stream (Next Gen Services)

Name of security log stream.

Selects the type of events that may be logged

• aamw—AAMW events are logged

• alg—Alg events are logged

• all—All events are logged

• appqos—Appqos events are logged

• content-security—Content security events are logged

• dns—DNS events are logged

• dnsf—DNS Filtering events are logged

• flow—Flow events are logged

• fw-auth—Fw-auth events are logged

• gtp—Gtp events are logged

• ha—Stateful High-Availability open and close events are logged

• ha-close—Stateful High-Availability close events are logged

• ha-open—Stateful High-Availability open events are logged

• idp—Idp events are logged

• ipsec—Ipsec events are logged

• nat—Nat events are logged

• pcp—PCP logs

• pst-ds-lite—Pst-ds-lite events are logged

• rtlog—Rtlog events are logged

• screen—Screen events are logged

• sctp—Sctp events are logged

• secintel—Secintel events are logged

• session—Session open and close events are logged

• session-close—Session close events are logged

• session-open—Session open events are logged

• sfw—Stateful Firewall events are logged

• urlf—URL filtering events are logged

Specify the log stream format

• binary—Binary log

• protobuf—Protobuf log

• sd-syslog—Structured syslog

• syslog—Traditional syslog

• welf—Web Trends Extended Log Format

Send logs to host

• ipaddr—IP address or host name

• log-tag—Tag included in logs to this host. Supported for sw, session, session-open, and session-close categories only.

• port—Host port number

• routing-instance—Routing-instance name

Radius configuration

• ipaddr—IP address for primary and backup radius server

• port—Radius server port number

• secret—Radius secret

Rate-limit for security logs. The log rate range is 1 through 65535

Severity threshold for security logs

• alert—Conditions that require immediate attention

• critical—Critical conditions

• debug—Information normally used in debugging

• emergency—Conditions that cause security functions to stop

• error—General error conditions

• info—Information about normal security operations

• notice—Non-error conditions that are of interest

• warning—General warning conditions

Source ip address used when exporting security logs

Time format for syslog events

• millisecond—Millisecond in time format for syslog

• year—Year in time format for syslog

Set security log transport settings

• protocol—Set security log transport protocol for the device

  • tcp—TCP transfer for log

  • tls—TLS transfer for log

  • udp—UDP transfer for log

• tcp-connections—Set tcp connection number per-stream. Range is 1 through 5

• tls-profile—TLS profile