Table of Contents
Note: This document is also available in other formats | |
---|---|
A PDF version of this document along with all current and older documentation in PDF format can be found at https://my.clavister.com. It is also available in a framed HTML version. |
This guide is a reference for all log messages generated by cOS Core. It is designed to be a valuable information source for both management and troubleshooting.
The following notations and conventions will be used in this guide for describing log messages.
Notation
The following notation is used throughout this reference guide when specifying the parameters of a log message:Example 1.1. Log Message Parameters
New configuration activated by user <username> and committed via <authsystem>
Both the authsystem and the username parameters will be included.
Example 1.2. Conditional Log Message Parameters
Administrative user <username> logged in via <authsystem>. Access level: <access_level>
The authsystem, username and the access_level parameters will be included. The other parameters of userdb, server_ip, server_port, client_ip and client_port may or may not be included, depending on the context of the log message.
Abbreviations
The following abbreviations are used throughout this reference guide:
Abbreviation | Full name |
---|---|
ALG | Application Layer Gateway |
ARP | Address Resolution Protocol |
DHCP | Dynamic Host Configuration Protocol |
DNS | Domain Name System |
ESP | Encapsulating Security Payload |
FTP | File Transfer Protocol |
HA | High Availability |
HTTP | Hyper Text Transfer Protocol |
ICMP | Internet Control Message Protocol |
IDS | Intrusion Detection System |
IP | Internet Protocol |
IPSec | Internet Protocol Security |
L2TP | Layer 2 Tunneling Protocol |
NAT | Network Address Translation |
OSPF | Open Shortest Path First |
PPP | Point to Point Protocol |
PPPoE | Point to Point Protocol over Ethernet |
RADIUS | Remote Authentication Dial In User Service |
SAT | Static Address Translation |
SMTP | Simple Mail Transfer Protocol |
SNMP | Simple Network Management Protocol |
SSL | Secure Socket Layer |
TCP | Transport Control Protocol |
TLS | Transport Layer Security |
UDP | User Datagram Protocol |
URL | Uniform Resource Locator |
UTF | Unicode Transformation Format |
VLAN | Virtual Local Area Network |
VPN | Virtual Private Network |
All log messages have a common design with attributes that include category, severity and recommended actions. These attributes enable the easy filtering of log messages, either within cOS Core prior to sending them to a log receiver, or as part of analysis that takes place after the logging and storage of messages on an external log server.
The following information is provided for each specific log message:
The name of the log message, which is a short string, 1-6 words separated by _. Please note that the name cannot be used as a unique identification of the log message, as several log messages might share the same name.
The ID is a number made up of a string of 8 digits which uniquely identifies the log message. The first 3 digits identify the category to which the log message belongs.
Note | |
---|---|
In this guide, the Name and the ID of the log message form the title of the section describing the log message. Also note that category IDs do not always form a perfectly sequential list. There are gaps where IDs have been removed during the evolution of the software. These gaps are discussed further in an article in the Clavister Knowledge Base at the following link: |
Log messages are grouped into categories, where each category maps to a specific subsystem in cOS Core. For instance, the IPSEC category includes some hundreds of log messages, all related to IPSec VPN activities. Other examples of categories include ARP, DHCP, IGMP and USERAUTH.
In this guide, categories are listed as sections in Chapter 2, Log Message Reference.
As previously mentioned, the category is identified by the first 3 digits in the message ID. All messages in a particular category have the same first 3 digits in their ID.
The default severity level for this log message. For a list of severity levels, see section Section 1.4, Severity levels.
A brief explanation of the event that took place. This explanation often features references to parameters, enclosed in angle brackets. Example:
Administrative user <username> logged in via <authsystem>. Access level: <access_level>
Note | |
---|---|
This string is only included in log messages sent to Clavister Log Receivers. |
A detailed explanation of the event.
Note that this information is only featured in this reference guide and is never actually included in the log message.
A short string, 1-3 words separated by _, of what action cOS Core will take. If the log message is purely informative, this is set to "None".
A detailed recommendation of what the administrator should do if this log message is received. If the log message is purely informative, this is set to "None".
Note that this information is only featured in this reference guide, and is never actually included in the log message.
The current revision of the log message. This is increased each time a log message is changed between two releases.
Additional Information
Depending on the log message, the following information may also be included:
The name of the parameters that are included in this log message. If a parameter is specified within square brackets (for example [username]), then the parameter is optional and may or may not be included in the log message.
The name of the context parameters that are included in this log message. See Section 1.3, Context Parameters for a description of all available context parameters.
In many cases, information regarding a certain object is featured in the log message. This can be information about, for example, a connection. In this case, the log message should, besides all the normal log message attributes, also include information about which protocol is used, source and destination IP addresses and ports (if applicable) and so on.
As the same information will be included in many log messages, these are referenced as a Context Parameter. So whenever a log message includes information about a connection, it will feature the CONN parameter in the Context Parameter list. This means that additional information about the connection will also be included in the log message.
A description of all available context parameters follows with an explanation of all the additional parameters. The names of the additional parameters are specified using the Syslog format.
Note | |
---|---|
The additional parameters are formatted differently in the EFWLog format, giving them a more user friendly presentation. |
ALG Module Name
The type of ALG related to an event. An ALG is always of a certain type, for example FTP, H323 or HTTP. This parameter specifies the name of the ALG sub-module, in order to quickly distinguish which type of ALG this is.ALG Session ID
The ALG session ID related to an event. Each ALG session has its own session ID, which uniquely identifies an ALG session. This is useful, for example, when matching the opening of an ALG session with the closure of the same ALG session.Packet Buffer
Information about the packet buffer related to an event. This can contain a large number of additional objects. Certain parameters may or may not be included, depending on the type of packet buffer. For example, the TCP flags are only included if the buffer contains the TCP protocol. The ICMP-specific parameters are only included if the buffer contains the ICMP protocol.The sender hardware address. Valid if the protocol is ARP.
The destination hardware address. Valid if the protocol is ARP.
The ARP state. Valid if the protocol is ARP. Possible values: request|reply.
The source IP Address. Valid if the protocol is not ARP.
The destination IP Address. Valid if the protocol is not ARP.
Fragmentation offset. Valid if the IP packet is fragmented.
Fragmentation ID. Valid if the IP packet is fragmented.
The source port. Valid if the protocol is TCP or UDP.
The destination port. Valid if the protocol is TCP or UDP.
The TCP header length. Valid if the protocol is TCP.
The total UDP data length. Valid if the protocol is UDP.
The specific TCP flag is set. Valid if the protocol is TCP. Possible values for tcpflag: syn, rst, ack, psh, fin, urg, ece, cwr and ns.
The ICMP sub-protocol name. Valid if the protocol is ICMP.
The ICMP echo ID. Valid if the protocol is ICMP and sub-protocol is echo.
The ICMP echo sequence number. Valid if the protocol is ICMP and sub-protocol is echo.
The ICMP destination unreachable code. Valid if the protocol is ICMP and sub-protocol is destination unreachable.
The ICMP redirect code. Valid if the protocol is ICMP and sub-protocol is redirect.
The ICMP sub-protocol code. Valid if the protocol is ICMP and sub-protocol is not echo, destination unreachable or redirect.
The "More Fragment" flag in the IP Packet 0 means "Last Fragment" and 1 means "More Fragments"
The "Don't Fragment" flag in the IP packet 0 means "May Fragment" and 1 means "Don't Fragment".
Reserved flag. Not used.
First fragment (IPv6). This entry indicates that this packet is the first fragmented packet.
The length of extension headers (IPv6).
Connection
Additional information about a connection that generated the event. Certain parameters may or may not be included depending on the type and status of the connection. For example, the number of bytes sent by the originator and terminator is only included if the connection is closed.The status of the connection. Possible values: open, close, closing and unknown.
The source port. Valid if the protocol is TCP or UDP.
The source ID. Valid if the protocol is not TCP or UDP.
The destination port. Valid if the protocol is TCP or UDP.
The destination ID. Valid if the protocol is not TCP or UDP.
The number of bytes sent by the originator in this connection. Valid if the connection is closing or closed.
The number of bytes sent by the terminator in this connection. Valid if the connection is closing or closed.
IDP
Specifies the name and a description of the signature that triggered this event.Note | |
---|---|
For IDP log messages an additional log receiver, an SMTP log receiver, can be configured. This information is only sent to log receives of that kind and not included in the Syslog or EFWLog format. |
Dropped Fragments
Specifies detailed information about dropped fragments in a packet.Note | |
---|---|
This information is only sent in the EFWLog format |
Rule Name
Specifies the name of the rule set entry that was triggered to generate this event.Rule Information
Additional information about the rule set entry that generated this event. Certain parameters may or may not be included, depending on the type of entry. For example, the name of an authenticated user is only included if this rule contains network objects that have user authentication information in them.The name of the SAT source rule. Valid if the rule action is SAT.
The name of the SAT destination rule. Valid if the rule action is SAT.
The name of the authenticated user in the source network object. Valid if the source network object has user authentication information.
The name of the authenticated user in the destination network object. Valid if the destination network object has user authentication information.
User Authentication
Additional information about a user authentication event.The user authentication event that occurred. Possible values: login, logout, timedout, disallowed_login, accounting and unknown.
OSPF
Additional information about an OSPF event.The OSPF section Possible values: packet, hello, ddesc, exchange, lsa, spf, route and unknown.
OSPF LSA
Additional information about OSPF LSA.The LSA type Possible values: Router, network, IP summary, ASBR summary and AS external.
Dynamic Route
Additional information about a dynamic route event.The dynamic routing event that occurred. Possible values: add, remove, modify, export, unexport and unknown.
Route
Additional information about a route event.Deep Inspection
Additional information about a deep inspection event.UINT64
Additional information about a UINT64 event.An event has a default severity level, based on how serious the event is. The following eight severity levels are possible, as defined by the Syslog protocol:
Priority in Syslog Messages
In Syslog messages the priority is indicated by the parameter prio=nn.Excluding Logged Messages
cOS Core allows the exclusion from logging of entire catageories of log messages or just specific log messages. It is also possible to change the severity level of log messages so that a specific category or a specific message has the severity reset to a particular level when it is sent by cOS Core. These features are documented further in the cOS Core Administrators Guide.Sort Order | |
---|---|
All log messages are sorted by their category and then by their ID number. |
These log messages refer to the ACMECERTS (ACME certificates) category.
These log messages refer to the ALG (Events from Application Layer Gateways) category.
Found DNS server DNS name in ClientHello datagram.
Connection to blaclisted URL closed.
These log messages refer to the ANTISPAM (Anti-spam related events) category.
These log messages refer to the ANTIVIRUS (Anti-Virus related events) category.