Sophos XG Firewall | Appendix A - Logs | 534
Figure 495: Security Heartbeat Log Viewer
Log ID Structure
Log is identified by Log ID. Log ID is a unique 12 characters code c1c2c3c4c5c6c7c8c9c10c11c12
Where: c1c2 - Log Type ID c3c4 - Log Component ID c5c6 - Log Sub Type ID c7 - Priority c8c9c10c11c12 - Message ID
For example, if the Log ID is 010101600001.
c1c2 – 01 c3c4 – 01 c5c6 – 01 c7 - 6 c8c9c10c11c12 - 00001
Hence, from the Log ID, we derive:
Log Type
(01) = Firewall
Log Component
(01) = Firewall Rule
Log Sub-type
(01) = Allowed
Priority
(6) = Information
Message (00001) = Firewall Traffic Allowed (to be seen under appropriate type of logs. Here, since Log Type is
Firewall, Message is found under Firewall Logs)
Log Type
Log Type ID identifies the type of log.
Type ID
01
02
03
04
05
Log Type
Security Policy
IPS
Anti Virus
Anti Spam
Content Filtering
Sophos XG Firewall | Appendix A - Logs | 535
Type ID
10
11
12
13
06
07
08
09
Log Type
Event
WAF
ATP
EATP
Wireless Protection
HeartBeat
System Health
Sandbox
Log Component
Log Component ID identifies the component of the log.
Comp ID
13
14
15
16
09
10
11
12
05
06
07
08
01
02
03
04
21
22
23
24
17
18
19
20
Component
Firewall Rule
Invalid Traffic
Appliance Access
DoS Attacks
ICMP Redirection
Source Routed
Anomaly
Signatures
HTTP
FTP
SMTP
POP3
IMAP4
Fragmented Traffic
Invalid Fragmented Traffic
HA
CLI
LCD
CCC
IM
Foreign Host
IPMAC Filter
IP Spoof
GUI
Comp ID
53
54
55
56
49
50
51
52
57
58
59
60
45
46
47
48
41
42
43
44
37
38
39
40
33
34
35
36
29
30
31
32
25
26
27
28
Sophos XG Firewall | Appendix A - Logs | 536
Component
IPsec
L2TP
PPTP
SSL VPN
Firewall Authentication
VPN Authentication
SSL VPN Authentication
My Account Authentication
Appliance
DHCP Server
Interface
Gateway
DDNS
WebCat
IPS
AV
Dial-In Authentication
Dial-In
Quarantine
Application Filter
Landing Page
WLAN
ARP Flood
HTTPS
Guest User
WAF
Virtual Host
CTA
NTLM
Appliances Deactivated
PPPoE
External Authentication
API
ICAP
SMTPS
Wireless Controller
Comp ID
73
74
75
76
69
70
71
72
65
66
67
68
61
62
63
64
81
82
83
77
78
79
80
Log Subtype
Log Subtype ID
05
06
07
08
01
02
03
04
09
10
Component
POPS
IMAPS
Firewall
DNS
Web Proxy
Heartbeat
End Point
RED
ATP
SSL VPN Client
IPsec Client
Authentication Client
RED Firmware
AP Firmware up2date
CPU
Memory
Disk
Live User
Missing Heartbeat
Enhanced app control
ICMP related packets
Mail proxy
Sub type
Allowed
Denied
Detect
Drop
Clean
Virus
Spam
Probable Spam
Admin
Authentication
Sophos XG Firewall | Appendix A - Logs | 537
