Log entries are stored on the primary and backup LiveSecurity Event Processor. By default, logfiles are placed in the WatchGuard installation directory in a subdirectory called \logs. The logfile to which the Event Processor is currently writing records is named Firebox IP.wgl. In addition, the Event Processor creates an index file in the same directory by the same name with the extension .idx. When Event Processor rolls a logfile over, it saves the old files as Firebox IP Time Stamp.wgl and Firebox IP Time Stamp.idx.Both the .wgl and .idx files are necessary to use any monitoring or log display tool.
For more information about the LiveSecurity Event Processor and configuring logging, see Setting Up Logging and Notification.