2

I have a sonicwall os firewall, and the security dashboard shows about 9 intrusion prevention events in the last month. Most are called "Suspicious CIFS traffic 4". I have syslog servers setup with facility local 0 for remote centralized logging.

I can't see any sign of the IPS events in syslog. I see nearly everything else I can think of, every connection open/closing, websites blocked due to content, bad password attempts , Smurf amplification attempts blocked, etc...

My only guess is I need to change the facility setting, but the few hits I find seem to say use the one I have.

Is sonicwall keeping those events out of the syslog to force me to buy their logging tools? Or am I just being dimmer than usual?

  • 1
    I think this is better suited for Serverfault than security stackexchange, you will have more luck there since more people will have experience with setting up Sonicwall. – Lucas Kauffman Jan 4 '13 at 7:23
1

Silly me.

I had "Low Priority" events not being logged.
For those who might be having a similar experience, I had forgotten that there were so many events logged (browsing activity, etc...) that it didn't seem warranted to keep the low priority events being logged. That said, I'm not sure why things like This "IPS Detection Alert: FILE-TYPES-HTTP Image -- JPEG 1A (HTTP Download)" would be considered a low level intrusion, but I'm not a firewall expert. On the dashboard, they seem to be categorized differently than the Suspicious CIFS that I was looking for in the first place. I find that a little frustrating and curious, but no point in venting here.

The Suspicious CIFS is considered a Low Priority threat according to sonicwall.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.