Configuring Log Settings; Table 137 Example Log Description - ZyXEL Communications ZyWall 70 User Manual

The following is an example of how a log displays in the command line interpreter and a
description of the sample log. Refer to the appendices for more log message descriptions and
details on using the command line interpreter to display logs.
# .time
notes
message
5|06/08/2004 05:58:20 |172.21.4.187:137
|ACCESS BLOCK
Firewall default policy: UDP (W to W/ZW)

Table 137 Example Log Description

LABEL
#
time
source
destination The NetBIOS packet was sent to the 172.21.255.255 subnet port 137. This was a
notes
message

24.3 Configuring Log Settings

To change your ZyWALL's log settings, click LOGS, then the Log Settings tab. The screen
appears as shown.
Use the Log Settings screen to configure to where the ZyWALL is to send logs; the schedule
for when the ZyWALL is to send the logs and which logs and/or immediate alerts the
ZyWALL is to send.
An alert is a type of log that warrants more serious attention. They include system errors,
attacks (access control) and attempted access to blocked web sites or web sites with restricted
web features such as cookies, active X and so on. Some categories such as System Errors
consist of both logs and alerts. You may differentiate them by their color in the View Log
screen. Alerts display in red and logs display in black.
Note: Alerts are e-mailed as soon as they happen. Logs may be e-mailed as soon as
the log is full (see Log Schedule). Selecting many alert and/or log categories
(especially Access Control) may result in many e-mails being sent.
Chapter 24 Logs Screens
source
DESCRIPTION
This is log number five.
The log was generated on June 8, 2004 at 5:58 and 20 seconds AM.
The log was generated due to a NetBIOS packet sent from IP address 172.21.4.187 port
137.
NetBIOS UDP broadcast packet meant to discover devices on the network.
The ZyWALL blocked the packet.
The ZyWALL blocked the packet in accordance with the firewall's default policy of blocking
sessions that are initiated from the WAN. "UDP" means that this was a User Datagram
Protocol packet. "W to W/ZW" indicates that the packet was traveling from the WAN to the
WAN or the ZyWALL.
ZyWALL 70 User's Guide
destination
|172.21.255.255:137
389