topic Re: Failed Policy Install Logging in Firewall and Security Management

Failed Policy Install Logging

kevin_t — Fri, 31 Jan 2020 13:58:16 GMT

Morning All, thanks in advance for any insight!

We are looking at exporting audit logs to our SIEM, and got the connection working and everything. We scheduled our policy installs to happen automatically, and we would like alerting to happen based on failed policy installs. That being said, we cannot find anything in any logs that indicate a failed policy install! Just wondering if anyone had any insight into if this gets logged, and if so - where are they?

Thanks again!

Re: Failed Policy Install Logging

PhoneBoy — Fri, 31 Jan 2020 19:20:14 GMT

I know when the gateway begins enforcing a new policy, that action will generate a log that should get exported to the SIEM.
I don't believe failed policy installs generate log entries at all.
Details about this only appear in SmartConsole as far as I know.

Re: Failed Policy Install Logging

Amir_Senn — Sun, 02 Feb 2020 09:22:34 GMT

If you have SmartEvent server you can create an event for any traffic/audit logs.

There's a pre-defined event for successful policy installations, it checks for audit logs for successful policy installation but it could easily be changed to an event that generates for failed attempts to install policy.

To any event you can attach an automatic reaction such as email.

Re: Failed Policy Install Logging

Tal_Paz-Fridman — Sun, 02 Feb 2020 15:50:00 GMT

You should receive an Audit Log for the failure.

Go to - SmartConsole > Logs & Monitor > New tab > Audit Logs View