Sophos XG Firewall | Appendix A - Logs | 558
Message ID
17506
17507
17504
17970
17971
17504
Message
Wizard
Admin login logout
<interface name>: Disconnect PPPoE due to Admin event
Ha enable event
Ha disable event
PPTP/L2TP Service Enabled/Disabled
Successfully
Sample Logs:
device="SFW" date=2017-01-31 time=18:15:43 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=062009617502 log_type="Event" log_component="GUI" log_subtype="Admin" status="Successful" priority=Information user_name="admin" src_ip=10.198.47.71
message="Log Settings were changed by 'admin' from '10.198.47.71' using
'GUI'" device="SFW" date=2017-01-31 time=18:15:50 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=062009617507 log_type="Event" log_component="GUI" log_subtype="Admin" status="Successful" priority=Information user_name="admin" src_ip=10.198.47.71
message="Administrator 'admin' logged out of Web Admin Console."
Module-specific Fields
Data Fields
status user_name src_ip message
Type
string string string string
Description
Ultimate status of traffic – Allowed or
Denied
User name
Original Source IP address of traffic
Message displayed
Sandbox Report Logs
Message ID
13013
13014
18041
18042
18043
16005
16006
16007
Message
Sandbox allowed
Sandbox denied
Sandbox file allowed
Sandbox file denied
Sandbox file pending
Website/file/application access is warned allowed according to the Internet access policy
Website/file/application access is warned blocked according to the Internet access policy
HTTP file upload warned allowed
