115 5.9.0 FTP DEBUG FTP client user logged in failed 1115 6.0.5 FTP DEBUG FTP client user logged in failed 1115 6.2.0 FTP DEBUG FTP client user logged in failed 1116 5.9.0 FTP DEBUG FTP client user logged out 1116 6.0.5 FTP DEBUG FTP client user logged out 1116 6.2.0 FTP DEBUG FTP client user logged out 1117 5.9.0 User Activity 1117 6.0.5 User Activity 1117 6.2.0 User Activity 1118 5.9.0 User Activity Access WARNING Access WARNING Access WARNING User login denied SSO probe failed User login denied SSO probe failed User login denied SSO probe failed User login denied Mail Address(From/to) or SMTP Server is not configured 128
1118 6.0.5 User Activity 1118 6.2.0 User Activity 1119 5.9.0 User Activity 1119 6.0.5 User Activity 1119 6.2.0 User Activity 1120 5.9.0 User Activity 1120 6.0.5 User Activity 1120 6.2.0 User Activity 1121 5.9.0 User Activity 1121 6.0.5 User Activity 1121 6.2.0 User Activity 1122 5.9.0 User Activity 1122 6.0.5 User Activity Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING Access WARNING User login denied Mail Address(From/to) or SMTP Server is not configured User login denied Mail Address(From/to) or SMTP Server is not configured RADIUS user cannot use One Time Password no mail address set for equivalent local user RADIUS user cannot use One Time Password no mail address set for equivalent local user RADIUS user cannot use One Time Password no mail address set for equivalent local user User login denied Terminal Services agent Timeout User login denied Terminal Services agent Timeout User login denied Terminal Services agent Timeout User login denied Terminal Services agent name resolution failed User login denied Terminal Services agent name resolution failed User login denied Terminal Services agent name resolution failed User login denied No name received from Terminal Services agent User login denied No name received from Terminal Services agent SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 129
1122 6.2.0 User Activity 1123 5.9.0 User Activity 1123 6.0.5 User Activity 1123 6.2.0 User Activity 1124 5.9.0 User Activity 1124 6.0.5 User Activity 1124 6.2.0 User Activity Access WARNING Access WARNING Access WARNING Access WARNING 1125 5.9.0 User Activity High Availability INFO 1125 6.0.5 High Availability INFO 1125 6.2.0 User Activity High Availability INFO 1126 5.9.0 User Activity High Availability ERROR 1126 6.0.5 High Availability ERROR User login denied No name received from Terminal Services agent User login denied Terminal Services agent communication problem User login denied Terminal Services agent communication problem User login denied Terminal Services agent communication problem User logged out logout reported by Terminal Services agent User logged out logout reported by Terminal Services agent User logged out logout reported by Terminal Services agent High Availability has been enabled, Dial Up device(s) are not supported in High Availability processing. High Availability has been enabled, Dial Up device(s) are not supported in High Availability processing. High Availability has been enabled, Dial Up device(s) are not supported in High Availability processing. The High Availability monitoring IP configuration of Interface %s is incorrect. The High Availability monitoring IP configuration of Interface %s is incorrect. 130
1126 6.2.0 User Activity High Availability ERROR 1127 5.9.0 User Activity VPN IKE WARNING 1127 6.0.5 User Activity VPN IKE WARNING 1127 6.2.0 User Activity VPN IKE WARNING 1128 5.9.0 User Activity VPN IKE WARNING 1128 6.0.5 User Activity VPN IKE WARNING The High Availability monitoring IP configuration of Interface %s is incorrect. IKE Responder: ESP mode mismatch Local Tunnel Remote Transport IKE Responder: ESP mode mismatch Local Tunnel Remote Transport IKE Responder: ESP mode mismatch Local Tunnel Remote Transport IKE Responder: ESP mode mismatch Local Transport Remote Tunnel IKE Responder: ESP mode mismatch Local Transport Remote Tunnel 1128 6.2.0 User Activity VPN IKE WARNING IKE Responder: ESP mode mismatch Local Transport Remote Tunnel 1131 5.9.0 Anti Spam DEBUG Probe Response Success %s 1131 6.0.5 Anti Spam DEBUG Probe Response Success %s 1131 6.2.0 Anti Spam DEBUG Probe Response Success %s 1132 5.9.0 Anti Spam DEBUG Probe Response Failure %s 1132 6.0.5 Anti Spam DEBUG Probe Response Failure %s 1132 6.2.0 Anti Spam DEBUG Probe Response Failure %s 1133 5.9.0 PPPoE INFO %s 1133 6.0.5 PPPoE INFO %s 1133 6.2.0 PPPoE INFO %s 1134 5.9.0 Maintenance PPTP INFO %s 1134 6.0.5 Maintenance PPTP INFO %s 1134 6.2.0 Maintenance PPTP INFO %s 1135 5.9.0 Maintenance L2TP Client INFO %s 1135 6.0.5 Maintenance L2TP Client INFO %s 1135 6.2.0 Maintenance L2TP Client INFO %s Received unauthenticated GRID 1138 5.9.0 Anti Spam DEBUG response SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 131
1138 6.0.5 Anti Spam DEBUG 1138 6.2.0 Anti Spam DEBUG 1139 5.9.0 Anti Spam DEBUG 1139 6.0.5 Anti Spam DEBUG 1139 6.2.0 Anti Spam DEBUG 1140 5.9.0 Anti Spam DEBUG 1140 6.0.5 Anti Spam DEBUG Received unauthenticated GRID response Received unauthenticated GRID response Invalid key or serial number used for GRID response Invalid key or serial number used for GRID response Invalid key or serial number used for GRID response Invalid key version used for GRID response Invalid key version used for GRID response 1140 6.2.0 Anti Spam DEBUG Invalid key version used for GRID response 1141 5.9.0 Anti Spam DEBUG Host IP address not in GRID List 1141 6.0.5 Anti Spam DEBUG Host IP address not in GRID List 1141 6.2.0 Anti Spam DEBUG Host IP address not in GRID List 1142 5.9.0 Anti Spam DEBUG 1142 6.0.5 Anti Spam DEBUG 1142 6.2.0 Anti Spam DEBUG 1143 5.9.0 Anti Spam DEBUG 1143 6.0.5 Anti Spam DEBUG No response received from DNS server No response received from DNS server No response received from DNS server Not blacklisted as per configuration Not blacklisted as per configuration 1143 6.2.0 Anti Spam DEBUG Not blacklisted as per configuration 1144 5.9.0 Anti Spam DEBUG Default to not blacklisted 1144 6.0.5 Anti Spam DEBUG Default to not blacklisted 1144 6.2.0 Anti Spam DEBUG Default to not blacklisted 1145 5.9.0 Anti Spam DEBUG 1145 6.0.5 Anti Spam DEBUG Failed to insert entry into GRID result IP cached table Failed to insert entry into GRID result IP cached table 132
1145 6.2.0 Anti Spam DEBUG Failed to insert entry into GRID result IP cached table 1146 5.9.0 Anti Spam DEBUG Resolved ES Cloud %s 1146 6.0.5 Anti Spam DEBUG Resolved ES Cloud %s 1146 6.2.0 Anti Spam DEBUG Resolved ES Cloud %s 1147 5.9.0 Anti Spam DEBUG Updated ES Cloud Address %s 1147 6.0.5 Anti Spam DEBUG Updated ES Cloud Address %s 1147 6.2.0 Anti Spam DEBUG Updated ES Cloud Address %s 1148 5.9.0 1148 6.0.5 1148 6.2.0 Advanced Switching Advanced Switching Advanced Switching INFO %s Advanced Switching INFO %s Advanced Switching INFO %s 1149 5.9.0 High Availability WARNING 1149 6.0.5 High Availability WARNING Your Active/Active Clustering subscription has expired. Your Active/Active Clustering subscription has expired. 1149 6.2.0 High Availability WARNING Your Active/Active Clustering subscription has expired. 1150 5.9.0 User Activity CIA ALERT Terminal Services agent is down 1150 6.0.5 User Activity CIA ALERT Terminal Services agent is down 1150 6.2.0 User Activity CIA ALERT Terminal Services agent is down 1151 5.9.0 User Activity CIA ALERT Terminal Services agent is up 1151 6.0.5 User Activity CIA ALERT Terminal Services agent is up 1151 6.2.0 User Activity CIA ALERT Terminal Services agent is up 1152 5.9.0 High Availability ERROR 1152 6.0.5 High Availability ERROR 1152 6.2.0 High Availability ERROR 1153 5.9.0 1153 6.0.5 Active/Active Clustering license is not activated on the following cluster units: %s Active/Active Clustering license is not activated on the following cluster units: %s Active/Active Clustering license is not activated on the following cluster units: %s Connection Traffic SSL VPN INFO SSL VPN Traffic Connection Traffic SSL VPN INFO SSL VPN Traffic SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 133
1153 6.2.0 1154 5.9.0 1154 6.0.5 1154 6.2.0 1155 5.9.0 1155 6.0.5 1155 6.2.0 Connection Traffic SSL VPN INFO SSL VPN Traffic Application Control Detection ALERT 15001 Application Control Detection ALERT 15001 Application Control Detection ALERT 15001 Application Control Detection ALERT 15002 Application Control Detection ALERT 15002 Application Control Detection ALERT 15002 1156 5.9.0 Firewall Event ERROR 1156 6.0.5 Firewall Event ERROR 1156 6.2.0 Firewall Event ERROR 1157 5.9.0 User Activity 1157 6.0.5 User Activity 1157 6.2.0 User Activity 1158 5.9.0 User Activity 1158 6.0.5 User Activity 1158 6.2.0 User Activity 1159 5.9.0 Security Services WARNING 1159 6.0.5 Security Services WARNING Application Control Detection Alert: %s Application Control Detection Alert: %s Application Control Detection Alert: %s Application Control Prevention Alert: %s Application Control Prevention Alert: %s Application Control Prevention Alert: %s Name Resolution for Syslog or GMS failed. Name Resolution for Syslog or GMS failed. Name Resolution for Syslog or GMS failed. User account '%s' expired and disabled User account '%s' expired and disabled User account '%s' expired and disabled User account '%s' expired and pruned User account '%s' expired and pruned User account '%s' expired and pruned Received Alert: Your Visualization Control subscription has expired. Received Alert: Your Visualization Control subscription has expired. 134
1159 6.2.0 Security Services WARNING 1160 5.9.0 Maintenance Firewall Event DEBUG 1160 6.0.5 Maintenance Firewall Event DEBUG 1160 6.2.0 Maintenance Firewall Event DEBUG 1161 5.9.0 Maintenance Firewall Event DEBUG 1161 6.0.5 Maintenance Firewall Event DEBUG 1161 6.2.0 Maintenance Firewall Event DEBUG 1162 5.9.0 System Error High Availability ALERT 664 1162 6.0.5 System Error High Availability ALERT 664 Received Alert: Your Visualization Control subscription has expired. Attempt to contact Remote backup server for upload approval failed Attempt to contact Remote backup server for upload approval failed Attempt to contact Remote backup server for upload approval failed Backup remote server did not approve upload Request Backup remote server did not approve upload Request Backup remote server did not approve upload Request Modules attached to HA units do not match: %s Modules attached to HA units do not match: %s 1162 6.2.0 System Error High Availability ALERT 664 Modules attached to HA units do not match: %s 1163 5.9.0 E1/T1 Status INFO E1_T1 Layer 1 status: No signal 1163 6.0.5 None INFO E1_T1 Layer 1 status: No signal 1163 6.2.0 E1/T1 Status INFO E1_T1 Layer 1 status: No signal 1164 5.9.0 E1/T1 Status INFO 1164 6.0.5 None INFO 1164 6.2.0 E1/T1 Status INFO 1165 5.9.0 E1/T1 Status INFO 1165 6.0.5 None INFO 1165 6.2.0 E1/T1 Status INFO E1_T1 Layer 1 status: No frame synchronization E1_T1 Layer 1 status: No frame synchronization E1_T1 Layer 1 status: No frame synchronization E1_T1 Layer 1 status: No multiframe synchronization E1_T1 Layer 1 status: No multiframe synchronization E1_T1 Layer 1 status: No multiframe synchronization SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 135
1166 5.9.0 E1/T1 Status INFO 1166 6.0.5 None INFO 1166 6.2.0 E1/T1 Status INFO 1167 5.9.0 E1/T1 Status INFO 1167 6.0.5 None INFO E1_T1 Layer 1 status: Remote alarm detected E1_T1 Layer 1 status: Remote alarm detected E1_T1 Layer 1 status: Remote alarm detected E1_T1 Layer 1 status: Controlled slip E1_T1 Layer 1 status: Controlled slip 1167 6.2.0 E1/T1 Status INFO E1_T1 Layer 1 status: Controlled slip 1168 5.9.0 E1/T1 Status INFO E1_T1 Layer 1 status: OK 1168 6.0.5 None INFO E1_T1 Layer 1 status: OK 1168 6.2.0 E1/T1 Status INFO E1_T1 Layer 1 status: OK 1169 5.9.0 Bandwidth Optimization INFO 1169 6.0.5 Unused DEBUG 1169 6.2.0 1170 5.9.0 Bandwidth Optimization INFO Bandwidth Optimization ALERT 1170 6.0.5 Unused DEBUG 1170 6.2.0 1171 5.9.0 Bandwidth Optimization ALERT Bandwidth Optimization ALERT 1171 6.0.5 Unused DEBUG 1171 6.2.0 1172 5.9.0 Bandwidth Optimization ALERT Bandwidth Optimization ALERT 1172 6.0.5 Unused DEBUG 1172 6.2.0 Bandwidth Optimization ALERT WAN Acceleration device %s found WAN Acceleration device %s found WAN Acceleration device %s found WAN Acceleration device %s is operational WAN Acceleration device %s is operational WAN Acceleration device %s is operational WAN Acceleration device %s is no longer operational WAN Acceleration device %s is no longer operational WAN Acceleration device %s is no longer operational WAN Acceleration device %s is being used WAN Acceleration device %s is being used WAN Acceleration device %s is being used 136
1173 5.9.0 Bandwidth Optimization ALERT 1173 6.0.5 Unused DEBUG 1173 6.2.0 1174 5.9.0 Bandwidth Optimization ALERT Bandwidth Optimization WARNING 1174 6.0.5 Unused DEBUG 1174 6.2.0 1175 5.9.0 Bandwidth Optimization WARNING Bandwidth Optimization WARNING 1175 6.0.5 Unused DEBUG 1175 6.2.0 1176 5.9.0 Bandwidth Optimization WARNING Bandwidth Optimization WARNING 1176 6.0.5 Unused DEBUG 1176 6.2.0 Bandwidth Optimization WARNING 1177 5.9.0 Debug Network Access ALERT 1177 6.0.5 Debug Network Access ALERT 1177 6.2.0 Debug Network Access ALERT 1178 5.9.0 User Activity CIA ALERT WAN Acceleration device %s is no longer being used WAN Acceleration device %s is no longer being used WAN Acceleration device %s is no longer being used Remote WAN Acceleration device stopped responding to probes Remote WAN Acceleration device stopped responding to probes Remote WAN Acceleration device stopped responding to probes Remote WAN Acceleration device started responding to probes Remote WAN Acceleration device started responding to probes Remote WAN Acceleration device started responding to probes Your WAN Acceleration Service subscription has expired. Your WAN Acceleration Service subscription has expired. Your WAN Acceleration Service subscription has expired. Malformed DNS packet detected Malformed DNS packet detected Malformed DNS packet detected A high percentage of the system packet buffers are held waiting for SSO SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 137
1178 6.0.5 User Activity CIA ALERT 1178 6.2.0 User Activity CIA ALERT 1179 5.9.0 User Activity CIA ALERT 1179 6.0.5 User Activity CIA ALERT A high percentage of the system packet buffers are held waiting for SSO A high percentage of the system packet buffers are held waiting for SSO A user has a very high number of connections waiting for SSO A user has a very high number of connections waiting for SSO 1179 6.2.0 User Activity CIA ALERT A user has a very high number of connections waiting for SSO 1183 5.9.0 VPN IKE DEBUG Deleting IPsec SA. (Phase 2) 1183 6.0.5 VPN IKE DEBUG Deleting IPsec SA. (Phase 2) 1183 6.2.0 VPN IKE DEBUG Deleting IPsec SA. (Phase 2) 1184 5.9.0 DHCP Server WARNING 1184 6.0.5 DHCP Server WARNING Delete invalid scope because port IP in the range of this DHCP scope. Delete invalid scope because port IP in the range of this DHCP scope. 1184 6.2.0 DHCP Server WARNING Delete invalid scope because port IP in the range of this DHCP scope. 1185 5.9.0 DSL ALERT DSL: %s Device Up 1185 6.0.5 DSL ALERT DSL: %s Device Up 1185 6.2.0 DSL ALERT DSL: %s Device Up 1186 5.9.0 DSL ALERT DSL: %s Device Down 1186 6.0.5 DSL ALERT DSL: %s Device Down 1186 6.2.0 DSL ALERT DSL: %s Device Down 1187 5.9.0 DSL ALERT DSL: %s WAN is connected 1187 6.0.5 DSL ALERT DSL: %s WAN is connected 1187 6.2.0 DSL ALERT DSL: %s WAN is connected 1188 5.9.0 DSL ALERT DSL: %s WAN is initializing 1188 6.0.5 DSL ALERT DSL: %s WAN is initializing 1188 6.2.0 DSL ALERT DSL: %s WAN is initializing 1189 5.9.0 VPN IKE WARNING IKE Responder: Peer's proposed network does not match VPN Policy's Network 138
1189 6.0.5 VPN IKE WARNING 1189 6.2.0 VPN IKE WARNING 1190 5.9.0 RADIUS INFO 1190 6.0.5 RADIUS INFO 1190 6.2.0 RADIUS INFO 1191 5.9.0 RADIUS INFO 1191 6.0.5 RADIUS INFO 1191 6.2.0 RADIUS INFO 1192 5.9.0 RADIUS INFO 1192 6.0.5 RADIUS INFO 1192 6.2.0 RADIUS INFO 1193 5.9.0 RADIUS INFO 1193 6.0.5 RADIUS INFO 1193 6.2.0 RADIUS INFO 1194 5.9.0 High Availability ERROR 1194 6.0.5 High Availability ERROR 1194 6.2.0 High Availability ERROR 1195 5.9.0 Security Services Security Services WARNING IKE Responder: Peer's proposed network does not match VPN Policy's Network IKE Responder: Peer's proposed network does not match VPN Policy's Network Added new LDAP mirror user group: %s Added new LDAP mirror user group: %s Added new LDAP mirror user group: %s Deleted LDAP mirror user group: %s Deleted LDAP mirror user group: %s Deleted LDAP mirror user group: %s Added a new member to an LDAP mirror user group Added a new member to an LDAP mirror user group Added a new member to an LDAP mirror user group Removed a member from an LDAP mirror user group Removed a member from an LDAP mirror user group Removed a member from an LDAP mirror user group Monitoring probe out interface mismatch %s Monitoring probe out interface mismatch %s Monitoring probe out interface mismatch %s Received Alert: Your Firewall Botnet Filter subscription has expired. SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 139
1195 6.0.5 1195 6.2.0 Security Services Security Services WARNING Security Services Security Services WARNING 1196 5.9.0 Maintenance Firewall Event ALERT 1196 6.0.5 Maintenance Firewall Event ALERT Received Alert: Your Firewall Botnet Filter subscription has expired. Received Alert: Your Firewall Botnet Filter subscription has expired. Product maximum entries reached %s Product maximum entries reached %s 1196 6.2.0 Maintenance Firewall Event ALERT Product maximum entries reached %s 1197 5.9.0 Network Access NOTICE Nat Mapping 1197 6.0.5 Network Access NOTICE Nat Mapping 1197 6.2.0 Network Access NOTICE Nat Mapping 1198 5.9.0 GeoIP ALERT 1198 6.0.5 GeoIP ALERT 1198 6.2.0 GeoIP ALERT 1199 5.9.0 GeoIP ALERT 1199 6.0.5 GeoIP ALERT 1199 6.2.0 GeoIP ALERT 1200 5.9.0 Botnet ALERT 1200 6.0.5 Botnet ALERT 1200 6.2.0 Botnet ALERT 1201 5.9.0 Botnet ALERT 1201 6.0.5 Botnet ALERT 1201 6.2.0 Botnet ALERT Initiator from country blocked: %s Initiator from country blocked: %s Initiator from country blocked: %s Responder from country blocked: %s Responder from country blocked: %s Responder from country blocked: %s Suspected Botnet initiator blocked: %s Suspected Botnet initiator blocked: %s Suspected Botnet initiator blocked: %s Suspected Botnet responder blocked: %s Suspected Botnet responder blocked: %s Suspected Botnet responder blocked: %s 140
1202 5.9.0 User Activity 1202 6.0.5 User Activity 1202 6.2.0 User Activity 1203 5.9.0 User Activity 1203 6.0.5 User Activity 1203 6.2.0 User Activity 1204 5.9.0 User Activity 1204 6.0.5 User Activity 1204 6.2.0 User Activity %s %s %s Access WARNING %s Access WARNING %s Access WARNING %s Access ERROR %s Access ERROR %s Access ERROR %s 1205 5.9.0 System Error High Availability ALERT 1205 6.0.5 System Error High Availability ALERT 1205 6.2.0 System Error High Availability ALERT 1206 5.9.0 System Error High Availability ALERT 1206 6.0.5 System Error High Availability ALERT 1206 6.2.0 System Error High Availability ALERT 1207 5.9.0 Maintenance High Availability INFO 1207 6.0.5 Maintenance High Availability INFO On HA peer firewall, Interface %s Link Is Up On HA peer firewall, Interface %s Link Is Up On HA peer firewall, Interface %s Link Is Up On HA peer firewall, Interface %s Link Is Down On HA peer firewall, Interface %s Link Is Down On HA peer firewall, Interface %s Link Is Down Peer firewall has reduced link status. In event of failover, it will operate with limited capability. Peer firewall has reduced link status. In event of failover, it will operate with limited capability. SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 141
1207 6.2.0 Maintenance High Availability INFO 1208 5.9.0 Maintenance High Availability INFO 1208 6.0.5 Maintenance High Availability INFO 1208 6.2.0 Maintenance High Availability INFO 1209 5.9.0 Attack MacIP Spoof ALERT 1209 6.0.5 Attack MacIP Spoof ALERT 1209 6.2.0 Attack MacIP Spoof ALERT 1210 5.9.0 Attack MacIP Spoof ALERT 1210 6.0.5 Attack MacIP Spoof ALERT 1210 6.2.0 Attack MacIP Spoof ALERT 1211 5.9.0 Attack MacIP Spoof ALERT 1211 6.0.5 Attack MacIP Spoof ALERT 1211 6.2.0 Attack MacIP Spoof ALERT 1212 5.9.0 Attack MacIP Spoof ALERT 1212 6.0.5 Attack MacIP Spoof ALERT 1212 6.2.0 Attack MacIP Spoof ALERT Peer firewall has reduced link status. In event of failover, it will operate with limited capability. Peer firewall has equivalent link status. In event of failover, it will operate with equal capability. Peer firewall has equivalent link status. In event of failover, it will operate with equal capability. Peer firewall has equivalent link status. In event of failover, it will operate with equal capability. MAC IP Anti spoof check enforced for hosts MAC IP Anti spoof check enforced for hosts MAC IP Anti spoof check enforced for hosts MAC IP Anti spoof cache not found for this router MAC IP Anti spoof cache not found for this router MAC IP Anti spoof cache not found for this router MAC IP Anti spoof cache found, but it is not a router MAC IP Anti spoof cache found, but it is not a router MAC IP Anti spoof cache found, but it is not a router MAC IP Anti spoof cache found, but it is blacklisted device MAC IP Anti spoof cache found, but it is blacklisted device MAC IP Anti spoof cache found, but it is blacklisted device 142
1213 5.9.0 Attack 1213 6.0.5 Attack 1213 6.2.0 Attack 1214 5.9.0 Attack 1214 6.0.5 Attack 1214 6.2.0 Attack ALERT ALERT ALERT ALERT ALERT ALERT 1215 5.9.0 Debug DHCP Relay INFO 1215 6.0.5 Debug DHCP Relay INFO Possible UDP flood attack detected Possible UDP flood attack detected Possible UDP flood attack detected Possible ICMP flood attack detected Possible ICMP flood attack detected Possible ICMP flood attack detected DHCP INFORM received from remote device DHCP INFORM received from remote device 1215 6.2.0 Debug DHCP Relay INFO DHCP INFORM received from remote device 1216 5.9.0 DEBUG IP Pool of the VPN Policy is Full 1216 6.0.5 DEBUG IP Pool of the VPN Policy is Full 1216 6.2.0 DEBUG IP Pool of the VPN Policy is Full 1217 5.9.0 DEBUG 1217 6.0.5 DEBUG 1217 6.2.0 DEBUG 1218 5.9.0 INFO 1218 6.0.5 INFO 1218 6.2.0 INFO IP Pool of the VPN Policy is Not Configured IP Pool of the VPN Policy is Not Configured IP Pool of the VPN Policy is Not Configured MOBIKE: Update Peer Gateway IP MOBIKE: Update Peer Gateway IP MOBIKE: Update Peer Gateway IP 1219 5.9.0 INFO IP Address is allocated for Client 1219 6.0.5 INFO IP Address is allocated for Client 1219 6.2.0 INFO IP Address is allocated for Client 1220 5.9.0 WARNING Invalid SNMP packet 1220 6.0.5 WARNING Invalid SNMP packet 1220 6.2.0 WARNING Invalid SNMP packet SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 143
1221 5.9.0 WARNING Invalid SNMPv3 engineid 1221 6.0.5 WARNING Invalid SNMPv3 engineid 1221 6.2.0 WARNING Invalid SNMPv3 engineid 1222 5.9.0 WARNING Invalid SNMPv3 User 1222 6.0.5 WARNING Invalid SNMPv3 User 1222 6.2.0 WARNING Invalid SNMPv3 User 1223 5.9.0 WARNING Invalid SNMPv3 Time Window 1223 6.0.5 WARNING Invalid SNMPv3 Time Window 1223 6.2.0 WARNING Invalid SNMPv3 Time Window 1225 5.9.0 INFO SNMP Packet Dropped 1225 6.0.5 INFO SNMP Packet Dropped 1225 6.2.0 INFO SNMP Packet Dropped 1226 5.9.0 INFO HTTPS Handshake: %s 1226 6.0.5 INFO HTTPS Handshake: %s 1226 6.2.0 INFO HTTPS Handshake: %s 1227 5.9.0 User Activity INFO Guest traffic quota exceeded 1227 6.0.5 User Activity INFO Guest traffic quota exceeded 1227 6.2.0 User Activity INFO Guest traffic quota exceeded 1229 5.9.0 1229 6.0.5 1229 6.2.0 TCP UDP ICMP WARNING TCP UDP ICMP WARNING TCP UDP ICMP WARNING 1230 5.9.0 UDP NOTICE 1230 6.0.5 UDP NOTICE 1230 6.2.0 UDP NOTICE 1231 5.9.0 UDP NOTICE 1231 6.0.5 UDP NOTICE Packet dropped by wireless Advanced IDP Packet dropped by wireless Advanced IDP Packet dropped by wireless Advanced IDP Failed on updating time from NTP server Failed on updating time from NTP server Failed on updating time from NTP server Time update from NTP server was successful Succeed in updating time from NTP server 1231 6.2.0 UDP NOTICE Time update from NTP server was successful 1232 5.9.0 UDP NOTICE NTP Request sent 1232 6.0.5 UDP NOTICE NTP Request sent 144
1232 6.2.0 UDP NOTICE NTP Request sent 1233 5.9.0 Debug NOTICE 1233 6.0.5 Debug ALERT Unhandled link local or multicast IPv6 packet dropped Unhandled link local or multicast IPv6 packet dropped 1233 6.2.0 Debug NOTICE Unhandled link local or multicast IPv6 packet dropped 1235 5.9.0 Network INFO Packet allowed by Access Rules 1235 6.0.5 Network INFO Packet allowed 1235 6.2.0 Network INFO Packet allowed: %s 1236 5.9.0 Security Services DEBUG 1236 6.0.5 Security Services DEBUG Received Blacklisted Directive from %s Received Blacklisted Directive from %s 1236 6.2.0 Security Services DEBUG Received Blacklisted Directive from %s 1237 5.9.0 Security Services DEBUG Not Blacklisted by domain %s 1237 6.0.5 Security Services DEBUG Not Blacklisted by domain %s 1237 6.2.0 Security Services DEBUG Not Blacklisted by domain %s 1238 5.9.0 Security Services DEBUG 1238 6.0.5 Security Services DEBUG 1238 6.2.0 Security Services DEBUG 1239 5.9.0 Security Services DEBUG 1239 6.0.5 Security Services DEBUG No DNS response to domain %s No DNS response to domain %s No DNS response to domain %s RBL DNS server responded with error code %s RBL DNS server responded with error code %s 1239 6.2.0 Security Services DEBUG RBL DNS server responded with error code %s 1240 5.9.0 INFO %s 1240 6.0.5 INFO %s 1240 6.2.0 INFO %s 1241 5.9.0 WARNING %s 1241 6.0.5 WARNING %s 1241 6.2.0 WARNING %s 1242 5.9.0 WARNING %s SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 145
1242 6.0.5 WARNING %s 1242 6.2.0 WARNING %s 1243 5.9.0 User Activity 1243 6.0.5 User Activity 1243 6.2.0 User Activity 1244 5.9.0 RADIUS WARNING 1244 6.0.5 RADIUS WARNING 1244 6.2.0 RADIUS WARNING 1245 5.9.0 RADIUS WARNING 1245 6.0.5 RADIUS WARNING 1245 6.2.0 RADIUS WARNING 1246 5.9.0 RADIUS WARNING 1246 6.0.5 RADIUS WARNING 1246 6.2.0 RADIUS WARNING 1247 5.9.0 Firewall Hardware ALERT 17001 1247 6.0.5 Firewall Hardware ALERT 17001 User login Failed An error has occurred while sending your one time password User login Failed An error has occurred while sending your one time password User login Failed An error has occurred while sending your one time password Failed to add an LDAP mirror user group Failed to add an LDAP mirror user group Failed to add an LDAP mirror user group Failed to add a member to an LDAP mirror user group Failed to add a member to an LDAP mirror user group Failed to add a member to an LDAP mirror user group An LDAP user group nesting is not being mirrored An LDAP user group nesting is not being mirrored An LDAP user group nesting is not being mirrored Physical interface utilization is greater than 80% of the maximum rated tolerance(for the interface)for more than 10 seconds. Physical interface utilization is greater than 80% of the maximum rated tolerance(for the interface)for more than 10 seconds. 146
1247 6.2.0 Firewall Hardware ALERT 17001 1248 5.9.0 Firewall Hardware ALERT 17002 1248 6.0.5 Firewall Hardware ALERT 17002 1248 6.2.0 Firewall Hardware ALERT 17002 1249 5.9.0 Firewall Hardware ALERT 17003 1249 6.0.5 Firewall Hardware ALERT 17003 1249 6.2.0 Firewall Hardware ALERT 17003 1250 5.9.0 Firewall Hardware ALERT 17004 1250 6.0.5 Firewall Hardware ALERT 17004 1250 6.2.0 Firewall Hardware ALERT 17004 1251 5.9.0 Firewall Hardware ALERT 17005 1251 6.0.5 Firewall Hardware ALERT 17005 1251 6.2.0 Firewall Hardware ALERT 17005 Physical interface utilization is greater than 80% of the maximum rated tolerance(for the interface)for more than 10 seconds. CPU reaches 80% utilization for more than 10 seconds. CPU reaches 80% utilization for more than 10 seconds. CPU reaches 80% utilization for more than 10 seconds. Current session count is more than 50% of the supported maximum. Current session count is more than 50% of the supported maximum. Current session count is more than 50% of the supported maximum. Current dynamic NAT translation count is more than 50% of the configured maximum. Total firewall throughput is greater than 50% of the maximum rated tolerance for more than 10 seconds. Current dynamic NAT translation count is more than 50% of the configured maximum. Total firewall throughput is greater than 50% of the maximum rated tolerance for more than 10 seconds. Current dynamic NAT translation count is more than 50% of the configured maximum. Total firewall throughput is greater than 50% of the maximum rated tolerance for more than 10 seconds. SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 147
1252 5.9.0 VPN IKE INFO 1252 6.0.5 VPN IKE INFO IPv6 VPN only support IKEv2 mode IPv6 VPN only support IKEv2 mode 1252 6.2.0 VPN IKE INFO IPv6 VPN only support IKEv2 mode 1253 5.9.0 VPN IKE NOTICE IPv6 Tunnel packet dropped 1253 6.0.5 VPN IKE NOTICE IPv6 Tunnel packet dropped 1253 6.2.0 VPN IKE NOTICE IPv6 Tunnel packet dropped 1254 5.9.0 Network NOTICE 1254 6.0.5 Network NOTICE 1254 6.2.0 Network NOTICE 1255 5.9.0 Network INFO 1255 6.0.5 Network INFO ICMPv6 packet from LAN dropped ICMPv6 packet from LAN dropped ICMPv6 packet from LAN dropped ICMPv6 packet from LAN allowed ICMPv6 packet from LAN allowed 1255 6.2.0 Network INFO ICMPv6 packet from LAN allowed 1256 5.9.0 Network INFO ICMPv6 packet allowed 1256 6.0.5 Network INFO ICMPv6 packet allowed 1256 6.2.0 Network INFO ICMPv6 packet allowed 1257 5.9.0 Network NOTICE 1257 6.0.5 Network NOTICE ICMPv6 packet dropped due to policy ICMPv6 packet dropped due to policy 1257 6.2.0 Network NOTICE ICMPv6 packet dropped due to policy 1258 5.9.0 DEBUG %s 1258 6.0.5 DEBUG %s 1258 6.2.0 DEBUG %s 1259 5.9.0 DHCP Server WARNING 1259 6.0.5 DHCP Server WARNING 1259 6.2.0 DHCP Server WARNING DHCPv6 lease file in the storage is corrupted; read failed DHCPv6 lease file in the storage is corrupted; read failed DHCPv6 lease file in the storage is corrupted; read failed 148
1260 5.9.0 DHCP Server WARNING 1260 6.0.5 DHCP Server WARNING 1260 6.2.0 DHCP Server WARNING 1261 5.9.0 DHCP Server INFO 1261 6.0.5 DHCP Server INFO Failed to write DHCPv6 leases to storage Failed to write DHCPv6 leases to storage Failed to write DHCPv6 leases to storage DHCPv6 leases written to storage DHCPv6 leases written to storage 1261 6.2.0 DHCP Server INFO DHCPv6 leases written to storage 1262 5.9.0 Network Access DEBUG YouTube for school enforced 1262 6.0.5 Network Access DEBUG YouTube for school enforced 1262 6.2.0 Network Access DEBUG YouTube for school enforced 1263 5.9.0 Maintenance AppServerEvent INFO AppFlow Server Event 1263 6.0.5 Unused INFO Appflow Server Event 1263 6.2.0 Unused INFO Appflow Server Event 1264 5.9.0 1264 6.0.5 1264 6.2.0 Bandwidth Optimization WARNING Bandwidth Optimization WARNING Bandwidth Optimization WARNING 1265 5.9.0 Firewall Event WARNING 1265 6.0.5 Firewall Event WARNING 1265 6.2.0 Firewall Event WARNING 1266 5.9.0 Firewall Event INFO 1266 6.0.5 Firewall Event INFO 1266 6.2.0 Firewall Event INFO WLAN HTTP traffic not being sent to WXA WebCache; zone conflict WLAN HTTP traffic not being sent to WXA WebCache; zone conflict WLAN HTTP traffic not being sent to WXA WebCache; zone conflict SonicPoint association request to License Manager failed: %s SonicPoint association request to License Manager failed: %s SonicPoint association request to License Manager failed: %s SonicPoint association posted successfully to License Manager SonicPoint association posted successfully to License Manager SonicPoint association posted successfully to License Manager SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 149
1267 5.9.0 User Activity VPN IKE DEBUG %s 1267 6.0.5 User Activity VPN IKE DEBUG %s 1267 6.2.0 User Activity VPN IKE DEBUG %s Firewall Settings 1268 5.9.0 Firewall Event NOTICE Firmware Update Failed 1268 6.0.5 NOTICE Firmware Update Failed 1268 6.2.0 Firewall Settings Firewall Event NOTICE Firmware Update Failed Firewall Settings 1269 5.9.0 Firewall Event NOTICE Firmware Update Success 1269 6.0.5 NOTICE Firmware Update Success 1269 6.2.0 Firewall Settings Firewall Event NOTICE Firmware Update Success 1270 5.9.0 Maintenance INFO Crypto DH test success 1270 6.0.5 Maintenance INFO Crypto DH test success 1270 6.2.0 Maintenance INFO Crypto DH test success 1271 5.9.0 Maintenance INFO Crypto Hmac MD5 test success 1271 6.0.5 Maintenance INFO Crypto Hmac MD5 test success 1271 6.2.0 Maintenance INFO Crypto Hmac MD5 test success 1272 5.9.0 Maintenance INFO 1272 6.0.5 Maintenance INFO Crypto hardware DES test success Crypto hardware DES test success 1272 6.2.0 Maintenance INFO Crypto hardware DES test success 1273 5.9.0 Maintenance INFO Crypto MD5 test success 1273 6.0.5 Maintenance INFO Crypto MD5 test success 1273 6.2.0 Maintenance INFO Crypto MD5 test success 1274 5.9.0 INFO 1274 6.0.5 INFO Crypto SHA1 based DRNG KAT test success Crypto SHA1 based DRNG KAT test success 1274 6.2.0 INFO Crypto SHA1 based DRNG KAT test success 1275 5.9.0 Maintenance INFO Crypto Hmac Sha1 test success 1275 6.0.5 Maintenance INFO Crypto Hmac Sha1 test success 1275 6.2.0 Maintenance INFO Crypto Hmac Sha1 test success 150
1276 5.9.0 Maintenance INFO 1276 6.0.5 Maintenance INFO Crypto hardware 3DES test success Crypto hardware 3DES test success 1276 6.2.0 Maintenance INFO Crypto hardware 3DES test success 1277 5.9.0 Maintenance INFO Crypto DES test success 1277 6.0.5 Maintenance INFO Crypto DES test success 1277 6.2.0 Maintenance INFO Crypto DES test success 1278 5.9.0 Maintenance ERROR Crypto AES test failed 1278 6.0.5 Maintenance ERROR Crypto AES test failed 1278 6.2.0 Maintenance ERROR Crypto AES test failed 1279 5.9.0 Maintenance INFO Crypto AES test success 1279 6.0.5 Maintenance INFO Crypto AES test success 1279 6.2.0 Maintenance INFO Crypto AES test success 1280 5.9.0 Maintenance INFO Crypto DRBG test success 1280 6.0.5 Maintenance INFO Crypto DRBG test success 1280 6.2.0 Maintenance INFO Crypto DRBG test success 1281 5.9.0 Maintenance ERROR Crypto DRBG test failed 1281 6.0.5 Maintenance ERROR Crypto DRBG test failed 1281 6.2.0 Maintenance ERROR Crypto DRBG test failed 1282 5.9.0 Maintenance INFO 1282 6.0.5 Maintenance INFO Crypto Hmac Sha256 test success Crypto Hmac Sha256 test success 1282 6.2.0 Maintenance INFO Crypto Hmac Sha256 test success 1283 5.9.0 Maintenance ERROR Crypto Hmac Sha256 test failed 1283 6.0.5 Maintenance ERROR Crypto Hmac Sha256 test failed 1283 6.2.0 Maintenance ERROR Crypto Hmac Sha256 test failed 1284 5.9.0 Maintenance INFO Crypto RSA test success 1284 6.0.5 Maintenance INFO Crypto RSA test success 1284 6.2.0 Maintenance INFO Crypto RSA test success 1285 5.9.0 Maintenance INFO Crypto Sha1 test success 1285 6.0.5 Maintenance INFO Crypto Sha1 test success 1285 6.2.0 Maintenance INFO Crypto Sha1 test success 1286 5.9.0 Maintenance INFO Crypto Sha256 test success 1286 6.0.5 Maintenance INFO Crypto Sha256 test success SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 151
1286 6.2.0 Maintenance INFO Crypto Sha256 test success 1287 5.9.0 Maintenance ERROR Crypto Sha256 test failed 1287 6.0.5 Maintenance ERROR Crypto Sha256 test failed 1287 6.2.0 Maintenance ERROR Crypto Sha256 test failed 1288 5.9.0 Maintenance INFO 1288 6.0.5 Maintenance INFO 1288 6.2.0 Maintenance INFO 1289 5.9.0 Maintenance INFO 1289 6.0.5 Maintenance INFO 1289 6.2.0 Maintenance INFO 1290 5.9.0 Maintenance INFO 1290 6.0.5 Maintenance INFO 1290 6.2.0 Maintenance INFO 1299 5.9.0 Maintenance ALERT 1299 6.0.5 Maintenance ALERT 1299 6.2.0 Maintenance ALERT 1300 5.9.0 Maintenance ALERT 1300 6.0.5 Maintenance ALERT 1300 6.2.0 Maintenance ALERT 1301 5.9.0 Debug Network Access ALERT Crypto hardware AES test success Crypto hardware AES test success Crypto hardware AES test success Crypto hardware DES with SHA test success Crypto hardware DES with SHA test success Crypto hardware DES with SHA test success Crypto hardware 3DES with SHA test success Crypto hardware 3DES with SHA test success Crypto hardware 3DES with SHA test success Ndpp SelfTest write/read encrypt/decrypt successsfully Ndpp SelfTest write/read encrypt/decrypt successsfully Ndpp SelfTest write/read encrypt/decrypt successsfully Ndpp SelfTest write/read encrypt/decrypt failure Ndpp SelfTest write/read encrypt/decrypt failure Ndpp SelfTest write/read encrypt/decrypt failure Source or Destination IPv6 address is reserved by RFC 4291. Packet is dropped 152
1301 6.0.5 Debug Network Access ALERT 1301 6.2.0 Debug Network Access ALERT 1302 5.9.0 Debug Network Access ALERT 1302 6.0.5 Debug Network Access ALERT 1302 6.2.0 Debug Network Access ALERT 1303 5.9.0 Debug Network Access ALERT 1303 6.0.5 Debug Network Access ALERT 1303 6.2.0 Debug Network Access ALERT 1304 5.9.0 Debug Network Access ALERT 1304 6.0.5 Debug Network Access ALERT 1304 6.2.0 Debug Network Access ALERT 1305 5.9.0 User Activity VPN IKE WARNING 1305 6.0.5 User Activity VPN IKE WARNING 1305 6.2.0 User Activity VPN IKE WARNING 1306 5.9.0 User Activity VPN IKE WARNING 1306 6.0.5 User Activity VPN IKE WARNING Source or Destination IPv6 address is reserved by RFC 4291. Packet is dropped Source or Destination IPv6 address is reserved by RFC 4291. Packet is dropped Destination IPv6 address is unspecified. Packet is dropped Destination IPv6 address is unspecified. Packet is dropped Destination IPv6 address is unspecified. Packet is dropped Source IPv6 address is unspecified but this packet is not Neighbor Solicitation message for DAD. Packet is dropped Source IPv6 address is unspecified but this packet is not Neighbor Solicitation message for DAD. Packet is dropped Source IPv6 address is unspecified but this packet is not Neighbor Solicitation message for DAD. Packet is dropped Packet is dropped due to NDPP rules. Packet is dropped due to NDPP rules. Packet is dropped due to NDPP rules. IKE Responder : VPN Policy for IKE ID not found IKE Responder : VPN Policy for IKE ID not found IKE Responder : VPN Policy for IKE ID not found IKE Responder : VPN Policy for gateway address not found IKE Responder : VPN Policy for gateway address not found SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 153
1306 6.2.0 User Activity VPN IKE WARNING 1307 5.9.0 User Activity VPN IKE WARNING 1307 6.0.5 User Activity VPN IKE WARNING 1307 6.2.0 User Activity VPN IKE WARNING 1308 5.9.0 User Activity VPN IKE WARNING 1308 6.0.5 User Activity VPN IKE WARNING 1308 6.2.0 User Activity VPN IKE WARNING 1309 5.9.0 Firewall Event WARNING 1309 6.0.5 Firewall Event WARNING 1309 6.2.0 Firewall Event WARNING 1310 5.9.0 Firewall Event INFO 1310 6.0.5 Firewall Event INFO 1310 6.2.0 Firewall Event INFO 1311 5.9.0 DHCP Server ALERT 1311 6.0.5 DHCP Server ALERT 1311 6.2.0 DHCP Server ALERT 1312 5.9.0 VPN IKE INFO 1312 6.0.5 VPN IKE INFO IKE Responder : VPN Policy for gateway address not found IKE Initiator : VPN Policy for IKE ID not found IKE Initiator : VPN Policy for IKE ID not found IKE Initiator : VPN Policy for IKE ID not found IKE Initiator : VPN Policy for gateway address not found IKE Initiator : VPN Policy for gateway address not found IKE Initiator : VPN Policy for gateway address not found HA association request to License Manager failed: %s HA association request to License Manager failed: %s HA association request to License Manager failed: %s HA association posted successfully to License Manager HA association posted successfully to License Manager HA association posted successfully to License Manager DHCP Server: Resources of this pool ran out. Client Info: %s DHCP Server: Resources of this pool ran out. Client Info: %s DHCP Server: Resources of this pool ran out. Client Info: %s IKEv2: Peer's IP Version of Traffic Selector does not match with ours IKEv2: Peer's IP Version of Traffic Selector does not match with ours 154
1312 6.2.0 VPN IKE INFO IKEv2: Peer's IP Version of Traffic Selector does not match with ours 1313 5.9.0 INFO NAT policy added 1313 6.0.5 INFO NAT policy added 1313 6.2.0 INFO NAT policy added 1314 5.9.0 INFO NAT policy modified 1314 6.0.5 INFO NAT policy modified 1314 6.2.0 INFO NAT policy modified 1315 5.9.0 INFO NAT policy deleted 1315 6.0.5 INFO NAT policy deleted 1315 6.2.0 INFO NAT policy deleted 1316 5.9.0 Network ALERT 1316 6.0.5 Network ALERT Possible ARP attack from MAC address %s Possible ARP attack from MAC address %s 1316 6.2.0 Network ALERT Possible ARP attack from MAC address %s 1317 5.9.0 Firewall Hardware ALERT 5426 %s 1317 6.0.5 Firewall Hardware ALERT 5426 %s 1317 6.2.0 Firewall Hardware ALERT 5426 %s 1318 5.9.0 Firewall Hardware ALERT 5427 %s 1318 6.0.5 Firewall Hardware ALERT 5427 %s 1318 6.2.0 Firewall Hardware ALERT 5427 %s 1319 5.9.0 Firewall Hardware ALERT 5428 %s 1319 6.0.5 Firewall Hardware ALERT 5428 %s 1319 6.2.0 Firewall Hardware ALERT 5428 %s 1320 5.9.0 Firewall Hardware ALERT 5429 %s 1320 6.0.5 Firewall Hardware ALERT 5429 %s 1320 6.2.0 Firewall Hardware ALERT 5429 %s 1321 5.9.0 Firewall Hardware ALERT 5430 %s 1321 6.0.5 Firewall Hardware ALERT 5430 %s 1321 6.2.0 Firewall Hardware ALERT 5430 %s 1322 5.9.0 Firewall Hardware ALERT 5431 %s 1322 6.0.5 Firewall Hardware ALERT 5431 %s 1322 6.2.0 Firewall Hardware ALERT 5431 %s 1323 5.9.0 Firewall Hardware ALERT 5432 %s SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 155
1323 6.0.5 Firewall Hardware ALERT 5432 %s 1323 6.2.0 Firewall Hardware ALERT 5432 %s 1324 5.9.0 User Activity VPN IKE INFO 1324 6.0.5 User Activity VPN IKE INFO 1324 6.2.0 User Activity VPN IKE INFO 1325 5.9.0 User Activity VPN IKE INFO 1325 6.0.5 User Activity VPN IKE INFO 1325 6.2.0 User Activity VPN IKE INFO 1326 5.9.0 User Activity VPN IKE INFO 1326 6.0.5 User Activity VPN IKE INFO 1326 6.2.0 User Activity VPN IKE INFO 1327 5.9.0 User Activity VPN IKE INFO 1327 6.0.5 User Activity VPN IKE INFO IKEv2 Received Dead Peer Detection Request IKEv2 Received Dead Peer Detection Request IKEv2 Received Dead Peer Detection Request IKEv2 Received Dead Peer Detection Response IKEv2 Received Dead Peer Detection Response IKEv2 Received Dead Peer Detection Response IKEv2 Send Dead Peer Detection Request IKEv2 Send Dead Peer Detection Request IKEv2 Send Dead Peer Detection Request IKEv2 Send Dead Peer Detection Response IKEv2 Send Dead Peer Detection Response 1327 6.2.0 User Activity VPN IKE INFO IKEv2 Send Dead Peer Detection Response 1328 5.9.0 User Activity VPN IKE INFO IKEv2 Send Invalid SPI Request 1328 6.0.5 User Activity VPN IKE INFO IKEv2 Send Invalid SPI Request 1328 6.2.0 User Activity VPN IKE INFO IKEv2 Send Invalid SPI Request 1329 5.9.0 User Activity VPN IKE INFO 1329 6.0.5 User Activity VPN IKE INFO IKEv2 Received Invalid SPI Request IKEv2 Received Invalid SPI Request 1329 6.2.0 User Activity VPN IKE INFO IKEv2 Received Invalid SPI Request 1330 5.9.0 User Activity VPN IKE INFO IKEv2 Send Invalid SPI Response 1330 6.0.5 User Activity VPN IKE INFO IKEv2 Send Invalid SPI Response 1330 6.2.0 User Activity VPN IKE INFO IKEv2 Send Invalid SPI Response 156
1331 5.9.0 User Activity VPN IKE INFO 1331 6.0.5 User Activity VPN IKE INFO IKEv2 Received Invalid SPI Response IKEv2 Received Invalid SPI Response 1331 6.2.0 User Activity VPN IKE INFO IKEv2 Received Invalid SPI Response 1332 5.9.0 Maintenance Firewall Event ALERT NDPP mode is changed to %s 1332 6.0.5 Maintenance Firewall Event ALERT NDPP mode is changed to %s 1332 6.2.0 Maintenance Firewall Event ALERT NDPP mode is changed to %s 1333 5.9.0 User Activity 1333 6.0.5 User Activity 1333 6.2.0 User Activity 1334 5.9.0 User Activity 1334 6.0.5 User Activity 1334 6.2.0 User Activity 1335 5.9.0 User Activity 1335 6.0.5 User Activity 1335 6.2.0 User Activity 1336 5.9.0 1336 6.0.5 1336 6.2.0 1337 5.9.0 1337 6.0.5 1337 6.2.0 %s %s %s %s %s %s %s %s %s Firewall Settings Firewall Event INFO Certification %s Firewall Settings Firewall Event INFO Certification %s Firewall Settings Firewall Event INFO Certification %s Firewall Settings Firewall Event INFO %s Firewall Settings Firewall Event INFO %s Firewall Settings Firewall Event INFO %s SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 157
1338 5.9.0 1338 6.0.5 1338 6.2.0 1339 5.9.0 1339 6.0.5 1339 6.2.0 1340 5.9.0 1340 6.0.5 1340 6.2.0 1341 5.9.0 User Activity 1341 6.0.5 User Activity 1341 6.2.0 User Activity 1342 5.9.0 User Activity 1342 6.0.5 User Activity Firewall Settings Firewall Event INFO User %s password is changed Firewall Settings Firewall Event INFO User %s password is changed Firewall Settings Firewall Event INFO User %s password is changed Firewall Settings Firewall Event INFO Password rule %s is changed Firewall Settings Firewall Event INFO Password rule %s is changed Firewall Settings Firewall Event INFO Password rule %s is changed Firewall Settings Firewall Event INFO Firewall Settings Firewall Event INFO Firewall Settings Firewall Event INFO %s %s %s User Inactive timeout is changed to %s User Inactive timeout is changed to %s User Inactive timeout is changed to %s Update administrator/user lockout params %s Update administrator/user lockout params %s 1342 6.2.0 User Activity Update administrator/user lockout params %s 1343 5.9.0 User Activity VPN INFO VPN Policy %s 1343 6.0.5 User Activity VPN INFO VPN Policy %s 1343 6.2.0 User Activity VPN INFO VPN Policy %s 1344 5.9.0 System Error Firewall Event INFO %s 1344 6.0.5 System Error Firewall Event INFO %s 1344 6.2.0 System Error Firewall Event INFO %s 1345 5.9.0 Crypto Test INFO Crypto Sha384 test success 1345 6.0.5 Crypto Test INFO Crypto Sha384 test success 1345 6.2.0 Crypto Test INFO Crypto Sha384 test success 158
1346 5.9.0 Crypto Test ERROR Crypto Sha384 test failed 1346 6.0.5 Crypto Test ERROR Crypto Sha384 test failed 1346 6.2.0 Crypto Test ERROR Crypto Sha384 test failed 1347 5.9.0 Crypto Test INFO Crypto Sha512 test success 1347 6.0.5 Crypto Test INFO Crypto Sha512 test success 1347 6.2.0 Crypto Test INFO Crypto Sha512 test success 1348 5.9.0 Crypto Test ERROR Crypto Sha512 test failed 1348 6.0.5 Crypto Test ERROR Crypto Sha512 test failed 1348 6.2.0 Crypto Test ERROR Crypto Sha512 test failed 1349 5.9.0 Crypto Test INFO Crypto Ikev1 test success 1349 6.0.5 Crypto Test INFO Crypto Ikev1 test success 1349 6.2.0 Crypto Test INFO Crypto Ikev1 test success 1350 5.9.0 Crypto Test ERROR Crypto Ikev1 test failed 1350 6.0.5 Crypto Test ERROR Crypto Ikev1 test failed 1350 6.2.0 Crypto Test ERROR Crypto Ikev1 test failed 1351 5.9.0 Crypto Test INFO Crypto Ikev2 test success 1351 6.0.5 Crypto Test INFO Crypto Ikev2 test success 1351 6.2.0 Crypto Test INFO Crypto Ikev2 test success 1352 5.9.0 Crypto Test ERROR Crypto Ikev2 test failed 1352 6.0.5 Crypto Test ERROR Crypto Ikev2 test failed 1352 6.2.0 Crypto Test ERROR Crypto Ikev2 test failed 1353 5.9.0 Crypto Test INFO Crypto SSH test success 1353 6.0.5 Crypto Test INFO Crypto SSH test success 1353 6.2.0 Crypto Test INFO Crypto SSH test success 1354 5.9.0 Crypto Test ERROR Crypto SSH test failed 1354 6.0.5 Crypto Test ERROR Crypto SSH test failed 1354 6.2.0 Crypto Test ERROR Crypto SSH test failed 1355 5.9.0 Crypto Test INFO Crypto SNMP test success 1355 6.0.5 Crypto Test INFO Crypto SNMP test success 1355 6.2.0 Crypto Test INFO Crypto SNMP test success 1356 5.9.0 Crypto Test ERROR Crypto SNMP test failed 1356 6.0.5 Crypto Test ERROR Crypto SNMP test failed 1356 6.2.0 Crypto Test ERROR Crypto SNMP test failed 1357 5.9.0 Crypto Test INFO Crypto TLS 1.0/1.1 test success 1357 6.0.5 Crypto Test INFO Crypto TLS 1.0/1.1 test success 1357 6.2.0 Crypto Test INFO Crypto TLS 1.0/1.1 test success 1358 5.9.0 Crypto Test ERROR Crypto TLS 1.0/1.1 test failed SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 159
1358 6.0.5 Crypto Test ERROR Crypto TLS 1.0/1.1 test failed 1358 6.2.0 Crypto Test ERROR Crypto TLS 1.0/1.1 test failed 1359 5.9.0 Crypto Test INFO 1359 6.0.5 Crypto Test INFO Crypto Hmac Sha384 test success Crypto Hmac Sha384 test success 1359 6.2.0 Crypto Test INFO Crypto Hmac Sha384 test success 1360 5.9.0 Crypto Test ERROR Crypto Hmac Sha384 test failed 1360 6.0.5 Crypto Test ERROR Crypto Hmac Sha384 test failed 1360 6.2.0 Crypto Test ERROR Crypto Hmac Sha384 test failed 1361 5.9.0 Crypto Test INFO 1361 6.0.5 Crypto Test INFO Crypto Hmac Sha512 test success Crypto Hmac Sha512 test success 1361 6.2.0 Crypto Test INFO Crypto Hmac Sha512 test success 1362 5.9.0 Crypto Test ERROR Crypto Hmac Sha512 test failed 1362 6.0.5 Crypto Test ERROR Crypto Hmac Sha512 test failed 1362 6.2.0 Crypto Test ERROR Crypto Hmac Sha512 test failed 1363 5.9.0 1363 6.0.5 802.11b Management Wireless ALERT Wireless Flood Attack 802.11b Management Wireless ALERT Wireless Flood Attacking 1363 6.2.0 802.11b Management Wireless ALERT Wireless Flood Attack 1364 5.9.0 VPN PKI ALERT Cert Payload processing failed 1364 6.0.5 VPN PKI ALERT Cert Payload processing failed 1364 6.2.0 VPN PKI ALERT Cert Payload processing failed 1365 5.9.0 DPI SSL NOTICE DPI SSL: %s 1365 6.0.5 DPI SSL NOTICE DPI SSL: %s 1365 6.2.0 DPI SSL NOTICE DPI SSL: %s 1366 5.9.0 Attack 1366 6.0.5 Attack 1366 6.2.0 Attack ALERT ALERT ALERT TCP Flooding machine %s blacklisted TCP Flooding machine %s blacklisted TCP Flooding machine %s blacklisted 160
1367 5.9.0 Attack 1367 6.0.5 Attack 1367 6.2.0 Attack 1368 5.9.0 Attack 1368 6.0.5 Attack 1368 6.2.0 Attack 1369 5.9.0 Attack 1369 6.0.5 Attack 1369 6.2.0 Attack 1370 5.9.0 Attack 1370 6.0.5 Attack 1370 6.2.0 Attack 1371 5.9.0 Attack 1371 6.0.5 Attack 1371 6.2.0 Attack WARNING WARNING WARNING ALERT ALERT ALERT TCP Flood Blacklist on IF %s continues TCP Flood Blacklist on IF %s continues TCP Flood Blacklist on IF %s continues Machine %s removed from TCP flood blacklist Machine %s removed from TCP flood blacklist Machine %s removed from TCP flood blacklist ALERT Possible TCP Flood on IF %s ALERT Possible TCP Flood on IF %s ALERT Possible TCP Flood on IF %s ALERT ALERT ALERT WARNING WARNING WARNING 1372 5.9.0 RADIUS WARNING 1372 6.0.5 RADIUS WARNING 1372 6.2.0 RADIUS WARNING 1373 5.9.0 Attack ALERT Possible TCP Flood on IF %s has ceased Possible TCP Flood on IF %s has ceased Possible TCP Flood on IF %s has ceased Possible TCP Flood on IF %s continues Possible TCP Flood on IF %s continues Possible TCP Flood on IF %s continues LDAP mirroring overflow: too many user groups LDAP mirroring overflow: too many user groups LDAP mirroring overflow: too many user groups IPv6 fragment dropped, invalid length (<1280 Bytes) SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 161
1373 6.0.5 Attack 1373 6.2.0 Attack 1374 5.9.0 Attack 1374 6.0.5 Attack 1374 6.2.0 Attack 1375 5.9.0 Attack 1375 6.0.5 Attack 1375 6.2.0 Attack 1376 5.9.0 Attack 1376 6.0.5 Attack 1376 6.2.0 Attack ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT 1377 5.9.0 Anti Spam ALERT 1377 6.0.5 Anti Spam ALERT 1377 6.2.0 Anti Spam ALERT 1378 5.9.0 Anti Spam ALERT 1378 6.0.5 Anti Spam ALERT 1378 6.2.0 Anti Spam ALERT 1379 5.9.0 Bandwidth Optimization WARNING IPv6 fragment dropped, invalid length (<1280 Bytes) IPv6 fragment dropped, invalid length (<1280 Bytes) IGMP packet dropped, incomplete fragments IGMP packet dropped, incomplete fragments IGMP packet dropped, incomplete fragments UDP fragment dropped, exceeds maximum IP datagram size (>65535) UDP fragment dropped, exceeds maximum IP datagram size (>65535) UDP fragment dropped, exceeds maximum IP datagram size (>65535) Nestea/Teardrop attack dropped Nestea/Teardrop attack dropped Nestea/Teardrop attack dropped SHLO verification failed with this client IP %s SHLO verification failed with this client IP %s SHLO verification failed with this client IP %s Possible replay attack with this client IP %s Possible replay attack with this client IP %s Possible replay attack with this client IP %s WXA association request to License Manager failed: %s 162
1379 6.0.5 Unused WARNING 1379 6.2.0 1380 5.9.0 Bandwidth Optimization WARNING Bandwidth Optimization INFO 1380 6.0.5 Unused INFO 1380 6.2.0 Bandwidth Optimization INFO 1381 5.9.0 Security Services WARNING 15003 1381 6.0.5 Security Services WARNING 15003 WXA association request to License Manager failed: %s WXA association request to License Manager failed: %s WXA association posted successfully to License Manager WXA association posted successfully to License Manager WXA association posted successfully to License Manager Received App Control Alert: Your Application Control subscription has expired. Received App Control Alert: Your Application Control subscription has expired. 1381 6.2.0 Security Services WARNING 15003 Received App Control Alert: Your Application Control subscription has expired. 1382 5.9.0 User Activity Unused INFO 5609 Configuration succeeded: %s 1382 6.0.5 User Activity Unused INFO 5609 Configuration succeeded: %s 1382 6.2.0 User Activity Firewall Logging INFO 5609 Configuration succeeded: %s 1383 5.9.0 User Activity Unused INFO 5610 Configuration failed: %s 1383 6.0.5 User Activity Unused INFO 5610 Configuration failed: %s 1383 6.2.0 User Activity Firewall Logging INFO 5610 Configuration failed: %s 1384 5.9.0 Debug Network DEBUG 1384 6.0.5 Debug Unused DEBUG 1384 6.2.0 Debug Network DEBUG 1385 5.9.0 Debug Network DEBUG 1385 6.0.5 Debug Unused DEBUG TCP packet received with invalid Timestamps option length; TCP packet dropped TCP packet received with invalid Timestamps option length; TCP packet dropped TCP packet received with invalid Timestamps option length; TCP packet dropped TCP packet received with wrapped sequence number; TCP packet dropped TCP packet received with wrapped sequence number; TCP packet dropped SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 163
1385 6.2.0 Debug Network DEBUG 1387 5.9.0 Attack 1387 6.0.5 Attack TCP packet received with wrapped sequence number; TCP packet dropped ALERT TCP Null Flag dropped ALERT TCP Null Flag dropped 1387 6.2.0 Attack ALERT TCP Null Flag dropped 1388 5.9.0 Attack VPN IPsec ALERT IPSec VPN Decryption Failed 1388 6.0.5 Attack VPN IPsec ALERT IPSec VPN Decryption Failed 1388 6.2.0 Attack VPN IPsec ALERT IPSec VPN Decryption Failed 1389 5.9.0 Maintenance Security Services INFO 1389 6.0.5 Maintenance Unused INFO 1389 6.2.0 Maintenance Security Services INFO 1390 5.9.0 Maintenance Security Services INFO 1390 6.0.5 Maintenance Unused INFO Access attempt from host without Client CF agent installed Access attempt from host without Client CF agent installed Access attempt from host without Client CF agent installed Client CF agent out of date on host Client CF agent out of date on host 1390 6.2.0 Maintenance Security Services INFO Client CF agent out of date on host 1391 5.9.0 Attack Unused ALERT Packet Data 1391 6.0.5 Attack Unused ALERT Packet Data 1391 6.2.0 Attack Security Services ALERT Packet Data 1392 5.9.0 Maintenance Unused ALERT 5243 Blade up:%s 1392 6.0.5 Maintenance Firewall Event ALERT 5243 Blade up:%s 1392 6.2.0 Maintenance Unused ALERT 5243 Blade up:%s 1393 5.9.0 Maintenance Unused ALERT 5244 Blade down:%s 1393 6.0.5 Maintenance Firewall Event ALERT 5244 Blade down:%s 1393 6.2.0 Maintenance Unused ALERT 5244 Blade down:%s 1394 5.9.0 Bandwidth Optimization ERROR WXA Startup Failure %s 1394 6.0.5 Unused ERROR WXA Startup Failure %s 1394 6.2.0 Bandwidth Optimization ERROR WXA Startup Failure %s 164
Bandwidth Optimization 1395 5.9.0 WARNING WXA Get Failure %s 1395 6.0.5 Unused WARNING WXA Get Failure %s 1395 6.2.0 Bandwidth Optimization WARNING WXA Get Failure %s Bandwidth Optimization 1396 5.9.0 NOTICE WXA Parse Failure %s 1396 6.0.5 Unused NOTICE WXA Parse Failure %s 1396 6.2.0 Bandwidth Optimization NOTICE WXA Parse Failure %s Bandwidth Optimization 1397 5.9.0 NOTICE WXA Register Failure %s 1397 6.0.5 Unused NOTICE WXA Register Failure %s 1397 6.2.0 Bandwidth Optimization NOTICE WXA Register Failure %s Bandwidth Optimization 1398 5.9.0 NOTICE WXA Unregister Failure %s 1398 6.0.5 Unused NOTICE WXA Unregister Failure %s 1398 6.2.0 Bandwidth Optimization NOTICE WXA Unregister Failure %s Bandwidth Optimization 1399 5.9.0 NOTICE WXA Probe Failure %s 1399 6.0.5 Unused NOTICE WXA Probe Failure %s 1399 6.2.0 Bandwidth Optimization NOTICE WXA Probe Failure %s Bandwidth Optimization 1400 5.9.0 ALERT WXA Create Failure %s 1400 6.0.5 Unused ALERT WXA Create Failure %s 1400 6.2.0 Bandwidth Optimization ALERT WXA Create Failure %s Bandwidth Optimization 1401 5.9.0 WARNING WXA Set Failure %s 1401 6.0.5 Unused WARNING WXA Set Failure %s 1401 6.2.0 Bandwidth Optimization WARNING WXA Set Failure %s Bandwidth Optimization 1402 5.9.0 ERROR WXA Delete Failure %s 1402 6.0.5 Unused ERROR WXA Delete Failure %s SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 165
1402 6.2.0 Bandwidth Optimization ERROR WXA Delete Failure %s Bandwidth Optimization 1403 5.9.0 INFO WXA Enable %s 1403 6.0.5 Unused INFO WXA Enable %s 1403 6.2.0 Bandwidth Optimization INFO WXA Enable %s Bandwidth Optimization 1404 5.9.0 INFO WXA Disable %s 1404 6.0.5 Unused INFO WXA Disable %s 1404 6.2.0 Bandwidth Optimization INFO WXA Disable %s Bandwidth Optimization 1405 5.9.0 WARNING WXA Request Failure %s 1405 6.0.5 Unused WARNING WXA Request Failure %s 1405 6.2.0 1406 5.9.0 Unused INFO 1406 6.0.5 Unused INFO 1406 6.2.0 DHCP Client INFO 1407 5.9.0 Unused DEBUG 1407 6.0.5 Unused DEBUG 1407 6.2.0 DHCP Client DEBUG 1408 5.9.0 Unused DEBUG 1408 6.0.5 Unused DEBUG 1408 6.2.0 DHCP Client DEBUG 1409 5.9.0 Unused DEBUG 1409 6.0.5 Unused DEBUG Bandwidth Optimization WARNING WXA Request Failure %s General DHCPv6 Client Information [%s] General DHCPv6 Client Information [%s] General DHCPv6 Client Information [%s] DHCPv6 Client sent message [%s] DHCPv6 Client sent message [%s] DHCPv6 Client sent message [%s] DHCPv6 Client received message [%s] DHCPv6 Client received message [%s] DHCPv6 Client received message [%s] DHCPv6 Client Duplicate Address Detection [%s] DHCPv6 Client Duplicate Address Detection [%s] 166
1409 6.2.0 DHCP Client DEBUG 1410 5.9.0 Unused DEBUG 1410 6.0.5 Unused DEBUG DHCPv6 Client Duplicate Address Detection [%s] DHCPv6 Client waiting reply timeout [%s] DHCPv6 Client waiting reply timeout [%s] 1410 6.2.0 DHCP Client DEBUG DHCPv6 Client waiting reply timeout [%s] 1411 5.9.0 Unused DEBUG Router Advertisement flags [%s] 1411 6.0.5 Unused DEBUG Router Advertisement flags [%s] 1411 6.2.0 DHCP Client DEBUG Router Advertisement flags [%s] 1412 5.9.0 Unused INFO 1412 6.0.5 Unused INFO 1412 6.2.0 DHCP Client INFO 1413 5.9.0 Unused INFO 1413 6.0.5 Unused INFO 1413 6.2.0 DHCP Client INFO 1414 5.9.0 Unused INFO 1414 6.0.5 Unused INFO 1414 6.2.0 DHCP Server INFO 1415 5.9.0 Unused INFO 1415 6.0.5 Unused INFO 1415 6.2.0 DHCP Server INFO 1416 5.9.0 Unused INFO 1416 6.0.5 Unused INFO DHCPv6 Client got a new lease [%s] DHCPv6 Client got a new lease [%s] DHCPv6 Client got a new lease [%s] DHCPv6 Client released lease [%s] DHCPv6 Client released lease [%s] DHCPv6 Client released lease [%s] DHCPv6 Server assigned lease %s DHCPv6 Server assigned lease %s DHCPv6 Server assigned lease %s DHCPv6 Server released lease %s DHCPv6 Server released lease %s DHCPv6 Server released lease %s DHCPv6 Server received DHCPv6 Decline from client %s DHCPv6 Server received DHCPv6 Decline from client %s SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 167
1416 6.2.0 DHCP Server INFO 1417 5.9.0 Unused WARNING 1417 6.0.5 Unused WARNING 1417 6.2.0 DHCP Server WARNING 1418 5.9.0 Unused INFO 1418 6.0.5 Unused INFO 1418 6.2.0 DHCP Server INFO 1419 5.9.0 Unused INFO 1419 6.0.5 Unused INFO 1419 6.2.0 DHCP Server INFO 1420 5.9.0 Unused DEBUG 1420 6.0.5 Unused DEBUG 1420 6.2.0 DHCP Server DEBUG 1421 5.9.0 Unused DEBUG 1421 6.0.5 Unused DEBUG 1421 6.2.0 DHCP Server DEBUG 1422 5.9.0 Unused WARNING 1422 6.0.5 Unused WARNING 1422 6.2.0 Network WARNING DHCPv6 Server received DHCPv6 Decline from client %s DHCPv6 Server: Resources of this pool ran out. Client Info: %s DHCPv6 Server: Resources of this pool ran out. Client Info: %s DHCPv6 Server: Resources of this pool ran out. Client Info: %s DHCPv6 Server: Add a new scope (%s) DHCPv6 Server: Add a new scope (%s) DHCPv6 Server: Add a new scope (%s) DHCPv6 Server: Delete scope (%s) DHCPv6 Server: Delete scope (%s) DHCPv6 Server: Delete scope (%s) DHCPv6 Server received message (%s) DHCPv6 Server received message (%s) DHCPv6 Server received message (%s) DHCPv6 Server sent message (%s) DHCPv6 Server sent message (%s) DHCPv6 Server sent message (%s) IPv6 address conflict detected from Ethernet address %s IPv6 address conflict detected from Ethernet address %s IPv6 address conflict detected from Ethernet address %s 168
Log > Syslog In addition to the standard event log, the Dell SonicWALL security appliance can send a detailed log to an external Syslog server. The Dell SonicWALL Syslog captures all log activity and includes every connection source and destination IP address, IP service, and number of bytes transferred. Syslog Analyzers such as Dell SonicWALL ViewPoint, Analyzer, or WebTrends Firewall Suite can be used to sort, analyze, and graph the Syslog data. For more information on configuring the Log > Syslog page, refer to the SonicOS Administrator s Guide. SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 169
Index of Syslog Tag Field Descriptions This section provides an alphabetical listing of Syslog tags and the associated field description. For more information about the pri Syslog Tag, see Table 3: Priority Level on page 182. The value here is taken from the Priority Level column of the Index of Log Event Messages on page 2. For more information about the c Syslog Tag, see Legacy Category on page 178. Tag Tags for Arc- Sight Field Description <ddd> Syslog message prefix The beginning of each syslog message has a string of the form <ddd> where ddd is a decimal number indicating facility and priority of the message af_polid Application Filter Displays the Application Filter Policy ID af_policy Application Filter Displays the Application Policy name Displays the Application Policy type such as: SMTP Client Request HTTP Client Request HTTP Server Response FTP Client Request af_type Application Filter FTP Client Upload File FTP Client Download File POP3 Client Request POP3 Server Response FTP Data Transfer IPS Content App Control Content Custom Policy Type CFS af_service Application Filter Displays the Application Policy service name 170
Displays the Application Policy action such as HTTP Block Page HTTP Redirect Bandwidth Management af_action Application Filter Disable E-Mail Attachment FTP Notification Reply Reset/Drop Block SMTP E-Mail Bypass DPI CFS Block Page Packet Monitor af_object Application policy object name Displays the custom Application Policy object name ai Active Interface via GMS heartbeat Displays the Active WAN Interface. Normally it is Primary WAN but in a failover, it displays the value of the failover default outbound WAN interface, if there s more than one WAN. When there is only one WAN interface, it is always Primary WAN regardless of the link state app app Numeric application ID Indicates the application for the applied syslog. Only displays when Flow Reporting is enabled. appcat appcat Application Control Display the application category when Application Control is enabled appid appid Application ID Display the application ID when Application Control is enabled appname Non-Signature Application Name Indicates the non-signature Application Name that matches the Application ID app or f of the Syslog. arg arg URL Used to render a URL: arg represents the URL path name part bcastrx bcastrx Interface statistics report Displays the broadcast packets received bcasttx bcasttx Interface statistics report Displays the broadcast packets transmitted bytesrx bytesrx Interface statistics report Displays the bytes received SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 171
bytestx bytestx Interface statistics report Displays the bytes transmitted c cat Message category (legacy only) Indicates the legacy category number (Note: We are not currently sending new category information.) category category Blocking code description Applicable only when CFS is enabled, indicates the category of the blocked content such as Gambling. This works in conjunction with code Blocking code. catid Rule category Indicates the category ID of the rule cdur cn3label Connection Duration Displays the connection duration change SWGMSchangeUrl Configuration change webpage Displays the basename of the firewall web page that performed the last configuration change code reason Blocking code Indicates the CFS block code category icmpcode cn2 ICMP type and code Indicates the ICMP code conns Firewall status report via GMS heartbeat Indicates the number of connections in use contentobject Application Filter Indicates rule name cs4 Interface Statistics Display interface statistics deviceoutboundinterface Interface Indicates interface on which the packet leaves the device deviceinbound- Interface Interface Indicates interface on which the packet enters the device dpt Port Display destination port dnpt NAT ed Port Display NAT ed destination port dst dst Destination dstv6 dst Destination Destination IP address, and optionally, port, network interface, and resolved name. Destination IPv6 address, and optionally, port, network interface, and resolved name. 172
dstname request URL dstname dstname Notes Displays the URL of accessed Websites and hosts Indicates additional information such as description of forbidden/deleted email attachments dstzone cs4label (destination) Destination zone name Displays destination zone dur cs6label Numeric, session duration in seconds Indicates the duration in units of seconds that a session is connected dyn Firewall status report via GMS heartbeat Displays the HA and dialup connection state (rendered as h.d where h is n (not enabled), b (backup), or p (primary) and d is 1 (enabled) or 0 (disabled)) f flowtype Numeric flow type Indicates the flow type when Flow Reporting is disabled fw Firewall WAN IP Indicates the WAN IP Address fwlan Firewall status report via GMS heartbeat Indicates the LAN zone IP address gcat gcat Group category Display event group category when using Enhanced Syslog goodrx- Bytes goodrxbytes SonicPoint statistics report Indicates the well formed bytes received goodtx- Bytes goodtxbytes SonicPoint statistics report Indicates the well formed bytes transmitted i Firewall status report via GMS heartbeat Displays the GMS message interval in seconds id=firewall WebTrends prefix Syntactic sugar for WebTrends (and GMS by habit) if if Interface statistics report Displays the interface on which statistics are reported ipscat ipscat IPS message Displays the IPS category ipspri ipspri IPS message Displays the IPS priority lic Firewall status report via GMS heartbeat Indicates the number of licenses for firewalls with limited modes SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 173
m Message ID Provides the message ID number mac smac or dmac MAC address Provides the source or destination MAC address mailfrom Email sender Originator of the email msg msg Message n cnt Message count Displays the message which is composed of either or both a predefined message and a dynamic message containing a string %s or numeric %d argument Indicates the number of times event occurs natdst cs2label NAT destination IP Displays the NAT ed destination IP address natdstv6 cs2label NAT destination IPv6 Displays the NAT ed destination IPv6 address natsrc cs1label NAT source IP Displays the NAT ed source IP address natsrcv6 cs1label NAT source IPv6 note cs6 Additional Information npcs cs5 URL op requestmethod HTTP OP code Displays the NAT ed source IPv6 address Additional information that is application-dependent Applicable only when Network Packet Capture System (NPCS Solera) is enabled, displays URL of an NPCS object Displays the HTTP operation (GET, POST, etc.) of web site hit pri Message priority Displays the event priority level (0=emergency..7=debug) proto proto Protocol and service Displays the protocol information (rendered as proto=[protocol] or just [proto]/[service] ) pt Firewall status report via GMS heartbeat Displays the HTTP/HTTPS management port (rendered as hhh.sss ) radio radio SonicPoint statistics report Displays the SonicPoint radio on which event occurred rcptto recipient Indicates the email recipient 174
rcvd in Bytes received Indicates the number of bytes received within connection result outcome HTTP Result code Displays the HTTP result code (200, 403, etc.) of web site hit rpkt cn1label Packet received Display the number of packet received rule cs1 Rule ID sent out Bytes sent Displays the Access Rule number causing packet drop. The policy index includes Address Object names Displays the number of bytes sent within connection sess cs5label Pre-defined string indicating session type Applies to syslogs with an associated user session being tracked by the UTM sid sid IPS or Anti-Spyware message Provides either IPS or Anti-Spyware signature ID sn Firewall serial number Indicates the device serial number spkt cn2label Packet sent Display the number of packets sent spt Port Displays source port spycat spycat Anti-Spyware message Displays the Anti-Spyware category spypri spypri Anti-Spyware message Displays the Anti-Spyware priority snpt NAT source port Display NAT ed source port src src Source Indicates the source IP address, and optionally, port, network interface, and resolved name. srczone cs3label (source) Source zone name Displays source zone station station SonicPoint statistics report Displays the client (station) on which event occurred time Time Reports the time of event type cn1 ICMP type and code Indicates the ICMP type ucastrx ucastrx Interface statistics report Displays the unicast packets received SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 175
ucasttx ucasttx Interface statistics report Displays the unicast packets transmitted unsynched Firewall status report via GMS heartbeat Reports the time since last local change in seconds usestandbysa Firewall status report via GMS heartbeat Displays whether standby SA is in use ( 1 or 0 ) for GMS management usr (or user) susr User Displays the user name ( user is the tag used by WebTrends) vpnpolicy cs2 (source) Source VPN policy name Displays the source VPN policy name of event vpnpolicydst cs3 (destination) Destination VPN policy name Displays the destination VPN policy name of event Examples of Standard Syslogs The following examples show the content of the Syslog packet. This type of message can be viewed on the Syslog server or any packet analyzer application. Note that this is the Default Syslog Format. id=firewall123 sn=0017c5991784 time="2013-03-20 11:56:53" fw=10.0.203.108 pri=6 c=1024 m=97 n=1 src=1.2.3.4:5432:x0 dst=4.3.2.1:2345:x1 proto=tcp/2345 op=1 sent=9876 rcvd=6789 result=403 dstname=http: arg=//www.gui.log.eng.sonicwall.com code=20 Category="Online Banking" id=firewall123 sn=0017c5991784 time="2013-03-20 11:57:04" fw=10.0.203.108 pri=6 c=262144 m=98 msg="connection Opened" n=1437 usr="admin" src=192.168.168.1:61505:x0 dst=192.168.168.168:443:x0 proto=tcp/https sent=52 id=firewall123 sn=0017c5991784 time="2013-03-20 11:57:06" fw=10.0.203.108 pri=6 c=1024 m=537 msg="connection Closed" n=3683 usr="admin" src=192.168.168.1:61505:x0 dst=192.168.168.168:443:x0 proto=tcp/https sent=1519 rcvd=951 spkt=7 rpkt=8 cdur=2133 id=firewall123 sn=0017c5991784 time="2013-03-20 11:56:53" fw=10.0.203.108 pri=1 c=32 m=609 msg="ips Prevention Alert: P2P BitTorrent -- Peer Sync" sid=1994 ipscat=p2p ipspri=3 P2P BitTorrent -- Peer Sync, SID: 1994, Priority: Low n=1 src=1.2.3.4:5432:x0 dst=4.3.2.1:2345:x1 id=firewall123 sn=0017c5991784 time="2013-01-29 23:38:24" bid=1 fw=10.8.70.22 pri=1 c=16 m=793 msg="app Rules Alert" af_polid=1 af_policy="test" af_type="smtp Client Request" af_service="smtp (Send E-Mail)" af_action="no Action" n=0 src=10.10.10.245:50613:x0 dst=10.8.41.228:25:x1" 176
id=firewall123 sn=0017c5991784 mgmtip=10.0.203.108 time="2013-03-20 20:14:30 UTC" fw=10.0.203.108 m=96 n=25 i=60 lic=0 unsynched=893 pt=80.443 usestandbysa=0 dyn=n.n ai=1 fwlan=192.168.168.168 conns=0 Examples of ArcSight Syslog The following examples show the content of the Syslog packet. This type of message can be viewed on the Syslog server or any packet analyzer application. MAR 20 2013 19:07:43 0017C5991784 CEF:0 SonicWALL NSA 2400 5.9.0.0- d_75o 97 Syslog Website Accessed 4 cat=1024 gcat=2 src=1.2.3.4 spt=5432 deviceinboundinterface=x0 cs1label=1.2.4.5 snpt=1 dst=4.3.2.1 dpt=2345 deviceoutboundinterface=x1 cs2label=5.4.3.2 dnpt=2 proto=tcp/2345 out=9876 in=6789 requestmethod=1 outcome=403 request=http://www.gui.log.eng.sonicwall.com reason=20 Category-"Online Banking" MAR 20 2013 19:07:49 0017C5991784 CEF:0 SonicWALL NSA 2400 5.9.0.0- d_75o 98 Syslog Connection Logged 4 cat=262144 gcat=2 src=192.168.168.1 spt=61693 deviceinboundinterface=x0 dst=192.168.168.168 dpt=443 deviceoutboundinterface=x0 susr="admin" proto=tcp/https out=52 cnt=1570 MAR 20 2013 19:07:52 0017C5991784 CEF:0 SonicWALL NSA 2400 5.9.0.0- d_75o 537 Syslog Close 4 cat=1024 gcat=2 smac=00:00:c5:b3:6b:e5 src=192.168.168.1 spt=61693 deviceinboundinterface=x0 cs3label=trusted dst=192.168.168.168 dpt=443 deviceoutboundinterface=x0 cs4label=trusted susr="admin" proto=tcp/https out=1519 in=967 cn2label=7 cn1label=8 cn3label=2333 cnt=3815 MAR 20 2013 19:07:43 0017C5991784 CEF:0 SonicWALL NSA 2400 5.9.0.0-d_75o 609 IDP Prevention Alert 9 cat=32 gcat=3 src=1.2.3.4 spt=5432 deviceinboundinterface=x0 cs1label=1.2.4.5 snpt=1 dst=4.3.2.1 dpt=2345 deviceoutboundinterface=x1 cs2label=5.4.3.2 dnpt=2 msg="ips Prevention Alert: P2P BitTorrent -- Peer Sync, SID: 1994, Priority: Low" cnt=3 MAR 20 2013 19:07:43 0017C5991784 CEF:0 SonicWALL NSA 2400 5.9.0.0- d_75o 793 Application Firewall Alert 9 cat=16 gcat=10 src=1.2.3.4 spt=5432 deviceinboundinterface=x0 dst=4.3.2.1 dpt=2345 deviceoutboundinterface=x1 msg="application Firewall Alert: Policy: foobar, Action Type: Block SMTP E-Mail - Send Error Reply, Mail From: an unknown string of unknown length" cnt=3 SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 177
Table of Values This section can be used as a reference for understanding different categories and their descriptions. Legacy Categories The following table describes the Legacy categories shared in all SonicOS releases. Table 1 Legacy Category ID (used in Syslog) Name Description 0 Event is not Legacy Category, not backward compatible. 1 System Maintenance Logs general system activity, such as system activations. 2 System Errors Logs problems with DNS or Email. 4 Blocked Web Sites Logs Web sites or news groups blocked by the Content Filter List or by customized filtering. 8 Blocked Java Etc Logs Java, ActiveX, and Cookies blocked by the Dell SonicWALL security appliance. 16 User Activity Logs successful and unsuccessful log in attempts. 32 Attacks Logs messages showing Denial of Service attacks, such as SYN Flood, Ping of Death, and IP Spoofing. 64 Dropped TCP Logs blocked incoming TCP connections. 128 Dropped UDP Logs blocked incoming UDP packets. 256 Dropped ICMP Logs blocked incoming ICMP packets. 512 Network Debug Logs NetBIOS broadcasts, ARP resolution problems, and NAT resolution problems. Also, detailed messages for VPN connections are displayed to assist the network administrator with troubleshooting problems with active VPN tunnels. Network Debug information is intended for experienced network administrators. 1024 Syslog Only For Traffic Reporting Used for Syslog only to report HTTP connections opened and closed, and bytes transferred. 2048 Dropped LAN TCP Used for Syslog only to report that the TCP packet is dropped due to LAN management policy. 178
ID (used in Syslog) Name Description 4096 Dropped LAN UDP Used for Syslog only to report that the UDP packet is dropped due to LAN management policy. 8192 Dropped LAN ICMP Used for Syslog only to report that the ICMP packet is dropped due to LAN management policy. 32768 Modem Debug Logs Modem Debug activity. 65536 VPN Tunnel Status Logs status information on VPN tunnels. 131072 802.11 Management Logs WLAN IEEE 802.11 connections. 262144 Syslog Only For Traffic Reporting Used for Syslog only to report that the Network Traffic is logged when connection is opened. 524288 System Environment Logs system environment activity. 1048576 Expanded VOIP Activity Used for Syslog only to log VoIP H.323/ RAS, H.323/H.225, and H.323/H.245 activity. 2097152 Expanded WLAN IDS Activity 4194304 Expanded SonicPoint Activity Used for Syslog only to log WLAN IDS activity. Used for Syslog only to log SonicPoint activity. Expanded Categories The following table displays expanded category information, also known as the SonicOS Category, for all firmware releases and platforms. Table 2 Expanded Categories Category Description 802.11 Management Logs 802.11 management activity Advanced Routing Logs Advanced Routing activity Advanced Switching Logs Advanced Switching activity Anti-Spam Service Logs the Anti-Spam service App Flow Server Logs App Flow Server activity App Rules Logs App Rules activity Application Control Logs Application Control activity Attacks Logs messages showing Denial of Service attacks, such as SYN Flood, Ping of Death, and IP Spoofing. Access Logs Access activity WAN Acceleration Logs the WAN Acceleration activity Blocked Java Etc Logs Java, ActiveX, and Cookies blocked Blocked WebSites Logs Websites blocked SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 179
BOOTP Botnet Blocking SSO Agent Authentication Crypto Test DDNS Denied LAN IP DHCP Client DHCP Relay DHCP Server DPI-SSL Dropped ICMP Dropped TCP Dropped UDP DSL Dynamic Address Objects E1-T1 Firewall Event Firewall Hardware Firewall Logging Firewall Rule FTP Geolocation GMS High Availability Intrusion Prevention IPComp IPNet IPv6 Tunnel L2TP Client L2TP Server MAC-IP Anti-Spoof Modem Modem Debug Logs Bootstrap Protocol (BOOTP) activity Logs the Botnet Blocking activity Logs the SSO Agent Authentication activity Logs Crypto Test activity Logs Dynamic Domain Name System (DDNS) activity Logs LAN IP denied activity Logs DHCP Client activity Logs DHCP Relay activity Logs DHCP Server activity Logs the Deep Packet Inspection of Secure Socket Layer (DPI-SSL) activity Logs blocked incoming Internet Control Message Protocol (ICMP) packet activity Logs blocked incoming Transmission Control Protocol (TCP) connection activity Logs blocked incoming User Datagram Protocol (UDP) packet activity Logs DSL activity Logs Dynamic Address Object activity Logs E1-T1 activity Logs Firewall Event alerts and activity Logs Firewall Hardware alerts and activity Logs other Firewall-related activity Logs Firewall Rule alerts and activity Logs File Transfer Protocol (FTP) activity Logs the Geolocation service activity Logs Dell SonicWALL Global Management System (GMS) activity Logs High Availability activity Logs Intrusion Prevention activity Logs IP Compression (IPComp) activity Logs IPNet activity Logs IPv6 activity Logs Layer 2 Tunnel Protocol (L2TP) client activity Logs Layer 2 Tunnel Protocol (L2TP) server activity Logs the MAC-IP Spoofing activity Logs the Modem activity Logs the Modem Debug activity 180
MSAD Multicast Network Network Debug Network Access Network Monitor Network Traffic PPP PPP Dial-Up PPPoE PPTP Remote Authentication RBL RF Monitoring RIP Security Services SNMP SonicPoint SonicPointN SSLVPN System Environment System Errors System Maintenance User Activity VOIP VPN VPN Tunnel Status VPN Client VPN IKE VPN IPSec WAN Availability Logs Microsoft Active Directory (MSAD) activity Logs Multicast activity Logs Network activity Logs NetBios broadcasts, ARP resolution problems, and NAT resolution problems. Logs successful and unsuccessful Network Access activity Logs Network Monitor activity Logs Network Traffic activity Logs Point-to-Point Protocol (PPP) activity Logs Point-to-Point Protocol (PPP) Dial-Up activity Logs Point-to-Point Protocol over Ethernet (PPPoE) activity Logs Point-to-Point Tunneling Protocol (PPTP) activity Logs Remote Authentication activity Logs Realtime Black List (RBL) activity Logs RF Monitoring activity Logs Routing Information Protocol (RIP) activity Logs Security Services activity Logs the Simple Network Management Protocol (SNMP) activity Logs the SonicPoint activity Logs the SonicPointN activity Logs Secure Socket Layer Virtual Private Network (SSLVPN) activity Logs System Environment activity Logs System Errors activity Logs System Maintenance activity Logs successful and unsuccessful log in attempts Logs Voice over IP (VOIP) activity Logs Virtual Private Network (VPN) activity Logs VPN Tunnel Status activity Logs VPN Client activity Logs VPN IKE activity Logs VPN IP Security activity Logs WAN Availability activity SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide 181
Wireless WLAN IDS Logs Wireless activity Logs Wireless LAN System (IDS) activity Priority Level The following table displays the Priority Number and Name for Syslog Tags. The value here is taken from the Priority Level column of the Index of Log Event Messages on page 2, or the pri tag in Index of Syslog Tag Field Descriptions on page 170. For example, a tag with pri=0 means Emergency Priority. Table 3 Priority Level Priority Number Priority Name 0 Emergency 1 Alert 2 Critical 3 Error 4 Warning 5 Notice 6 Info 7 Debug 182
183