Set Logging and Notification Preferences

The settings for logging and notification are similar throughout the XTM device configuration. For each place you define logging and notification preferences, most or all of the options described below are available.

Screen shot of the Policy page Logging section

Send Log message

When you select this check box, the XTM device sends a log message when an event occurs.

You can select to send log messages to a WatchGuard Log Server, Syslog server, or XTM device internal storage. For detailed steps to select a destination for your log messages, see Configure Logging Settings.

Send SNMP trap

When you select this check box, the XTM device sends an event notification to the SNMP management system. Simple Network Management Protocol (SNMP) is a set of tools used to monitor and manage networks. A SNMP trap is an event notification the XTM device sends to the SNMP management system when a specified condition occurs.

If you select the Send SNMP Trap check box and you have not yet configured SNMP, a dialog box appears and asks you if you want to do this. Click Yes to go to the SNMP Settings dialog box. You cannot send SNMP traps if you do not configure SNMP.

For more information about SNMP, see About SNMP.

To enable SNMP traps or inform requests, see Enable SNMP Management Stations and Traps.

Send Notification

When you select this check box, the XTM device sends a notification when the event you specified occurs. For example, when a policy allows a packet.

You can select how the XTM device sends the notification:

Email — The Log Server sends an email message when the event occurs.
Pop-up Window — The Log Server opens a dialog box when the event occurs.
Set the:
Launch Interval — The minimum time (in minutes) between different notifications. This parameter prevents more than one notification in a short time for the same event.
Repeat Count — This setting tracks how frequently an event occurs. When the number of events reaches the selected value, a special repeat notification starts. This notification creates a repeat log entry about that specified notification. Notification starts again after the number of events you specify in this field occurs.

For example, set the Launch interval to 5 minutes and the Repeat count to 4. A port space probe starts at 10:00 AM. and continues each minute. This starts the logging and notification mechanisms.
These actions occur at these times:

10:00 — Initial port space probe (first event)
10:01 — First notification starts (one event)
10:06 — Second notification starts (reports five events)
10:11 — Third notification starts (reports five events)
10:16 — Fourth notification starts (reports five events)

The launch interval controls the time intervals between each event (1, 2, 3, 4, and 5). This was set to 5 minutes. Multiply the repeat count by the launch interval. This is the time interval an event must continue to in order to start the repeat notification.

Set Logging and Notification Preferences

See Also