Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
carl_t
Contributor

IPS logs dont always show in the console but appear in debug

Hi Guys

We have noticed when some things get blocked under IPS etc, they don't always appear in the console logs, we end up having to do a debug on the gateway to see them.

Why would this be? is this by design or?

Cheers

0 Kudos
3 Replies
Tal_Paz-Fridman
Employee
Employee

Have you changed any of the logging settings for the specific IPS protections, for example:

2023-01-18 15_18_00-Protection Details - Apache Log4j Denial Of Service (CVE-2021-45105).png

 

Also, what version are you using?

0 Kudos
carl_t
Contributor

Hi

Good point, I forgot the logs can be switched off there, we generally use recommended settings and leave the logs as is, maybe someone switched them off? Would this be one of the reasons the gateway would show the drops but the logging server not showing them ?

 

0 Kudos
Timothy_Hall
Legend Legend
Legend

You say "IPS etc", but what specific type of IPS-related signature are you talking about:

  • IPS ThreatCloud Protection?
  • Core Activation?
  • Inspection Settings (Access Control)?
  • Geo Policy (deprecated)?

How these are logged varies a lot depending on type...

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events