Policy Configuration : Configuring Enhanced Log Settings
Configuring Enhanced Log Settings
1
In the center pane, navigate to Log > Enhanced Log Settings.
 
2
Enter the IP address or name of the mail server in the Mail Server (name or IP Address) field.
3
Enter the email address that appears as the sender on emails in the From E-mail Address field.
4
Select a method of authentication from the Authentication Method pull-down menu, either None or POP before SMTP.
5
If you selected POP before SMTP, enter the POP server name or IP address in the POP Server (name or IP address) field, and the POP account user name and password in the Username and Password fields.
6
Enter the name of the SonicWALL appliance in the Firewall Name field. The firewall name appears in the subject of email sent by the SonicWALL appliance. By default, the firewall name is the same as the SonicWALL appliance serial number.
* 
NOTE: The name of the SonicWALL appliance cannot be configured at the group or global level.
7
In the Syslog Facility pull-down menu, select one of the syslog facility options.
8
To override syslog settings with ViewPoint settings, check Override Syslog settings with ViewPoint settings.
9
To select a syslog format, choose one of the two options from the Syslog Format pull-down menu:
•
Default—The standard SonicWALL syslog format.
•
WebTrends—A reporting software that analyzes traffic activity, protocol usage, security problems, resource usage, bandwidth consumption, and more. For more information, visit http://www.webtrends.com.
10
To specify how often Dell SonicWALL GMS logs repetitive events, enter the time period (in seconds) in the Syslog Event Redundancy Filter field (default: 60 seconds). This prevents repetitive events from being logged to the syslog. If duplicate events occur during the period, they are logged as a single event that specifies the number of times that the event occurred.The minimum is 0 seconds and the maximum is 86,400 seconds (24 hours). If you specify 0, all events are logged.
11
To enable event rate limiting, check Enable Event Rate Limiting and enter a maximum number of events per second in the Maximum Events Per Second field.
12
To enable data rate limiting, check Enable Data Rate Limiting and enter a maximum bytes per second in the Maximum Bytes Per Second field.
13
Specify how often the SonicWALL appliance(s) send heartbeats to Dell SonicWALL GMS in the Heartbeat Rate field (default: 60 seconds). If Dell SonicWALL GMS does not receive a heartbeat message within three intervals, Dell SonicWALL GMS considers the SonicWALL appliances offline or unavailable and its icon turns red.
* 
NOTE: It is highly recommended to leave the Heartbeat Rate at the default setting of 60 seconds. Values close to zero generates a large number of status messages. The maximum value is 86400 seconds (24 hours).
14
Enter the complete email address (for example, administrator@company.com) where the log is sent in the Email Log to field. If this field is left blank, the log is not sent.
* 
NOTE: This address is also used as the return address.
15
Some events, such as an attack, might require immediate attention. Enter the complete email address or email pager address in the Email Alerts to field. If this field is left blank, alerts are not sent.
* 
NOTE: This address is also used as the return address.
16
To email the log now, click Email Log Now. The scheduler displays.
17
Expand Schedule by clicking the plus icon.
18
Select Immediate or specify a future date and time.
19
Click Accept.
20
To clear the log, click Clear Log Now. A confirmation displays. Click OK to clear the log.
21
To add a syslog server, enter the IP address and port in the Syslog Server IP Address and Port fields. Click Add. The scheduler displays.
22
Expand Schedule by clicking the plus icon.
23
Select Immediate or specify a future date and time.
24
Click Accept.
25
For automated log delivery, specify when the log file is sent from the Send Log pull-down menu. Select When Full, Daily, or Weekly. If the log is sent daily, select the time that logs are sent (24-hour format). If the log is sent weekly, select the day of the week and the time.
26
In some cases, the log buffer might fill up. This might occur if there is a problem with the mail server and the log cannot be successfully emailed. Under When Log Overflows, select Overwrite Log (SonicWALL appliances will overwrite the log and discard its contents) or Shutdown SonicWALL (this will prevent further traffic from not being logged).
27
From the Logging Level pull-down menu, select one of the logging level options.
28
From the Alert Level pull-down menu, select one of the alert level options.
29
Enter a period of time, in seconds, in the Log Redundancy Filter (seconds) field.
30
Enter a period of time, in seconds, in the Alert Redundancy Filter (seconds) field.
31
For each category in the Categories table, select a combination of Log, Alerts, and Syslog.
* 
NOTE: If you are using SonicWALL GMS, make sure that it can generate all reports for each SonicWALL appliance by selecting all log category check boxes.
32
When you are finished, click Update. The scheduler displays.
33
Expand Schedule by clicking the plus icon.
34
Select Immediate or specify a future date and time.
35
Click Accept.