IPS logs dont always show in the console but appear in debug

[carl_t]

Hi Guys

We have noticed when some things get blocked under IPS etc, they don't always appear in the console logs, we end up having to do a debug on the gateway to see them.

Why would this be? is this by design or?

Cheers

[Tal_Paz-Fridman]

Have you changed any of the logging settings for the specific IPS protections, for example:

Also, what version are you using?

[carl_t]

Hi

Good point, I forgot the logs can be switched off there, we generally use recommended settings and leave the logs as is, maybe someone switched them off? Would this be one of the reasons the gateway would show the drops but the logging server not showing them ?

[Timothy_Hall]

You say "IPS etc", but what specific type of IPS-related signature are you talking about:

• IPS ThreatCloud Protection?
• Core Activation?
• Inspection Settings (Access Control)?
• Geo Policy (deprecated)?

How these are logged varies a lot depending on type...