Understanding IDP Logging

The basic Junos OS system logging continues to function after Intrusion Detection and Prevention (IDP) is enabled. An IDP-enabled device continues to record events that occur because of routine operations, such as a user login into the configuration database. It records failure and error conditions, such as failure to access a configuration file. You can configure files to log system messages and also assign attributes, such as severity levels, to messages. In addition to the regular system log messages, IDP generates event logs for attacks. For information about monitoring events, managing system log files, and configuring packet capture see the Junos OS Administration Guide for Security Devices.

IDP generates event logs when an event matches an IDP policy rule in which logging is enabled. When you configure a rule for logging, the device creates a log entry for each event that matches that rule. You can use the CLI or J-Web to configure the policy rules to generate event logs.

Because IDP event logs are generated during an attack, log generation happens in bursts, generating a much larger volume of messages during an attack. In comparison to other event messages, the message size is also much larger for attack generated messages. The log volume and message size are important concerns for log management. To better manage the volume of log messages, IDP supports log suppression.

By configuring log suppression you can suppress multiple instances of the same log occurring from the same or similar sessions over the same period of time. Enabling log suppression ensures that minimal numbers of logs are generated for the same event or attack that occurs multiple times.

Related Topics

• Junos OS Feature Support Reference for SRX Series and J Series Devices
• IDP Policies Overview
• Understanding IDP Policy Rules
• Understanding IDP Log Suppression Attributes
• Understanding IDP Log Information Usage on the Infranet Controller
• Example: Defining Rules for an IDP IPS Rulebase