Login
- Table of Contents
-
- 07-System
- 01-High availability group
- 02-VRRP
- 03-Track
- 04-BFD
- 05-NQA
- 06-Basic log settings
- 07-Session log settings
- 08-NAT log settings
- 09-AFT log settings
- 10-Threat log settings
- 11-Application audit log settings
- 12-NetShare log settings
- 13-URL filtering log settings
- 14-Attack defense log settings
- 15-Bandwidth alarm logs
- 16-Configuration log settings
- 17-Security policy log
- 18-Heartbeat log settings
- 19-IP access logs
- 20-WAF log settings
- 21-Bandwidth management logs
- 22-Context rate limit logging
- 23-Report settings
- 24--Session settings
- 25-MAC authentication online users
- 26-Signature upgrade
- 27-Software upgrade
- 28-License management
- 29-IRF
- 30-IRF advanced settings
- 31-Contexts
- 32-Administrators
- 33-Date and time
- 34-MAC address learning through a Layer 3 device
- 35-SNMP
- 36-Configuration management
- 37-About
- 38-Reboot
- 39-Ping
- 40-Tracert
- 41-Packet capture
- 42-Webpage Diagnosis
- 43-Diagnostic Info
- 44-Packet trace
- 45-Load balancing test
- 46-IPsec diagnosis
- 47-Fast Internet Access
- 48-IP reputation log settings
- 49-Load balancing logging
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 14-Attack defense log settings | 28.02 KB |
Attack defense log settings
This help contains the following topics:
¡ Log aggregation for single-packet attack events
Introduction
Log aggregation for single-packet attack events
When you enable logging for single-packet attacks, the device generates logs when it detects single-packet attacks. The log generation and output require more system resources if single-packet attacks frequently occur. You can enable Log aggregation for single-packet attacks to save system resources. This feature aggregates multiple logs generated during a period of time and sends one log. Logs that are aggregated must have the following attributes in common:
· Attacks are detected on the same interface or security zone or are destined for the device.
· Attack type.
· Attack defense action.
· Source and destination IP addresses.
· VRF to which the victim IP address belongs.
Blacklist logging
With logging enabled for the blacklist feature, the system outputs logs in the following situations:
· A blacklist entry is manually added.
· A blacklist entry is dynamically added by the scanning attack detection feature.
· A blacklist entry is manually deleted.
· A blacklist entry ages out.
A blacklist log records the following information:
· Source IP address of the blacklist entry.
· Remote IP address of the DS-Lite tunnel.
· VRF name.
· Reason for adding or deleting the blacklist entry.
· Aging time for the blacklist entry.
Log buffer and log file
The device provides separate log buffers and log files for the blacklist module and the attack defense module. To enable outputting logs of service modules to their log buffers and log files, select the Output to log buffer option on the basic settings page for the syslog.
Logs are saved in the log file buffer before they are saved to the log file. After the system saves logs to the log file, the log file buffer is cleared.
When the maximum capacity of the log file is reached, the system replaces the oldest logs with new logs.
