Login
- Table of Contents
-
- 07-System
- 01-Track
- 02-BFD
- 03-NQA
- 04-Basic log settings
- 05-Email server
- 06-Session log settings
- 07-Sandbox log settings
- 08-Threat log settings
- 09-Application audit log settings
- 10-NetShare log settings
- 11-URL filtering log settings
- 12-Attack defense log settings
- 13-Reputation log settings
- 14-Bandwidth alarm logs
- 15-Configuration log settings
- 16-Security policy log
- 17-Terminal identification logging
- 18-Heartbeat log settings
- 19-WAF log settings
- 20-Bandwidth management logs
- 21-Report settings
- 22-Session settings
- 23-Signature upgrade
- 24-Software upgrade
- 25-License management
- 26-Administrators
- 27-Date and time
- 28-SNMP
- 29-Configuration management
- 30-Reboot
- 31-About
- 32-Ping
- 33-Tracert
- 34-Packet capture
- 35-Webpage Diagnosis
- 36-Diagnostic Info
- 37-Packet trace
- 38-Fast Internet Access
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 12-Attack defense log settings | 20.96 KB |
Attack defense log settings
Introduction
Log aggregation for single-packet attack events
When you enable logging for single-packet attacks, the device generates logs when it detects single-packet attacks. The log generation and output require more system resources if single-packet attacks frequently occur. You can enable Log aggregation for single-packet attacks to save system resources. This feature aggregates multiple logs generated during a period of time and sends one log. Logs that are aggregated must have the following attributes in common:
· Attacks are detected on the same interface or security zone or are destined for the device.
· Attack type.
· Attack defense action.
· Source and destination IP addresses.
· VRF to which the victim IP address belongs.
Blacklist logging
With logging enabled for the blacklist feature, the system outputs logs in the following situations:
· A blacklist entry is manually added.
· A blacklist entry is dynamically added by the scanning attack detection feature.
· A blacklist entry is manually deleted.
· A blacklist entry ages out.
A blacklist log records the following information:
· Source IP address of the blacklist entry.
· VRF name.
· Reason for adding or deleting the blacklist entry.
· Aging time for the blacklist entry.
Log buffer and log file
The device provides separate log buffers and log files for the blacklist module and the attack defense module. To enable outputting logs of service modules to their log buffers and log files, select the Output to log buffer option on the basic settings page for the syslog.
Logs are saved in the log file buffer before they are saved to the log file. After the system saves logs to the log file, the log file buffer is cleared.
When the maximum capacity of the log file is reached, the system replaces the oldest logs with new logs.
