Logging To A Watchguard Log Server - Watchguard Firebox X20E User Manual

Logging to a WatchGuard Log Server

Logging to a WatchGuard Log Server
The WatchGuard® Log Server (previously known as the WatchGuard System Event Processor, or WSEP)
is a component of WatchGuard System Manager. If you have a Firebox® III, Firebox X Core, or Firebox X
Peak, configure a primary Log Server to collect the log messages from your Firebox X Edge e-Series.
You can also configure a backup Log Server. If the Firebox X Edge cannot connect to the primary Log
Server, it tries to connect to the backup Log Server. It then sends log messages to the backup Server
until it cannot connect to that Server. Then, it tries the primary Server again. For instructions on how to
configure the Log Server to accept log messages, see the WatchGuard System Manager User Guide.
If you have not already done so, it is a good idea to configure the Edge with a device name. This name
lets the Log Server know which log messages come from which device. The device name appears in
the Log Viewer. If this field is clear, the Firebox X Edge is identified in the log file by the IP address of the
Edge external interface. To give your Edge a device name, go to the Administration web page.
Use these instructions to send your event logs to the Log Server:
To connect to the System Status page, type https:// in the browser address bar, and the IP
1
address of the Firebox X Edge trusted interface.
The default URL is: https://192.168.111.1
From the navigation bar, select Logging > WatchGuard Logging.
2
The WatchGuard Logging page appears.
Select the Send logs to WSM Log Server check box if you want the Edge to send log messages
3
to a WatchGuard Log Server you specify.
Select the Send logs in native XML format check box to have the Edge log messages sent to the
4
WatchGuard Log Server in the XML format standard for Fireware v8.0 or higher. The WSM/Log
148 Firebox X Edge e-Series