Watchguard Firebox FireboxTM System 4.6, User Manual

Page: 86 / 170

Customizing logging and notification by service or option
76
3 For a record size, enable the By Number of Entries checkbox. Use the scroll
control or enter a number of log record entries.
The Approximate Size field changes to display the approximate file size of the final log file. For
a detailed description of each control, right-click it, and then select What’s This?.
4 Click OK .
The Event Processor Interface closes and saves your entries. New settings take effect
immediately.
Scheduling log reports
You can use the Event Processor to schedule the automatic generation of network
activity reports. For more information, see “Scheduling a report” on page 114.
Controlling notification
Notification occurs when the firewall sends an e-mail, pops up a window on the
Event Processor, or dials a pager to notify an administrator that the Firebox detected a
triggering event. Use the Event Processor to control when and to whom such
notifications are sent. From the Event Processor interface:
1 Click the Notification tab.
2 Modify the settings according to your security policy preferences.
For more information on individual settings, right-click the setting, and then select What’s
This?.
Customizing logging and notification by service or option
The Firebox System allows you to create custom logging and notification properties
for each service and blocking option. You can fine-tune your security policy, logging
only those events that require your attention and limiting notification to truly high-
priority events.
To make logging and notification configuration easier, services, blocking categories,
and packet-handling options share an identical dialog box. Therefore, once you learn
the controls for one type of service, you can easily configure the remainder.
The Logging and Notification dialog box contains the following controls:
Category
The event types that can be logged by the service or option. This list changes
depending on the service or option. Click the event name to display and set its
properties.
Enter it in the log
Enable this checkbox to log the event type; clear it to disable logging for the
event type. Because the Firebox must perform domain name resolution, there
may be a time lag before logs appear in the log file. All denied packets are
logged by default.