Watchguard Logging Architecture; Designating Event Processors For A Firebox - Watchguard Firebox FireboxTM System 4.6 User Manual

WatchGuard logging architecture

log messages to the second Event Processor. It continues through the list until it finds
an Event Processor capable of recording events.
Multiple Event Processors operate in failover mode, not redundancy
mode—that is, events are not logged to multiple Event Processors
simultaneously; they are logged only to the primary Event Processor unless
that host becomes unavailable. Then the logs are passed on to the next
available Event Processor according to the order of priority. As soon as a
higher-priority Event Processor becomes available again, the logs are
shifted to that host. The highest-ranking Event Processor available always
receives the logs.
The LiveSecurity Event Processor software must be installed on each Event
Processor. For more information, see "Setting up the LiveSecurity Event
Processor" on page 73.
WatchGuard logging architecture
The flexible architecture of the Firebox System makes it possible to separate the
logging and notification responsibilities to multiple machines. By default, the Policy
Manager and the log and notification application – the LiveSecurity Event Processor
– are installed on the same computer. You can, however, install the Event Processor
software on a separate or multiple computers.
You must complete the following tasks to configure the firewall for logging and
notification:
Policy Manager
- Add logging and notification host(s)
- Customize preferences for services and packet handling options
- Save the configuration file with logging properties to the Firebox
LiveSecurity Event Processor
- Install the software on each Event Processor
- Set global logging and notification preferences for the host
- Set the log encryption key on the Event Processor identical to the key set in
Policy Manager.

Designating Event Processors for a Firebox

You should have at least one Event Processor to run the WatchGuard Firebox System.
The default primary Event Processor is the Management Station, which is set when
70