When I try to enable "Output Blocking Event Log" under Logging Config, the checkbox to send IPS logging entries to the Syslog (Logs Facility And Severity) is automatically disabled.
Is this a known bug? Is there a workaround. Or is this by design?
Also, we have noticed that we are no longer getting very many IPS entries in the log after enabling Protectlink Web. Is this because Protectlink is stopping the *intruders* before they get to the IPS layer? All we have enabled in under Protectlink is Web Threat Protection (default of medium) and all entries under (Computers/Harmful) in URL Filtering.
Let me know if I'm not making sense.