Attack defense log settings

Introduction

Attack defense logs can be output in system logs or fast logs. By default, attack defense logs are output in system logs.

Log aggregation for single-packet attack events

When you enable logging for single-packet attacks, the device generates logs when it detects single-packet attacks. The log generation and output require more system resources if single-packet attacks frequently occur. You can enable Log aggregation for single-packet attacks to save system resources. This feature aggregates multiple logs generated during a period of time and sends one log. Logs that are aggregated must have the following attributes in common:

·     Attacks are detected on the same interface or security zone or are destined for the device.

·     Attack type.

·     Attack defense action.

·     Source and destination IP addresses.

·     VRF to which the victim IP address belongs.

Blacklist logging

With logging enabled for the blacklist feature, the system outputs logs in the following situations:

·     A blacklist entry is manually added.

·     A blacklist entry is dynamically added by the scanning attack detection feature.

·     A blacklist entry is manually deleted.

·     A blacklist entry ages out.

A blacklist log records the following information:

·     Source IP address of the blacklist entry.

·     Remote IP address of the DS-Lite tunnel.

·     VRF name.

·     Reason for adding or deleting the blacklist entry.

·     Aging time for the blacklist entry.

Log buffer and log file

The device provides separate log buffers and log files for the blacklist module and the attack defense module. To enable outputting logs of service modules to their log buffers and log files, select the Output to log buffer option on the basic settings page for the syslog.

Logs are saved in the log file buffer before they are saved to the log file. After the system saves logs to the log file, the log file buffer is cleared.

When the maximum capacity of the log file is reached, the system replaces the oldest logs with new logs.