This article applies to:
Symptoms:
- NetScreen firewall report does not show a virus warning as a security event.
Causes:
NetScreen firewall log files need to have the msg= field for the entry to be considered an event.
An example is provided below of a line containing a virus warning, but does not contain a msg= field. This entry will not be considered to be a security event in the Firewall Suite report.
WTsyslog[2002-05-22 19:01:38 ip=192.168.3.1 pri=6] <134>ns100: NetScreen device_id=05000410 system-warning-00540: AV: VIRUS FOUND: 192.168.3.100(4289)->212.959.120.150(80), scanner message: REASON:eicar.com contains a virus Eicar_test_file. The file is delet (2002-08-30 21:11:17)
This virus warning example does include the msg= field. This entry will be considered a security event.
WTsyslog[2002-05-22 19:01:42 ip=192.168.3.1 pri=6] id=firewall time="2002-08-30 21:11:16" fw=05000410 pri=6 rule=10 proto=dns src=192.168.3.100 dst=165.21.83.88 sent=86 rcvd=102 duration=1 msg="Action:Permit" module=system level=notification type=00257
Information:
If you are not logging the msg= field, please follow the steps for configuring your NetScreen firewall, provided in the Firewall Configuration Guide found on the page linked below.
https://support.trustwave.com/Firewall-Suite/Documentation.asp
If you have completed all of the necessary steps in the Firewall Configuration Guide and you are still unable to log the needed field, please contact NetScreen for additional assistance.
- This article was previously published as:
- NETIQKB14277