Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

click it to view its Details window. Got to System > System Settings and click the Notifications tab.
Like many other settings on a Computer, you can instruct it to inherit default settings, or override them.
To instruct this Computer to ignore any inheritable default settings, select the "Forward Events To :" radio
button and enter the details for a different Syslog server, or to not forward logs at all. Follow the same
procedure to override the setting on a Security Profile.
Parsing Syslog Messages
The Client Plug-in sends two types of logs to Syslog: Firewall Event Logs, and DPI Event Logs. Firewall
Event Logs are prefixed with "dsa_mpf:" and DPI Event Logs are prefixed with "dsa_mpld:". The content
of the log is a space-separated string (comma-separated prior to version 4.5) containing additional
information.
Note that syslog messages are limited to 1024 characters by the syslog protocol specification. In
rare cases data may be truncated if long rule and interface names are used.
Firewall Event Log Format
The Client Plug-in follows the format used by netfilter/iptables as closely as possible, and adds several
Trend Micro specific fields. Fields are delimited by a single space character, and consist of a TOKEN or a
TOKEN=value string. The value string will never contain space characters. In the case of items such as
rule names or network interface names, space characters are converted to underscores.
Name Description Examples
Reason The "REASON=" field contains
either a built-in string or the
string "PKT:" followed by the
name of the Firewall Rule that
caused the log. Space
characters in the Firewall Rule
name are converted to
underscores.
Interface
Information
Interface name and Ethernet
frame information. The IN=,
OUT=, and MAC= fields are
always present. If the packet is
an incoming packet the
interface name follows IN=,
and the OUT= field contains
nothing. The opposite is true
for outgoing packets.
The MAC= field consists of 14
two-digit hex characters. The
first six are the destination
MAC address, the next six are
the source MAC address, and
the last two are the Ethernet
frame type.
IP Information For IP packets, the source and
destination IPs in numeric
form.
Packet Length The LEN= field gives the length
of the received packet.
Fragmentation The "DF" field is present if the DF
REASON=Unsolicited_UDP
REASON=PKT:Block_Incoming_NetBIOS_broadcasts
IN=LAN_-_Gigabit OUT=
MAC=FF:FF:FF:FF:FF:FF:00:80:C8:38:79:E3:08:00
IN= OUT=eth2
MAC=00:11:95:B9:A5:AD:00:11:95:B9:A5:B4:08:00
SRC=192.168.5.9 DST=192.168.5.255
SRC=192.168.5.8 DST=192.168.5.255
LEN=216
LEN=92
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 89 -