Juniper NETWORK AND SECURITY MANAGER 2010.3, Administration Manual

Page: 781 / 1016

About Log Severity
The log severity level defines the urgency of the information contained in the log entry.
The severity level of a log entry depends on the log category, such as information, traffic,
or configuration log entries.
You can configure a managed device to generate log entries only for those events that
meet a specific severity level. Additionally, you can configure the device to forward log
entries that contain a specific severity to a specific destination, such as a console location
or syslog server. You can forward multiple log entries with different severity levels to the
same log destination.
Juniper Networks assigns a predefined severity level in the firmware of each Juniper
Networks device. However, these severity levels are not the same as the severity levels
that appear in the log entries viewed in an NSM UI module.
Table 91 on page 731 details how NSM handles severity levels as defined by DMI devices:
Table 91: Log Entry Severity Levels for DMI Devices
Description NSM Severity
Log entries triggered when system requires immediate action. Alert
Log entries triggered when system encounters critical conditions. Critical
Log entries triggered when system becomes unusable. Emergency
Log entries triggered when system encounters errors, such as errors in device function. Error
Log entries triggered when system encounters normal but significant conditions. Notice
Log entries triggered when system encounters warning conditions. Warning
Log entries triggered by general system operations such as when a device connects or disconnects. Informational
Log entries triggered when system receives debug-level messages. Debug
Table 92 on page 731 details how NSM handles severity levels as defined by ScreenOS
and IDP devices:
Table 92: Log Entry Severity Levels for ScreenOS and IDP Devices
Description Severity NSM Severity
Log entries triggered when traffic matches a critical severity attack object.
Also includes log entries triggered by the SCREEN-level attacks, SYN attacks,
Tear Drop attacks, and Ping of Death attacks. Emergency Device_critical_log
Log entries triggered by the general firewall SCREEN-level attacks or other
conditions that require immediate attention, such the expiration of license
keys. Alert
731 Copyright © 2010, Juniper Networks, Inc.
Chapter 19: Logging