This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS Logging

How does one enable logging (so one can see it in the Log Viewer in the management web interface) of IPS events.

Every time I have a IPS problem, I get email notifications but the IPS Log Viewer tab is empty - how can i get it to populate?

Regards,

Paul McGinnie

SFOS 19.0.0 GA-Build317 on own hardware

This thread was automatically locked due to age.

Top Replies

Wayne Folta over 2 years ago in reply to Paul McGinnie +1 suggested

Turning on logging for the rule is only one part. Did you enable logging of IPS in System Services > Log Settings?

0 Vivek Jagad over 2 years ago

Hello Paul McGinnie,

Thank you for reaching out to the community, in order to see the logging events of the IPS, ensure under the firewall rule the option: "Log firewall traffic." is enabled.
Also check under the Intrusion prevention > IPS Polices > IPS protection is enabled. Here you can also see number firewall rules using IPS.
And Under the System services > Log settings > IPS. Is that enabled ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Global Support & Services

Log a Support Case | Sophos Service Guide
Best Practices – Support Case

Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Paul McGinnie over 2 years ago in reply to Vivek Jagad

Hi - thanks for the quick reply. All but one of my rules has logging turned on, and IPS Protection is enables (and it records it is used by 44 rules). However, I still have literally nothing in the IPS Log Viewer tab, not just nothing relevant - zero entries.

Is there anything that might be blocking this?

Many thanks,

Paul McGinnie
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 2 years ago in reply to Paul McGinnie

are you facing this particular issue only with the IPS logs or rest of the log entries are too not updating or show absolutely no entries ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Global Support & Services

Log a Support Case | Sophos Service Guide
Best Practices – Support Case

Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Paul McGinnie over 2 years ago in reply to Vivek Jagad

My firewall log is full, my email has entries etc. IPS is blank!

In another thread I show the ips.log file from the firewall itself - so something is happening.

Regards,

Paul
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 2 years ago in reply to Paul McGinnie

If possible try restarting the IPS service from System services > Services > IPS > STOP/RESTART/START

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Global Support & Services

Log a Support Case | Sophos Service Guide
Best Practices – Support Case

Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Wayne Folta over 2 years ago in reply to Paul McGinnie

Turning on logging for the rule is only one part. Did you enable logging of IPS in System Services > Log Settings?
Cancel
Vote Up +1 Vote Down

Cancel