| Home Prev |  cOS Stream 4.00.03 Administration Guide
|
Next |
|---|
The ability to log and analyze system activities is an essential feature of cOS Stream. Logging enables not only the monitoring of system status and health, but also allows auditing of network usage and assists in trouble-shooting.
Log Message Generation
A large number of different log event messages can be generated as a result of associated system events. Examples of such events are the establishment and ending of flows, receipt of malformed packets and the dropping of traffic according to filtering policies.Log events are always generated for certain aspects of cOS Stream such as buffer usage, DHCP clients, high availability and IPsec. The generation of events for other subsystems such as DHCP Relay, DHCP Servers and IP Rules can be enabled as needed.
Several hundred events exist for which log messages can be generated. The events range from high-level, customizable, user events down to low-level and mandatory system events.The flow_open event, for example, is a typical high-level event that generates an event message whenever a new flow is established, given that the matching security policy rule has defined that event messages should be generated for that flow.
An example of a low-level event would be the startup_normal event, which generates a mandatory event message as soon as the system starts up.
All event messages have a common format, with attributes that include category, severity and recommended actions. These attributes enable easy filtering of messages, either within cOS Stream prior to sending to an event receiver, or as part of the analysis after logging and storing messages on an external log server.A list of all event messages can be found in the separate cOS Stream Log Reference Guide. The document also describes the design of event messages, the meaning of severity levels and the various attributes available.
The severity of each event is predefined and it can be, in order of severity, one of:
Emergency
Alert
Critical
Error
Warning
Notice
Info
Debug
By default, cOS Stream sends all messages of level Info and above to configured log servers. The Debug category is not sent by default and is intended for troubleshooting only and should only be turned on if required when trying to solve a problem. All log messages of all severity levels are found listed in the separate cOS Stream Log Reference Guide.
There is an additional severity type called Dynamic which does not fit into the progressive severity list given above. A severity of Dynamic means that the severity of the log event can change. There are two uses for this severity type:cOS Stream can set the severity of the event to a specific level to indicate that the triggering condition has not been dealt with.
The severity of the event can be explicitly set by the administrator.
cOS Stream can be configured to distribute log event messages in different ways:
Real-Time Log Event Display with the log Command
The CLI console can act as a log receiver, displaying new log messages as they are generated in real-time. The feature can be turned on using the CLI log command.
This receiver type is discussed further below in Section 20.2, Using the log Command.
Syslog Receivers
An external server that will collect Syslog log messages sent by cOS Stream can be defined with a LogReceiverSyslog object. Syslog is the de-facto standard for logging events from network devices. If other network devices are already logging to Syslog servers, using Syslog with cOS Stream log messages can simplify overall administration.
This receiver type is discussed further below in Section 20.3, Logging to Syslog Servers.
SNMP Traps
An LogReceiverSNMP2c object can be defined for an external server that will collect SNMP Trap log messages sent by cOS Stream. Such receivers are typically used to collect and respond to critical alerts from network devices.
This receiver type is discussed further below in Section 20.5, SNMP Traps.
