Sophos XG Firewall | Appendix A - Logs | 557
Log Component
External Authentication
Message ID
17968
Message
connection to ADS/LDAPS <server ip/fqdn> failed because <reason>
Sample Logs
device="SFW" date=2017-01-31 time=18:13:38 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=062910617701 log_type="Event" log_component="Firewall
Authentication" log_subtype="Authentication" status="Successful" priority=Information user_name="gaurav" usergroupname="Open Group" auth_client="Web Client" auth_mechanism="Local" reason="" src_ip=10.198.47.71
message="User gaurav of group Open Group logged in successfully to Firewall through Local authentication mechanism from 10.198.47.71" name="gaurav" src_mac= device="SFW" date=2017-01-31 time=18:13:40 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=062910617703 log_type="Event" log_component="Firewall
Authentication" log_subtype="Authentication" status="Successful" priority=Information user_name="gaurav" usergroupname="Open Group" auth_client="Web Client" auth_mechanism="N/A" reason="" src_ip=10.198.47.71
src_mac= start_time=1485866617 sent_bytes=1233 recv_bytes=1265 message="User gaurav was logged out of firewall" name="gaurav" timestamp=1485866620
Module-specific Fields
Data Fields
status user_name usergroupname auth_client reason src_ip src_mac sent_bytes recv_bytes message timestamp
Type
string string string string string string integer integer string integert
Description
Ultimate status of traffic – Allowed or
Denied
User name
Group name to which the user belongs.
Original Source IP address of traffic
Original Source MAC address of traffic
Total number of bytes sent
Total number of bytes received
Message displayed timestamp
Admin Logs
Message ID
17501
17502
17503
17504
17505
Message
Add operation
Update
Delete
Other management action
System - Maintenance actions
