Adding an event processor, Enabling syslog logging, Editing an event processor setting – WatchGuard Technologies FireboxTM System 4.6 User Manual
Page 81
User Guide
71
Designating Event Processors for a Firebox
you run the QuickSetup wizard. You can specify a different primary Event Processor
as well as multiple backup Event Processors.
Adding an Event Processor
From Policy Manager:
1
Select Setup => Logging.
2
Click Add.
3
Enter the IP address to be used by the Event Processor.
4
Enter the encryption key that secures the connection between the Firebox and the
Event Processor.
The default encryption key is the monitoring passphrase set in the QuickSetup wizard. You must
use the same log encryption key for both the Firebox and the LiveSecurity Event Processor.
5
Click OK.
Repeat until all primary and backup Event Processors appear in the LiveSecurity Event
Processors list.
Enabling Syslog logging
Note that Syslog logging is not encrypted; therefore, do not set the Syslog server to a
host on the External interface. From Policy Manager:
1
Select Setup => Logging.
The Logging Setup dialog box appears.
2
In the Logging Setup dialog box, click the Syslog tab.
3
Enable the Enable Syslog Logging checkbox.
4
Enter the IP address of the Syslog server.
Editing an Event Processor setting
Modify an Event Processor entry to change the log encryption key. From Policy
Manager:
1
Select Setup => Logging.
The Logging Setup dialog box appears.
2
Click the host name. Click Edit.
3
Modify the IP address or log encryption key fields. Click OK.
You must use the same log encryption key for both the Firebox and the LiveSecurity Event
Processor. To change the log encryption key on the Event Processor, see “Setting the log
• IP address of each Event Processor
• Encryption key to secure the connection between the Firebox and Event
Processors
• Priority order of primary and backup Event Processors