IPS Debugging Sophos XG19

Question

Is there a Best Practice/Guide/HowTo document that described how to go about investigating IPS problems? I seem to go round this every time I have an IPS issue, but somehow never find what help I am looking for - which may be my own shortcomings in searching. 
 The notifications don't tell you much, and the documentation doesn't seem to say much about the individual rules. 
 
 Regards, 
 Paul McGinnie

Vivek Jagad · Answer

Hello Paul McGinnie , Thank you for reaching out to the community. You can check the logging with the help CLI: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Logs/LogFileDetails/index.html To enable/disable the *IPS logs: service ips:debug -ds nosync To check the live logs: tail -f /log/ips.log *NOTE - Ensure the " Log firewall traffic." is enabled under the firewall rule.