SignaMax 065-7434, Configuration Manual

Page: 289 / 669

289 SIGNAMAX LLC • www.signamax.eu
Log
Overview
Log information adopts the consolidated log configuration of the system. The following items
are recorded in the log information:
1. Access-list-based filtering log: if the rule of the access list has the log option, the
information is recorded into the log when the rule is introduced by a firewall;
2. Special packet and pseudo-source address detection record: each special packet
automatically records log information into the log system; if the received packets
exceed the threshold limitation, a warning record about the threshold value is added
into the log;
3. Warning threshold value adopts the mode of status switch. Once a kind of received
packets exceeds a given number in a period and the receiving frequency exceeds
limitation, then the warning information is recorded into the log immediately;
Here, the information of the normal access list, such as the filtering log, the special
packet detection and the pseudo-source address detection is in the system log buffer.
When a log record is generated, firstly send the prompt information to the log file (or
remote log system), cache the following information in the local buffer temporarily, and
write the recording condition in the time interval per a period; but the warning record of
threshold value and the attack detection record do not adopt the buffer mechanism. Once
such kind of information is generated, they are sent to the log record immediately.
Basic Commands
Command Description Config mode
firewall pseudo-address log The switch of the pseudo-address detection log config
ip intercept log The switch of the attack detection log config
The symbol “*” before the command description means that there is the configuration
example to describe the command in details later.
firewall pseudo-address log
The pseudo-source address log has a switch. The no format of the command is to disable the
log.