Buy or Renew
Buy or Renew
Cisco + Splunk: It’s a new day for your data. Learn more.
 
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
728
Views
0
Helpful
2
Replies

SA540 Syslog Setup Problems

doug_counsil
Level 1
Level 1

‎06-04-2012 09:04 PM

When I try to enable "Output Blocking Event Log" under Logging Config, the checkbox to send IPS logging entries to the Syslog (Logs Facility And Severity) is automatically disabled.

Is this a known bug?  Is there a workaround.  Or is this by design?

Also, we have noticed that we are no longer getting very many IPS entries in the log after enabling Protectlink Web.  Is this because Protectlink is stopping the *intruders* before they get to the IPS layer?  All we have enabled in under Protectlink is Web Threat Protection (default of medium) and all entries under (Computers/Harmful) in URL Filtering.

Let me know if I'm not making sense.

Labels:
0 Helpful
2 Replies 2

doug_counsil
Level 1
Level 1

‎06-16-2012 09:30 AM

I hope the Cisco Engineers are reading these posts.  We really need to send IPS and Protectlink to our syslog server.  Right now they are mutually exclusive.  This is a bug and I don't know if Cisco is aware of it or not.

0 Helpful

linksysinfo
Level 4
Level 4
In response to doug_counsil

‎06-16-2012 09:51 AM

Best if you raise a ticket with Cisco SBSC and raise your concerns/issues with them and get the to forward them onto the development team. That way it will at least be past on to the relevant team instead of hoping they will read this thread.

Sent from Cisco Technical Support iPad App

Regards Simon
0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents