I have a sonicwall os firewall, and the security dashboard shows about 9 intrusion prevention events in the last month. Most are called "Suspicious CIFS traffic 4". I have syslog servers setup with facility local 0 for remote centralized logging.
I can't see any sign of the IPS events in syslog. I see nearly everything else I can think of, every connection open/closing, websites blocked due to content, bad password attempts , Smurf amplification attempts blocked, etc...
My only guess is I need to change the facility setting, but the few hits I find seem to say use the one I have.
Is sonicwall keeping those events out of the syslog to force me to buy their logging tools? Or am I just being dimmer than usual?