Sophos XG Firewall | Appendix A - Logs | 532
Data Fields
dst_port bytes_sent bytes_received status message appresolvedby
Type
integer integer integer string string string
Description
Original Destination Port of TCP and
UDP traffic
Total number of bytes sent
Total number of bytes received
Ultimate state of traffic – accept/deny
Message displayed
Application is resolved by signature or synchronized applications
Malware Logs
HTTP, HTTPS, FTP Logs are displayed only if Web Protection Module is subscribed.
POP, POPS, IMAP, IMAPS, SMTP and SMTPS Logs are displayed only if Web Protection Module is subscribed.
Message ID
08001
08002
09001
09002
10001
10002
11001
11002
12001
12002
Message
The URL has been blocked as it contained a virus
Access to URL is allowed as it does not contain any virus
FTP data transfer was blocked as it contained a virus
FTP data transfer didn’t have any virus and completed successfully
The mail is infected with a virus detected by the Device
Mail doesn’t contain any virus
The mail is infected with a virus detected by the Device
Mail doesn’t contain any virus
The mail is infected with a virus detected by the Device
Mail doesn’t contain any virus
Log Component
HTTP
HTTP
FTP
FTP
SMTP
SMTP
POP3
POP3
IMAP4
IMAP4
Module-specific Fields
Data Fields Type
time, date, timezone string log_component log_subtype string string
Description
System-local date/time at which the event occurred.
Application protocol or firewall component that detected the malware.
log_subtype="Virus"
