SonicOS Log Event Reference Guide - SonicWALL

COMPREHENSIVE INTERNET SECURITY
S o n i c WALL Internet Security Ap p l i a n c e s
SonicOS Log Event Reference Guide

Using the SonicOS Log Event
Reference Guide
This reference guide lists and describes SonicOS log event messages. Reference a log event message
by using the alphabetical index of log event messages.
This document contains the following sections:
• “SonicOS Log Event Messages Overview” on page 1
• “Configuring SonicOS ‘Log’ > ‘View’” on page 4
• “Referencing the SonicOS ‘Log’ > ‘View ’ Field Display” on page 7
• “Index of Log Event Messages” on page 9
• “Index of Syslog Tag Field Description” on page 63
SonicOS Log Event Messages Overview
During the operation of a SonicWALL security appliance, SonicOS software sends log event messages
to the ‘Log’ > ‘View’ page in the SonicWALL management interface.
In Figure 1, the ‘Log’ > ‘View’ page is displayed.
Figure 1
SonicOS Enhanced ‘Log’ > ‘View’ page
Note:
Event logging automatically begins when the SonicWALL security appliance is powered on and configured.
SonicOS supports a traffic log containing entries with multiple fields.
Log event messages provide operational informational and debugging information to help you diagnose
problems with communication lines, internal hardware, or your firmware configuration.
For the SonicOS CLI console display, use the show log command to display log events. Refer
to the SonicOS CLI Reference Guide located on the SonicWALL Web site:
SONICOS LOG EVENT REFERENCE GUIDE 1

Note:
Not all log event messages indicate operational issues with your SonicWALL security
appliance.
SonicOS Log Entries
Each log entry contains the date and time of the event and a brief message describing the event. The
SonicWALL manages log events in the following manner:
• TCP, UDP, or ICMP packets dropped
When IP packets are dropped by the SonicWALL security appliance, dropped TCP, UDP and
ICMP messages are displayed. The messages include the source and destination IP addresses of
the packet. The TCP or UDP port number or the ICMP code follows the IP address. Log event
messages usually include the name of the service in quotation marks.
• Web, FTP, Gopher, or Newsgroup blocked
When a computer attempts to connect to the blocked site or newsgroup, a log event is displayed.
Blocked is defined as a Web site, connection, or event that is denied access from the SonicWALL
security appliance. The computer’s IP address, Ethernet address, the name of the blocked Web
site, and the Content Filter List Code is displayed. Code definitions for the 12 Content Filter List
categories are shown below.
1. Violence 7. Cult
2. Intimate Apparel/Swimsuit
8. Drugs/Illegal Drugs
3. Nudism 9. Criminal Skills/Illegal Skills
4. Adult/Mature Content/
Pornography
10. Sex Education
5. Weapons 11. Gambling
6. Hate/Racism 12. Alcohol & Tobacco
• ActiveX, Java, Cookie or Code Archive blocked
When ActiveX, Java or Web cookies are blocked, messages with the source and destination IP
addresses of the connection attempt is displayed.
• Ping of Death, IP Spoof, and SYN Flood Attacks
The IP address of the machine under attack and the source of the attack is displayed. In most
attacks, the source address shown is fake and does not reflect the real source of the attack.
SonicOS ‘Log View Settings’
The ‘Log View Settings’ section of the ‘Log’ > ‘View’ page provides you the filtering controls to filter log
event messages based on your configured log filter logic. It also contains the following log management
buttons:
• Refresh—Renews the ‘Log View’ table with current log event messages.
• Clear Log—Empties the entries in the ‘Log View’ table.
• E-mail Log—E-mails log event messages to your configured SMTP server or list of e-mail
addresses.
• Export Log—Exports the log into a plain .txt or .csv file format.
2 SONICOS LOG EVENT REFERENCE GUIDE

SonicOS ‘Log View’ Display Format
The ‘Log’ > ‘View’ page displays log event messages in following format for alert notification:
• Time—Displays the hour and minute the event occurred.
• Priority—Displays the level urgency for the event.
• Category—Displays the event type.
• Message—Displays a description of the event.
• Source—Displays the source IP address of incoming IP packet.
• Destination—Displays the destination IP address of incoming IP packet.
• Note—Displays displays additional information specific to a particular event occurrence.
• Rule—Displays the source and destination zones for the access rule. This field provides a link to
the access rule defined in the ‘Firewall’ > ‘Access Rules’ page.
The display fields for a log event message provides you with data to verify your configurations, trouble-shoot
your security appliance, and track IP traffic.
SONICOS LOG EVENT REFERENCE GUIDE 3

Configuring SonicOS ‘Log’ > ‘View’
The ‘Log’ > ‘View” page in the Web-based SonicWALL management interface allows you to export log
reports, e-mail log reports, and monitor real-time Syslog data. As soon as you power on your SonicWALL
security appliance, SonicOS software sends Syslog data to your log. In the SonicWALL management
interface, you can navigate through the subcategories of the ‘Log’ setting for reporting and
customizing log reports.
In Figure 2, the ‘Log’ > ‘View’ page is displayed.
Figure 2 SonicOS Enhanced ‘Log’ > ‘View’ page
4 SONICOS LOG EVENT REFERENCE GUIDE

Setting the Log Filter Logic
By default, the SonicOS filter logic is set to “Priority && Category && Source && Destination.” The
double ampersand symbols (&&) indicate the boolean expression “and.” The default SonicOS filter
logic displays all log events.
In Figure 3, the ‘Log’ > ‘View’ > ‘Log View Settings’ page is displayed.
Figure 3
SonicOS ‘Log View Settings’
Log Event Message Filters
Default filter logic value
Group filters
Apply filters
Default filter logic
Export logs
Reset filters
Applying Custom Log Event Message Filters
This section provides examples on using the ‘Log View Settings’ to filter log event messages displayed
in the ‘Log View’ page.
Configuration Example: Filtering Log Event Messages by Priority Value
To set the log filter logic to display only log event messages with a priority level of Emergency:
1. Select Emergency from the filter-Priority Value pull-down menu.
2. Click on the Apply Filters button.
Configuration Example: Filtering Log Event Messages by Category Value
To set the log filter logic to display only log event messages with a category event type of Attacks:
1. Select Attacks from the filter-Category Value pull-down menu.
2. Click on the Apply Filters button.
SONICOS LOG EVENT REFERENCE GUIDE 5

Configuration Example: Filtering Log Event Messages by Source Value
To set the log filter logic to display only log event messages associated to a source IP address:
1. Enter the source IP address or select an interface from the filter-Source Value pull-down menu.
2. Click on the Apply Filters button.
Configuration Example: Filtering Log Event Messages by Destination Value
To set the log filter logic to display only log event messages associated to a destination IP address:
1. Enter the destination IP address or select an interface from the filter-Source Value pull-down
menu.
2. Click on the Apply Filters button.
Using Group Filters
Note:
Use Group filters to change the default SonicOS filter logic (Priority && Category && Source && Destination)
from double ampersand symbols (&&) to double pipe symbols (||) to indicate the boolean
expression “or.” When using group filters, select two or more Group Filters checkboxes.
If you select only one Group Filter checkbox, the filter logic will remain the same. Selecting only
the Priority-Group Filter checkbox provides you with the following filter logic:
(Priority) && Category && Source && Destination
Configuration Example: Using the ‘Priority’ Group Filter and ‘Category Group’ Filter
To set the log filter logic to display log event messages with a priority level of Emergency or a category
event type of Attack:
1. Select the ‘Priority’ group filter checkbox.
2. Select the ‘Category’ group filter checkbox.
3. Select Emergency from the filter-Priority Value pull-down menu.
4. Select Attacks from the filter-Category Value pull-down menu.
Figure 4 illustrates the SonicOS filter logic updated as follows:
(Priority || Category) && Source && Destination
Figure 4 SonicOS Log Group Filters
A filter logic using the boolean expression “||” is less restrictive than the default filter logic using the
boolean expression “&&”. With the boolean expression “||”, log event messages are displayed if they
match either filter values. With the boolean expression “&&”, log event messages are displayed if they
match both filter values.
6 SONICOS LOG EVENT REFERENCE GUIDE

Exporting the Logs to a File
This section provides instructions to export your log to a file.
To export the log to a file:
1. Click on the Export Log button. You will be prompted to select a export file format type as
illustrated in Figure 5.
Figure 5 SonicOS Export Log
Note:
2. Select a file format:
Plain text format used in log and alert e-mail—Saves the log file as plain text, which can be
used for alert e-mails.
Comma-Separated Value (CSV) format—Saves the log file for importing into Microsoft Excel or
other presentation development application.
3. Click on the Export button.
4. Save the exported log file to a location on your personal computer’s hard drive.
You can export a log to a file with applied filter settings.
Referencing the SonicOS ‘Log’ > ‘View ’
Field Display
SonicOS 2.5 Enhanced and Standard releases and greater provide the SonicOS ‘Log’ > ‘View’ field
display as illustrated in Figure 6.
Figure 6 SonicOS ‘Log’ > ‘View’ Field Display
Time and Date Stamp
Category
Source IP Address
Log Event Notes
Priority
Message Descrition
Destination IP
Network Rule
SONICOS LOG EVENT REFERENCE GUIDE 7

Referencing the SonicWALL Firmware ‘Log’ > ‘View Log’ Field Display
SonicWALL Firmware 6.6.0.0 release and greater provide the SonicWALL Firmware ‘Log’ > ‘View
Log’ field display as illustrated in Figure 7.
Figure 7
SonicWALL Firmware Log’ > ‘View Log’ Field Display
Time and Date Stamp
Source IP Address
Additional Information
Event Message
Destination IP Address
Rule Number (If Applicable)
8 SONICOS LOG EVENT REFERENCE GUIDE

Index of Log Event Messages
This section contains a list of log event messages for all SonicWALL Firmware and SonicOS Software
Releases, ordered alphabetically. Use your web browser’s Find function to search for a command.
Log Event Message Symbols Key
Log Event Message Symbol Description Context
%s Ethernet Port Down Represents a character string. [WAN | LAN | DMZ] Ethernet Port
Down
The cache is full; %u open
connections; some will be dropped
Represents a numerical string.
The cache is full; [40,000] open
connections; some will be dropped
TCP IP Layered-Data Packet Processing and SonicOS Log Event Handling
In specific cases of multi-layer packet processing, a TCP connection initially logged as "open," will be
rejected by a deeper layer of packet processing. In these cases, the connection request has not been
forwarded by the SonicWALL security appliance, and the initial Connection Open SonicOS log event
message should be ignored in favor of the TCP Connection Dropped log event message.
Each log event message described in the following table provides the following log event details:
• SonicOS Category—Displays the SonicOS Software category event type.
• Legacy Category—Displays the SonicWALL Firmware Software category event type.
• Priority Level—Displays the level of urgency of the log event message.
• Log Message ID Number—Displays the ID number of the log event message.
• SNMP Trap Type—Displays the SNMP Trap ID number of the log event message.
Log Event
Message
SonicOS
Category
Legacy
Category
Priority
Level
Log
Message
ID
Number
SNMP
Trap
Type
Log Event
Type
#Web site hit
Network
Traffic
Connection
Traffic
Information 97 --- Standard
HTTP
Traffic
Report
%s VPN IKE User Activity Information 171 --- Standard
Message
String
%s ARS --- Information 840 --- Standard
Message
String
%s ARS --- Notice 841 --- Standard
Message
String
%s ARS --- Debug 842 --- Standard
Message
String
SONICOS LOG EVENT REFERENCE GUIDE 9

%s Ethernet Port
Down
%s Ethernet Port
Up
%s-payload
processing error
Firewall Event System Error Error 333 641 Standard
String
Service
Firewall Event System Error Warning 332 640 Standard
String
Service
VPN IKE Debug Error 616 --- Standard
Message
String
SonicWALL
Registration
Update Needed:
Restore your
existing
security service
subscriptions by
clicking here.
Security
Services
Maintenance Warning 496 --- Simple
802.11b
Management
Wireless 802.11b
Management
Information 518 --- Simple
Destination
A prior version of
preferences was
loaded because the
most recent
preferences file
was inaccessible
A SonicOS
Standard to
Enhanced Upgrade
was performed
Firewall Event System Error Warning 572 648 Simple
Firewall Event Maintenance Information 611 --- Simple
Access attempt
from host out of
compliance with
GSC policy
Access attempt
from host without
Anti-Virus agent
installed
Access attempt
from host without
GSC installed
Security
Services
Security
Services
Security
Services
Maintenance Information 761 --- Standard
Maintenance Information 123 --- Standard
Maintenance Information 763 524 Standard
Access rule added Firewall Rule User Activity Information 440 --- Simple
Rule
Access rule
deleted
Firewall Rule User Activity Information 442 --- Simple
Rule String
10 SONICOS LOG EVENT REFERENCE GUIDE

Access rule
modified
Firewall Rule User Activity Information 441 --- Simple
Rule
Access to proxy
server denied
ActiveX access
denied
ActiveX or Java
archive access
denied
Network
Access
Network
Access
Network
Access
Blocked Sites Notice 60 705 Standard
Note
Blocked
Blocked Code Notice 18 --- Standard
Note
Blocked
Blocked Code Notice 20 --- Standard
Note
Blocked
AD agent %s is not
responding
Add an attack
message
Adding Dynamic
Entry for Bound
MAC Address
Adding L2TP IP
pool Address
object Failed
Adding to
multicast
policyList,
interface: %s
Adding to Multicast
policyList, VPN
SPI: %s
Administrator
logged out
Administrator
logged
out - inactivity
timer expired
Administrator login
allowed
Administrator login
denied due to bad
credentials
MS AD --- Error 769 --- Standard
Message
String
Firewall Event Attack Error 143 525 Simple
String
Network --- Information 813 --- Standard
Note ENET
L2TP Server System Error Error 603 661 Simple
Multicast --- Debug 697 --- Standard
Message
String
Multicast --- Debug 699 --- Standard
Message
String
Authentication User Activity Information 261 --- Standard
Authentication User Activity Information 262 --- Standard
Authentication User Activity Information 29 --- Standard
Authentication Attack Alert 30 560 Standard
SONICOS LOG EVENT REFERENCE GUIDE 11

Administrator login
denied from %s;
logins disabled
from this interface
Adminstrator name
changed
All DDNS
associations have
been deleted
All preference
values have been
set to factory
default values
Allowed LDAP
server certificate
with wrong host
name
Authentication Attack Alert 35 506 Standard
Message
String
Authentication Maintenance Information 328 --- Standard
DDNS Maintenance Information 783 --- Simple
Firewall Event System Error Warning 574 650 Simple
RADIUS User Activity Warning 752 --- Standard
Note String
Anti-Spyware
Detection Alert: %s
Anti-Spyware
Prevention Alert:
%s
Anti-Spyware
Service Expired
Anti-Virus agent
out-of-date on host
Anti-Virus
Licenses Exceeded
Intrusion
Detection
Intrusion
Detection
Security
Services
Security
Services
Security
Services
Attack Alert 795 576 Standard
Anti-Spy
Message
String
Attack Alert 794 575 Standard
Anti-Spy
Message
String
Maintenance Warning 796 577 Simple
Maintenance Information 124 --- Standard
Maintenance Information 408 --- Standard
Arp request packet
received
Arp request packet
sent
Arp response
packet received
Arp response
packet sent
Network --- Information 717 --- Standard
Note ENET
Network --- Information 715 --- Standard
Note ENET
Network --- Information 716 --- Standard
Note ENET
Network --- Information 718 --- Standard
Note ENET
ARP timeout Network Debug Debug 45 --- Standard
Association Flood
from wlan station
WLAN IDS WLAN IDS Alert 548 903 Simple
Destination
12 SONICOS LOG EVENT REFERENCE GUIDE

Authentication
timeout during
Remotely
Triggered Dial-out
session
Authentication User Activity Information 821 --- Simple
Back Orifice attack
dropped
Backup active
Backup firewall
being preempted
by Primary
Backup firewall
has transitioned to
Active
Backup firewall
has transitioned to
Idle
Backup going
Active in preempt
mode after reboot
Backup missed
heartbeats from
Primary
Backup received
error signal from
Primary
Backup received
reboot signal from
Primary
Backup shut down
because license is
expired
Backup will be
shut down in %s
minutes
Intrusion
Detection
High
Avaiability
High
Availability
High
Availability
High
Availability
High
Availability
High
Availability
High
Availability
High
Availability
High
Availability
High
Availability
Attack Alert 73 512 Standard
System Error Information 825 --- Simple
System Error Error 152 619 Simple
Maintenance Information 145 --- Simple
Maintenance Information 147 --- Simple
System Error Error 170 622 Simple
System Error Error 149 616 Simple
System Error Error 151 618 Simple
System Error Error 672 666 Simple
System Error Error 824 --- Simple
System Error Error 823 --- Standard
String
Service
Bad CRL format VPN PKI User Activity Alert 277 --- Simple
Destination
Blocked Quick
Mode for Client
using Default
KeyId
VPN Client System Error Error 505 660 Standard
SONICOS LOG EVENT REFERENCE GUIDE 13

BOOTP Client IP
address on LAN
conflicts with
remote device IP,
deleting IP address
from remote table
BOOTP reply
relayed to local
device
BOOTP Request
received from
remote device
BOOTP server
response relayed
to remote device
BOOTP Maintenance Information 619 --- Standard
Destination
BOOTP Maintenance Information 620 --- Standard
Destination
BOOTP Debug Debug 621 --- Standard
Destination
BOOTP Debug Debug 618 --- Standard
Destination
Broadcast packet
dropped
Network
Access
Debug Debug 46 --- Standard
Note
Protocol
Cannot connect to
the CRL server
Cannot Validate
Issuer Path
Certificate on
Revoked list (CRL)
VPN PKI User Activity Alert 274 --- Simple
Destination
VPN PKI User Activity Alert 878 --- Simple
Destination
VPN PKI User Activity Alert 279 --- Simple
Destination
CFL
auto-download
disabled, time
problem detected
Security
Services
Maintenance Information 268 --- Simple
CLI administrator
logged out
CLI administrator
login allowed
CLI administrator
login denied due to
bad credentials
Computed hash
does not match
hash received from
peer
Authentication User Activity Information 520 --- Simple
Authentication User Activity Information 199 --- Simple
Authentication User Activity Warning 200 --- Simple
VPN IKE User Activity Warning 410 --- Standard
Destination
14 SONICOS LOG EVENT REFERENCE GUIDE

Connection Closed
Note: In specific cases of
multi-layer packet processing,
a TCP connection initially
logged as "open," will be
rejected by a deeper layer of
packet processing. In these
cases, the connection request
has not been forwarded by
the SonicWALL security
appliance, and the initial
Connection Open SonicOS
log event message should be
ignored in favor of the TCP
Connection Dropped log
event message.
Network
Traffic
Connection
Traffic
Information 537 --- Standard
Traffic
Report
Connection
Opened
Note: In specific cases of
multi-layer packet processing,
a TCP connection initially
logged as "open," will be
rejected by a deeper layer of
packet processing. In these
cases, the connection request
has not been forwarded by
the SonicWALL security
appliance, and the initial
Connection Open SonicOS
log event message should be
ignored in favor of the TCP
Connection Dropped log
event message.
Network
Traffic
Connection Information 98 --- Standard
Note
Protocol
Connection timed
out
VPN PKI User Activity Alert 273 --- Simple
Destination
Cookie removed
Network
Access
Blocked Code Notice 21 --- Standard
String
Service
CRL has expired VPN PKI User Activity Alert 874 --- Simple
Destination
CRL loaded from VPN PKI User Activity Information 270 --- Simple
Destination
CRL
missing - Issuer
requires CRL
checking
CRL validation
failure for Root
Certificate
Crypto DES test
failed
Crypto DH test
failed
VPN PKI User Activity Alert 876 --- Simple
Destination
VPN PKI User Activity Alert 877 --- Simple
Destination
Crypto Test Maintenance Error 360 --- Simple
Crypto Test Maintenance Error 361 --- Simple
SONICOS LOG EVENT REFERENCE GUIDE 15

Crypto Hardware
3Des test failed
Crypto Hardware
3DES with SHA
test failed
Crypto Hardware
AES test failed
Crypto hardware
DES test failed
Crypto Haredware
DES with SHA test
failed
Crypto Hmac-MD5
fest failed
Crypto Hmac-Sha1
test failed
Crypto MD5 test
failed
Crypto RSA test
failed
Crypto Sha1 test
failed
DDNS association
%s disabled
DDNS association
%s enabled
DDNS association
%s added
DDNS association
%s deactivated
DDNS association
%s deleted
DDNS Association
%s put on line
Crypto Test Maintenance Error 367 --- Simple
Crypto Test Maintenance Error 369 --- Simple
Crypto Test Maintenance Error 610 --- Standard
Crypto Test Maintenance Error 366 --- Simple
Crypto Test Maintenance Error 368 --- Simple
Crypto Test Maintenance Error 362 --- Simple
Crypto Test Maintenance Error 363 --- Simple
Crypto Test Maintenance Error 370 --- Simple
Crypto Test Maintenance Error 364 --- Simple
Crypto Test Maintenance Error 365 --- Simple
DDNS Maintenance Information 781 --- Simple
Message
String
DDNS Maintenance Information 780 --- Simple
Message
String
DDNS Maintenance Information 779 --- Simple
Message
String
DDNS Maintenance Information 784 --- Simple
Message
String
DDNS Maintenance Information 785 --- Simple
Message
String
DDNS Maintenance Information 782 --- Simple
Message
String
16 SONICOS LOG EVENT REFERENCE GUIDE

DDNS association
%s taken Offline
locally
DDNS Failure:
Provider %s
DDNS Failure:
Provider %s
DDNS Failure:
Provider %s
DDNS Update
success for
domain %s
DDNS Warning:
Provider %s
Deleting from
Multicast policy
list, interface : %s
Deleting from
Multicast policy
list, VPN SPI : %s
DDNS Maintenance Information 778 --- Simple
Message
String
DDNS System Error Error 774 --- Simple
Message
String
DDNS System Error Error 775 --- Simple
Message
String
DDNS System Error Error 773 --- Simple
Message
String
DDNS Maintenance Information 776 --- Standard
Message
String
DDNS System Error Warning 777 --- Simple
Message
String
Multicast --- Debug 698 --- Standard
Message
String
Multicast --- Debug 700 --- Standard
Message
String
Deleting IPSec SA VPN IKE User Activity Information 92 --- Standard
Note SPI
DHCP client
enabled but not
ready
DHCP Client did
not get DHCP ACK
DHCP Client failed
to verify and lease
has expired. Go to
INIT state.
DHCP Client got a
new IP address
lease.
DHCP Client got
ACK from server
DHCP Client got
NACK
DHCP Client Maintenance Information 504 --- Simple
DHCP Client Maintenance Information 109 --- Standard
DHCP Client Maintenance Information 119 --- Standard
DHCP Client Maintenance Information 121 --- Standard
Destination
DHCP Client Maintenance Information 111 --- Standard
Destination
DHCP Client Maintenance Information 110 --- Standard
SONICOS LOG EVENT REFERENCE GUIDE 17

DHCP Client is
declining address
offered by the
server.
DHCP Client
sending REQUEST
and going to
REBIND state
DHCP Client
sending REQUEST
and going to
RENEW state
DHCP DISCOVER
received from
remote device
DHCP lease
dropped. Lease
from Central
Gateway conflicts
with Relay IP
DHCP lease
dropped. Lease
from Central
Gateway conflicts
with Remote
Management IP
DHCP lease
relayed to local
device
DHCP lease
relayed to remote
device
DHCP lease to LAN
device conflicts
with remote device,
deleting remote IP
entry
DHCP NAK
received from
server
DHCP OFFER
received from
server
DHCP Client Maintenance Information 112 --- Standard
Destination
DHCP Client Maintenance Information 113 --- Standard
Destination
DHCP Client Maintenance Information 114 --- Standard
Destination
DHCP Relay Debug Information 474 --- Standard
Destination
DHCP Relay Maintenance Warning 228 --- Standard
Destination
DHCP Relay Maintenance Warning 484 --- Standard
Destination
DHCP Relay Maintenance Information 223 --- Standard
Destination
DHCP Relay Debug Information 225 --- Standard
Destination
DHCP Relay Maintenance Information 226 --- Standard
Destination
DHCP Relay Debug Information 477 --- Standard
Destination
DHCP Relay Debug Information 476 --- Standard
Destination
18 SONICOS LOG EVENT REFERENCE GUIDE

DHCP Ranges
altered
automatically due
to change in
network settings
for interface %s
DHCP RELEASE
received from
remote device
DHCP RELEASE
relayed to Central
Gateway
DHCP REQUEST
received from
remote device
DHCP Server not
available. Did not
get any DHCP
OFFER.
Firewall Event --- Information 832 --- Standard
String
Service
DHCP Relay Debug Information 224 --- Standard
Destination
DHCP Relay Maintenance Information 222 --- Standard
Destination
DHCP Relay Debug Information 473 --- Standard
Destination
DHCP Client Maintenance Information 106 --- Standard
Diagnostic Code A
Diagnostic Code B
Diagnostic Code C
Diagnostic Code D
Diagnostic Code D
Firewall
Hardware
Firewall
Hardware
Firewall
Hardware
Firewall
Hardware
Firewall
Hardware
System Error Error 93 611 Simple
Note String
System Error Error 94 612 Simple
Note String
System Error Error 95 613 Simple
Note String
System Error Error 64 610 Standard
Note Code
System Error Error 517 642 Simple
Note String
Diagnostic Code E VPN IPSec System Error Error 61 609 Standard
Note Code
Diagnostic Code F
Diagnostic Code G
Diagnostic Code H
Diagnostic Code I
Firewall
Hardware
Firewall
Hardware
Firewall
Hardware
Firewall
Hardware
System Error Error 164 621 Simple
Note String
System Error Error 599 655 Simple
Note String
System Error Error 600 656 Simple
Note String
System Error Error 601 657 Simple
Note String
Disconnecting
L2TP Tunnel due to
traffic timeout
L2TP Client Maintenance Information 215 --- Simple
SONICOS LOG EVENT REFERENCE GUIDE 19

Disconnecting
PPPoE due to
traffic timeout
Disconnecting
PPTP Tunnel due
to traffic timeout
PPPoE Maintenance Information 168 --- Simple
PPTP Maintenance Information 389 --- Simple
Discovered HA
Backup Firewall
DNS packet
allowed
Drop Wlan traffic
from non
SonicPoint devcies
High
Availability
Network
Access
Intrusion
Detection
Maintenance Information 156 --- Simple
Debug Information 602 --- Standard
Policy
Attack Error 662 572 Standard
Dynamic IPSec
client connected
VPN IPSec User Activity Information 62 --- Standard
Destination
EIGRP packet
dropped
E-Mail fragment
dropped
Error initializing
Hardware
acceleration for
VPN
Error Rebooting
HA Peer Firewall
Error setting the IP
address of the
backup, please
manually set to
backup LAN IP
Error
Synchronizing HA
Peer Firewall
Network
Access
Intrusion
Detection
Firewall
Hardware
High
Availability
High
Availability
High
Availability
Debug Notice 714 --- Standard
Note String
Attack Error 437 550 Standard
Maintenance Error 374 --- Simple
System Error Error 669 663 Simple
System Error Error 191 629 Simple
System Error Error 158 662 Simple
Exceeded Max
multicast address
limit
Failed payload
validation
Failed payload
verification after
decryption.
Possible preshared
key mismatch.
Multicast --- Warning 703 --- Standard
VPN IKE User Activity Warning 405 --- Standard
VPN IKE User Activity Warning 404 --- Standard
20 SONICOS LOG EVENT REFERENCE GUIDE

Failed to find
certificate
Failed to get CRL
from
Failed to Process
CRL from
Failed to resolve
name
Failed to
synchronize Relay
IP Table
Failure to add data
channel
VPN PKI User Activity Alert 875 --- Simple
Destination
VPN PKI User Activity Alert 271 --- Simple
Destination
VPN PKI User Activity Alert 276 --- Simple
Destination
Network Maintenance Information 84 --- Simple
Destination
DHCP Relay System Error Warning 234 632 Standard
Unused Debug Debug 49 --- Standard
Failure to reach
Interface %s probe
High
Availability
System Error Error 675 647 Standard
String Service
Fan Failure
Firewall
Hardware
System
Environment
Alert 576 102 Simple
Forbidden E-Mail
attachment deleted
Forbidden E-Mail
attachment
disabled
Intrusion
Detection
Intrusion
Detection
Attack Error 248 534 Standard
Destination
Attack Alert 165 527 Standard
Destination
Found Rogue
Access Point
Found Rogue
Access Point
WLAN IDS WLAN IDS Alert 546 901 Simple
Destination
WLAN IDS WLAN IDS Alert 556 901 Simple
Destination
Fragmented packet
dropped
Network TCP | UDP |
ICMP
Notice 28 --- Standard
Note
Protocol
Fraudulent
Microsoft
certificate found;
access denied
FTP: Data
connection from
non default port
dropped
FTP: PASV
response bounce
attack dropped.
Intrusion
Detection
Network
Access
Intrusion
Detection
Attack Error 193 532 Standard
Attack Alert 538 557 Standard
Attack Alert 528 556 Standard
Note String
SONICOS LOG EVENT REFERENCE GUIDE 21

FTP: PASV
response spoof
attack dropped.
FTP: PORT bounce
attack dropped.
Gateway Anti-Virus
Alert: %s
Gateway Anti-Virus
Service expired
Intrusion
Detection
Intrusion
Detection
Security
Services
Security
Services
Attack Error 446 551 Standard
Attack Alert 527 555 Standard
Note String
Attack Alert 809 --- Standard
Message
String
Maintenance Warning 810 --- Simple
Global VPN Client
connection is not
allowed. Appliance
is not registered.
Global VPN Client
License Exceeded:
Connection
denied.
Global VPN Client
version cannot
enforce personal
firewall. Minimum
Version required is
2.1.
Got DHCP OFFER.
Selecting.
VPN Client System Error Information 529 643 Standard
VPN Client System Error Information 494 658 Standard
VPN Client User Activity Information 604 --- Standard
Destination
DHCP Client Maintenance Information 107 --- Standard
Destination
GSC policy
out-of-date on host
Security
Services
Maintenance Information 762 --- Standard
Guest account '%s'
created
Guest account '%s'
deleted
Guest account '%s'
disabled
Guest account '%s'
pruned
Guest account '%s'
re-enabled
Authentication User Activity Information 558 --- Standard
Message
String
Authentication User Activity Information 559 --- Standard
Message
String
Authentication User Activity Information 560 --- Standard
Message
String
Authentication User Activity Information 562 --- Standard
Message
String
Authentication User Activity Information 561 --- Standard
Message
String
22 SONICOS LOG EVENT REFERENCE GUIDE

Guest account '%s'
re-generated
Guest login denied.
Guest '%s' is
already logged in.
Please try again
later.
H.323/H.225
Connect
Authentication User Activity Information 563 --- Standard
Message
String
Authentication User Activity Information 557 --- Standard
Message
String
VoIP VoIP Debug 634 --- Standard
Note String
H.323/H.225 Setup VoIP VoIP Debug 633 --- Standard
Note String
H.323/H.245
Address
H.323/H.245 End
Session
H.323/RAS
Admission Confirm
H.323/RAS
Admission Reject
H.323/RAS
Admission
Request
H.323/RAS
Bandwidth Reject
H.323/RAS
Disengage Confirm
H.323/RAS
Disengage Reject
H.323/RAS
Gatekeeper Reject
H.323/RAS
Location Confirm
H.323/RAS
Location Reject
H.323/RAS
Registration Reject
H.323/RAS
Unknown Message
Response
VoIP VoIP Debug 635 --- Standard
Note String
VoIP VoIP Debug 636 --- Standard
Note String
VoIP VoIP Debug 625 --- Standard
Note String
VoIP VoIP Debug 624 --- Standard
Note String
VoIP VoIP Debug 626 --- Standard
Note String
VoIP VoIP Debug 627 --- Standard
Note String
VoIP VoIP Debug 628 --- Standard
Note String
VoIP VoIP Debug 641 --- Standard
Note String
VoIP VoIP Debug 629 --- Standard
Note String
VoIP VoIP Debug 630 --- Standard
Note String
VoIP VoIP Debug 631 --- Standard
Note String
VoIP VoIP Debug 632 --- Standard
Note String
VoIP VoIP Debug 640 --- Standard
Note String
SONICOS LOG EVENT REFERENCE GUIDE 23

H.323/RAS
Unregistration
Reject
VoIP VoIP Debug 642 --- Standard
Note String
HA packet
processing error
High
Availability
Maintenance Information 162 --- Simple
Hardware Failover
settings were not
upgraded
Header verification
failed
HTTP
management port
has changed
HTTPS
management port
has changed
Firewall Event Maintenance Information 743 --- Simple
VPN IKE User Activity Warning 587 --- Standard
Firewall Event Maintenance Information 340 --- Simple
Note String
Firewall Event Maintenance Information 341 --- Simple
Note String
ICMP checksum
error
ICMP packet
allowed
ICMP packet
dropped
ICMP packet
dropped
ICMP packet from
LAN allowed
Network
Access
Network
Access
Network
Access
Network
Access
Network
Access
UDP Notice 886 --- Standard
Debug Information 597 --- Standard
Policy
ICMP Notice 38 --- Standard
Policy
ICMP Notice 523 --- Standard
ICMP
Service
Debug Information 598 --- Standard
ICMP
Service
ICMP packet from
LAN dropped
Network
Access
LAN ICMP |
LAN TCP
Notice 175 --- Standard
ICMP
Service
If not already
enabled, enabling
NTP is
recommended
Firewall
Hardware
System Error Warning 540 645 Simple
IGMP packet
dropped, wrong
checksum received
on interface %s
IGMP Leave group
message Received
on interface %s
Multicast --- Notice 683 --- Standard
Message
String
Multicast --- Information 682 --- Standard
Message
String
24 SONICOS LOG EVENT REFERENCE GUIDE

IGMP packet
dropped, decoding
error
IGMP Packet Not
handled. Packet
type : %s
IGMP querier
Router detected on
interface %s
IGMP querier
Router detected on
VPN tunnel , SPI
%S
IGMP state table
entry time
out,deleting
interface : %s for
multicast address :
%s
IGMP state table
entry time
out,deleting VPN
SPI :%s for
Multicast address :
%s
IGMP V2 client
joined multicast
Group : %s
IGMP V2
Membership report
received from
interface %s
IGMP V3 client
joined multicast
Group : %s
IGMP V3
Membership report
received from
interface %s
IGMP V3 packet
dropped,
unsupported
Record type : %s
Multicast --- Notice 686 --- Standard
Multicast --- Notice 687 --- Standard
Message
String
Multicast --- Debug 701 --- Standard
Message
String
Multicast --- Debug 702 --- Standard
Message
String
Multicast --- Debug 692 --- Standard
Message
String
Multicast --- Debug 693 --- Standard
Message
String
Multicast --- Information 676 --- Standard
Message
String
Multicast --- Debug 679 --- Standard
Message
String
Multicast --- Information 677 --- Standard
Message
String
Multicast --- Debug 678 --- Standard
Message
String
Multicast --- Notice 688 --- Standard
Message
String
SONICOS LOG EVENT REFERENCE GUIDE 25

IGMP V3 reord
type : %s not
Handled
IKE ID mismatch
%s
IKE Initiator drop:
Packet dest
address does not
match selected
local interface
address
IKE Initiator:
Accepting IPSec
proposal (Phase 2)
IKE Initiator:
Accepting peer
lifetime (Phase 1)
IKE Initiator:
Aggressive Mode
complete (Phase 1)
IKE Initiator: Main
Mode complete
(Phase 1)
IKE Initiator:
Received notify.
NO_PROPOSAL_
CHOSEN
IKE Initiator: Start
Aggressive Mode
negotiation (Phase
1)
IKE Initiator: Start
Main Mode
negotiation (Phase
1)
IKE Initiator: Start
Quick Mode (Phase
2)
IKE Initiator: Using
secondary gateway
to negotiate
Multicast --- Debug 689 --- Standard
Message
String
VPN IKE Debug Debug 658 --- Standard
String
Service
VPN IKE User Activity Information 544 --- Standard
VPN IKE User Activity Information 372 --- Standard
Note String
VPN IKE User Activity Information 445 --- Standard
Destination
VPN IKE User Activity Information 354 --- Standard
Destination
VPN IKE User Activity Information 353 --- Standard
Destination
VPN IKE User Activity Warning 401 --- Standard
Destination
VPN IKE User Activity Information 358 --- Standard
VPN IKE User Activity Information 351 --- Standard
VPN IKE User Activity Information 346 --- Standard
VPN IKE User Activity Information 543 --- Standard
Destination
26 SONICOS LOG EVENT REFERENCE GUIDE

IKE negotiation
aborted due to
timeout
IKE negotiation
complete. Adding
IPSec SA. (Phase
2)
IKE Responder
drop: Packet dest
address does not
match selected
local interface
address
IKE Responder: %s
policy does not
allow static IP for
Virtual Adapter.
IKE Responder:
Accepting IPSec
proposal (Phase 2)
IKE Responder:
Aggressive Mode
complete (Phase 1)
IKE Responder: AH
Perfect Forward
Secrecy mismatch
IKE Responder:
Algorithms and/or
keys do not match
IKE Responder:
Default LAN
gateway is not set
but peer is proposing
to use this SA
as a default route
IKE Responder:
Default LAN
gateway is set but
peer is not
proposing to use
this SA as a default
route
VPN IKE User Activity Information 403 --- Standard
VPN IKE User Activity Information 89 --- Standard
VPN IKE User Activity Information 545 --- Standard
VPN Client System Error Error 660 --- Standard
Message
String
VPN IKE User Activity Information 87 --- Standard
Note String
VPN IKE User Activity Information 373 --- Standard
Destination
VPN IKE User Activity Warning 258 544 Standard
VPN IKE User Activity Warning 260 546 Standard
VPN IKE Attack Error 516 553 Standard
Note String
VPN IKE User Activity Warning 253 539 Standard
Note String
SONICOS LOG EVENT REFERENCE GUIDE 27

IKE Responder:
ESP Perfect
Forward Secrecy
mismatch
IKE Responder:
IKE proposal does
not match
(Phase 1)
IKE Responder: IP
Address already
exists in the DHCP
relay table. Client
traffic not allowed.
IKE Responder:
IPSec proposal
does not match
(Phase 2)
IKE Responder:
Main Mode
complete (Phase 1)
IKE Responder:
Mode %d - not
transport mode.
Xauth is required
but not supported
by peer.
IKE Responder:
Mode %d - not
tunnel mode
IKE Responder: No
match for
proposed remote
network address
IKE Responder: No
matching Phase 1
ID found for
proposed remote
network
IKE Responder:
Proposed local
network is 0.0.0.0
but SA has no LAN
Default Gateway
VPN IKE User Activity Warning 259 545 Standard
VPN IKE User Activity Warning 402 --- Standard
Destination
VPN Client System Error Error 659 --- Standard
Note String
VPN IKE User Activity Warning 88 523 Standard
Note String
VPN IKE User Activity Information 357 --- Standard
Destination
VPN IKE Debug Warning 342 --- Standard
Message
Number
VPN IKE User Activity Warning 249 535 Standard
Message
Number
VPN IKE User Activity Warning 252 538 Standard
Note String
VPN IKE User Activity Warning 250 536 Standard
Note String
VPN IKE User Activity Warning 418 549 Standard
Note String
28 SONICOS LOG EVENT REFERENCE GUIDE

IKE Responder:
Proposed remote
network is 0.0.0.0
but not DHCP relay
nor default route
IKE Responder:
Received
Aggressive Mode
request (Phase 1)
IKE Responder:
Received Main
Mode request
(Phase 1)
IKE Responder:
Received Quick
Mode Request
(Phase 2)
IKE Responder:
Tunnel terminates
inside firewall but
proposed local
network is not
inside firewall
IKE Responder:
Tunnel terminates
on DMZ but
proposed local
network is on LAN
IKE Responder:
Tunnel terminates
on LAN but
proposed local
network is on DMZ
IKE Responder:
Tunnel terminates
outside firewall but
proposed local
network is not NAT
public address
IKE Responder:
Tunnel terminates
outside firewall but
proposed remote
network is not NAT
public address
VPN IKE User Activity Warning 251 537 Standard
VPN IKE User Activity Information 356 --- Standard
VPN IKE User Activity Information 355 --- Standard
VPN IKE User Activity Information 352 --- Standard
VPN IKE User Activity Warning 255 541 Standard
Note String
VPN IKE User Activity Warning 256 542 Standard
Note String
VPN IKE User Activity Warning 257 543 Standard
Note String
VPN IKE User Activity Warning 254 540 Standard
Note String
VPN IKE User Activity Warning 345 548 Standard
Note String
SONICOS LOG EVENT REFERENCE GUIDE 29

IKE SA lifetime
expired.
VPN IKE User Activity Information 350 --- Standard
Illegal IPSec SPI VPN IPSec User Activity Information 65 --- Standard
Destination
Imported VPN SA
is invalid - disabled
Inbound
connection from
RBL-listed SMTP
server dropped
Incoming call
received for
Remotely
Triggered Dial-out
session
Incompatible IPSec
Security
Association
Incorrect
authentication
received for
Remotely
Triggered Dial-out
Firewall Event Maintenance Warning 348 --- Standard
Note String
RBL --- Notice 798 --- Standard
Authentication User Activity Information 817 --- Simple
VPN IPSec User Activity Information 69 --- Standard
Destination
Authentication User Activity Information 819 --- Simple
Ini Killer attack
dropped
Intrusion
Detection
Attack Alert 80 519 Standard
Interface %s Link
Is Down
Interface %s Link
Is Up
Interface IP
Assignment :
Binding and
initializing %s
Interface IP
Assignment
changed: Shutting
down %s
Interface statistics
report
Firewall Event System Error Error 566 647 Standard
String
Service
Firewall Event System Error Warning 565 646 Standard
String
Service
Firewall Event Maintenance Information 568 --- Standard
String
Service
Firewall Event Maintenance Information 567 --- Standard
String
Service
GMS --- Information 805 --- Simple
Interface
Statistics
30 SONICOS LOG EVENT REFERENCE GUIDE

Invalid TCP flags
on an incomplete
connection
Network
Access
--- Notice 760 --- Standard
Note String
Invalid VLAN
packet dropped
Network --- Alert 836 --- Standard
Note String
IP Header
checksum error
Network
Access
TCP | UDP Notice 883 --- Standard
IP spoof detected
on packet to
Central Gateway,
packet dropped
DHCP Relay Attack Error 229 533 Standard
Note ENET
IP spoof dropped
Intrusion
Detection
Attack Alert 23 502 Standard
Note ENET
IP type %s packet
dropped
Network
Access
LAN UDP |
LAN TCP
Notice 590 --- Standard
Message
String
IPS Detection
Alert: %s
IPS Detection
Alert: %s
IPS Prevention
Alert: %s
IPS Prevention
Alert: %s
Intrusion
Detection
Intrusion
Detection
Intrusion
Detection
Intrusion
Detection
Attack Alert 608 569 Standard
IDP
Message
String
Attack Alert 789 573 Standard
Message
String
Attack Alert 609 570 Standard
IDP
Message
String
Attack Alert 790 574 Standard
Message
String
IPSec (AH) packet
dropped
VPN IPSec TCP | UDP |
ICMP
Notice 534 --- Standard
Note String
IPSec (AH) packet
dropped; waiting
for pending IPSec
connection
VPN IPSec Debug Debug 536 --- Standard
IPSec (ESP) packet
dropped
VPN IPSec TCP | UDP |
ICMP
Notice 533 --- Standard
Note String
IPSec (ESP) packet
dropped; waiting
for pending IPSec
connection
VPN IPSec Debug Debug 535 --- Standard
SONICOS LOG EVENT REFERENCE GUIDE 31

IPSec
Authentication
Failed
VPN IPSec Attack Error 67 508 Standard
Destination
IPSec connection
interrupt
Network
Access
Debug Debug 43 --- Standard
IPSec Decryption
Failed
VPN IPSec Attack Error 68 509 Standard
Destination
IPSec packet
dropped
Network
Access
TCP | UDP |
ICMP
Notice 40 --- Standard
IPSec packet
dropped; waiting
for pending IPSec
connection
Network
Access
Debug Debug 42 --- Standard
IPSec packet from
an illegal host
IPSec packet from
or to an illegal host
IPSEC Replay
Detected
VPN IPSec Maintenance Information 247 --- Standard
Destination
VPN IPSec Attack Error 70 510 Standard
Destination
VPN IPSec Attack Alert 180 531 Standard
Note String
IPSecTunnel
status changed
VPN
VPN Tunnel
Status
Information 427 801 Simple
ISDN Driver
Firmware
successfully
updated
Firewall Event Maintenance Information 493 --- Simple
Issuer match failed VPN PKI User Activity Alert 278 --- Simple
Destination
Java access
denied
Network
Access
Blocked Code Notice 19 --- Standard
Note
Blocked
L2TP enabled but
not ready
L2TP Max
Retransmission
Exceeded
L2TP PPP
Authentication
Failed
Unused Maintenance Information 500 --- Simple
L2TP Client Maintenance Information 203 --- Simple
L2TP Client Maintenance Information 212 --- Simple
L2TP PPP Down L2TP Client Maintenance Information 211 --- Simple
L2TP PPP link
down
L2TP Client Maintenance Information 217 --- Simple
32 SONICOS LOG EVENT REFERENCE GUIDE

L2TP PPP
Negotiation Started
L2TP PPP Session
Up
L2TP Server :
Deleting the L2TP
active Session
L2TP Server :
Deleting the Tunnel
L2TP Server : L2TP
Session Established.
L2TP Server : L2TP
Tunnel Established.
L2TP Server :
Retransmission
Timeout, Deleting
the Tunnel
L2TP Server : User
Name
authentication
Failure locally.
L2TP Server:
Local
Authentication
Failure
L2TP Server:
Local
Authentication
Success.
L2TP Server:
Radius
Authentication
Success
L2TP Server:
Radius reports
Authentication
Failure
L2TP Server:
Radius server not
assigned IP
address
L2TP Client Maintenance Information 208 --- Simple
L2TP Client Maintenance Information 210 --- Simple
L2TP Server Maintenance Information 337 --- Standard
Destination
L2TP Server Maintenance Information 336 --- Standard
Destination
L2TP Server Maintenance Information 309 --- Standard
Destination
L2TP Server Maintenance Information 308 --- Standard
Destination
L2TP Server Maintenance Information 338 --- Standard
Destination
L2TP Server Maintenance Information 344 --- Standard
Destination
L2TP Server Maintenance Information 312 --- Standard
Destination
L2TP Server Maintenance Information 318 --- Standard
Destination
L2TP Server Maintenance Information 319 --- Standard
Destination
L2TP Server Maintenance Information 311 --- Standard
Destination
L2TP Server Maintenance Information 313 --- Standard
Destination
SONICOS LOG EVENT REFERENCE GUIDE 33

L2TP Server: Call
Disconnect from
Remote.
L2TP Server:
Tunnel Disconnect
from Remote.
L2TP Session
Disconnect from
Remote
L2TP Session
Established
L2TP Session
Negotiation Started
L2TP Tunnel
Disconnect from
Remote
L2TP Tunnel
Established
L2TP Tunnel
Negotiation Started
LAN Subnet
configurations
were not upgraded.
L2TP Server Maintenance Information 334 --- Standard
Destination
L2TP Server Maintenance Information 335 --- Standard
Destination
L2TP Client Maintenance Information 207 --- Simple
L2TP Client Maintenance Information 206 --- Simple
L2TP Client Maintenance Information 202 --- Simple
L2TP Client Maintenance Information 205 --- Simple
L2TP Client Maintenance Information 204 --- Simple
L2TP Client Maintenance Information 201 --- Simple
Firewall Event Maintenance Information 741 --- Simple
Land attack
dropped
Intrusion
Detection
Attack Alert 27 505 Standard
License exceeded:
Connection
dropped because
too many IP
addresses are in
use on your LAN
Firewall Event System Error Error 58 608 Standard
License of HA pair
doesn't match
High
Availability
System Error Error 670 664 Simple
Local user login
allowed
Local user login
denied due to bad
credentials
Locked-out user
logins
allowed - lockout
period expired
Authentication User Activity Information 31 --- Standard
String
Service
Authentication User Activity Information 32 --- Standard
String
Service
Authentication User Activity Information 438 --- Standard
Note String
34 SONICOS LOG EVENT REFERENCE GUIDE

Locked-out user
logins allowed by
administrator
Authentication User Activity Information 439 --- Standard
Note String
Log Cleared
Firewall
Logging
Maintenance Information 5 --- Simple
Log Debug Firewall Event Debug Error 142 --- Simple
String
Log successfully
sent via email
Firewall
Logging
Maintenance Information 6 --- Simple
Login screen timed
out
MAC address
collides with Static
ARP Entry with
Bound MAC
address; packet
dropped
Authentication User Activity Information 34 --- Standard
String
Service
Network --- Notice 814 --- Standard
Note ENET
Machine %s
removed from SYN
flood blacklist
Malformed or
unhandled IP
packet dropped
Maximum events
per second
threshold
exceeded
Intrusion
Detection
Network
Access
Firewall
Logging
--- Alert 865 --- Standard
String
Service
Attack Alert 522 554 Standard
Destination
System Error Critical 654 --- Simple
Maximum
sequential failed
dial attempts (10)
to a single dial-up
number: %s
PPP Dial-up Attack Error 591 566 Standard
Message
String
Maximum syslog
data per second
threshold
exceeded
Firewall
Logging
System Error Critical 655 --- Simple
Multicast
application %s not
supported
Multicast packet
dropped, Invalid
src IP received on
interface : %s
Multicast --- Information 696 --- Standard
Message
String
Multicast --- Alert 685 --- Standard
Message
String
SONICOS LOG EVENT REFERENCE GUIDE 35

Multicast packet
dropped, wrong
MAC address
receieved on
interface : %s
Multicast TCP
packet dropped
Multicast UDP
packet dropped, no
state entry
Multicast UDP
packet dropped,
RTCP stateful
failed
Multicast UDP
packet dropped,
RTP stateful failed
NAT device may
not support IPSec
AH passthrough
NAT Discovery :
No NAT/NAPT
device detected
between IPSec
Security gateways
NAT Discovery :
Local IPSec
Security Gateway
behind a NAT/
NAPT Device
NAT Discovery :
Peer IPSec
Security Gateway
behind a NAT/
NAPT Device
NAT Discovery :
Peer IPSec
Security Gateway
doesn't support
VPN NAT Traversal
NAT translated
packet exceeds
size limit, packet
dropped
Multicast --- Alert 684 --- Standard
Message
String
Multicast --- Notice 691 --- Standard
Multicast --- Notice 690 --- Standard
Multicast --- Warning 695 --- Standard
Multicast --- Warning 694 --- Standard
VPN IPSec Maintenance Information 266 --- Simple
VPN IKE User Activity Information 241 --- Standard
VPN IKE User Activity Information 240 --- Standard
VPN IKE User Activity Information 239 --- Standard
VPN IKE User Activity Information 242 --- Standard
Network Debug Debug 339 --- Standard
36 SONICOS LOG EVENT REFERENCE GUIDE

Net Spy attack
dropped
Intrusion
Detection
Attack Alert 74 513 Standard
NetBIOS settings
were not upgraded.
Use Network>IP
Helper to
configure NetBIOS
support
Firewall Event Maintenance Information 740 --- Simple
NetBus attack
dropped
Intrusion
Detection
Attack Alert 72 511 Standard
Network for
interface %s
overlaps with
another interface.
Network Modem
Mode Disabled:
re-enabling NAT
Network Modem
Mode Enabled:
turning off NAT
Firewall Event Maintenance Information 569 --- Standard
String
Service
PPP Dial-up Maintenance Information 531 --- Simple
PPP Dial-up Maintenance Information 530 --- Simple
New URL List
loaded
Newsgroup access
allowed
Newsgroup access
denied
Security
Services
Network
Access
Network
Access
Maintenance Information 8 --- Simple
Blocked Sites Notice 17 704 Standard
Note
Blocked
Blocked Sites Notice 15 702 Standard
Note
Blocked
No Certificate for VPN PKI User Activity Alert 280 --- Simple
Destination
No new URL List
available
Security
Services
Maintenance Information 9 --- Simple
No response from
ISP Disconnecting
PPPoE.
No response from
PPTP server to call
requests
No response from
PPTP server to
control connection
requests
PPPoE Maintenance Information 169 --- Simple
PPTP Maintenance Information 431 --- Simple
PPTP Maintenance Information 430 --- Simple
SONICOS LOG EVENT REFERENCE GUIDE 37

No response from
server to Echo
Requests,
disconnecting
PPTP Tunnel
No valid DNS
server specified for
RBL lookups
Not all
configurations may
have been
completely
upgraded
Not enough
memory to hold the
CRL
Obtained Relay IP
Table from Remote
Gateway
OCSP Failed to
Resolve Domain
Name.
OCSP Internal
error handling
received response.
OCSP received
response error.
OCSP received
response.
OCSP Resolved
Domain Name.
OCSP send
request message
failed.
OCSP sending
request.
Outbound
connection to
RBL-listed SMTP
server dropped
PPTP Maintenance Information 429 --- Simple
RBL --- Error 800 --- Simple
Firewall Event Maintenance Information 612 --- Simple
VPN PKI User Activity Warning 272 --- Simple
Destination
DHCP Relay Maintenance Information 233 --- Standard
VPN PKI User Activity Error 853 --- Standard
Note String
VPN PKI User Activity Error 854 --- Standard
Note String
VPN PKI User Activity Error 851 --- Standard
Note String
VPN PKI User Activity Information 850 --- Standard
Note String
VPN PKI User Activity Information 852 --- Standard
Note String
VPN PKI User Activity Error 849 --- Standard
Note String
VPN PKI User Activity Information 848 --- Standard
Note String
RBL --- Notice 797 --- Standard
Out-of-order
command packet
dropped
Network
Access
Debug Debug 48 --- Standard
38 SONICOS LOG EVENT REFERENCE GUIDE

Packet dropped by
wlan guest check
Packet dropped by
wlan vpn traversal
check
Wireless TCP | UDP |
ICMP
Wireless TCP | UDP |
ICMP
Warning 488 --- Standard
Destination
Warning 495 --- Standard
Destination
Packet dropped.
No firewall rule
associated with
VPN policy.
VPN System Error Alert 739 --- Standard
Note String
Ping of death
dropped
Intrusion
Detection
Attack Alert 22 501 Standard
PKI Failure: CA
certificates store
exceeded. Cannot
verify this Local
Certificate
PKI Failure: Cannot
alloc memory
PKI Failure:
Certificate's ID
does not match
this SonicWall
PKI Failure:
Duplicate local
certificate
PKI Failure:
Duplicate local
certificate name
PKI Failure: Import
failed
PKI Failure:
Improper file
format. Please
select PKCS#12
(*.p12) file
PKI Failure:
Incorrect admin
password
PKI Failure:
Internal error
PKI Failure:
Loaded but could
not verify
certificate
VPN PKI Maintenance Error 453 --- Simple
VPN PKI Maintenance Error 449 --- Simple
VPN PKI Maintenance Error 455 --- Simple
VPN PKI Maintenance Error 458 --- Simple
VPN PKI Maintenance Error 457 --- Simple
VPN PKI Maintenance Error 451 --- Simple
VPN PKI Maintenance Error 454 --- Simple
VPN PKI Maintenance Error 452 --- Simple
VPN PKI Maintenance Error 460 --- Simple
VPN PKI Maintenance Error 469 --- Simple
SONICOS LOG EVENT REFERENCE GUIDE 39

PKI Failure:
Loaded the
certificate but
could not verify it's
chain
PKI Failure: No CA
certificates yet
loaded
PKI Failure:
Output buffer too
small
PKI Failure:
public-private key
mismatch
PKI Failure:
Reached the limit
for local certs, cant
load any more
PKI Failure:
Temporary memory
shortage, try again
PKI Failure: The
certificate chain
has no root
PKI Failure: The
certificate chain is
circular
PKI Failure: The
certificate chain is
incomplete
PKI Failure: The
certificate or a
certificate in the
chain has a bad
signature
PKI Failure: The
certificate or a
certificate in the
chain has a validity
period in the future
PKI Failure: The
certificate or a
certificate in the
chain has expired
VPN PKI Maintenance Error 470 --- Simple
VPN PKI Maintenance Error 459 --- Simple
VPN PKI Maintenance Error 448 --- Simple
VPN PKI Maintenance Error 456 --- Simple
VPN PKI Maintenance Error 450 --- Simple
VPN PKI Maintenance Error 461 --- Simple
VPN PKI Maintenance Error 464 --- Simple
VPN PKI Maintenance Error 462 --- Simple
VPN PKI Maintenance Error 463 --- Simple
VPN PKI Maintenance Error 468 --- Simple
VPN PKI Maintenance Error 466 --- Simple
VPN PKI Maintenance Error 465 --- Simple
40 SONICOS LOG EVENT REFERENCE GUIDE

PKI Failure: The
certificate or a
certificate in the
chain is corrupt
Please connect
interface %s to
another network to
function properly
Please manually
check all system
configurations for
correctness of
Upgrade
VPN PKI Maintenance Error 467 --- Simple
Firewall Event Maintenance Information 570 --- Standard
String
Service
Firewall Event Maintenance Information 613 --- Simple
Port configured to
receive IPSEC
ONLY. Drop packet
received in the
clear.
Network
Access
TCP | UDP |
ICMP
Warning 347 --- Standard
Destination
Possible port scan
dropped
Possible SYN flood
attack detected
Possible SYN flood
detected on WAN
IF %s - switching to
connection-proxy
mode
Possible SYN
Flood on IF %s
Possible SYN
Flood on IF %s
continues
Possible SYN
Flood on IF %s has
ceased
Intrusion
Detection
Intrusion
Detection
Intrusion
Detection
Intrusion
Detection
Intrusion
Detection
Intrusion
Detection
Attack Alert 82 521 Standard
Note String
Attack Warning 25 503 Standard
--- Alert 859 --- Standard
String
Service
--- Alert 860 --- Standard
String
Service
--- Warning 866 --- Standard
String
Service
--- Alert 867 --- Standard
String
Service
PPP Dial-Up:
Connect request
canceled
PPP Dial-Up:
Connected at %s
bps - starting PPP
PPP Dial-up User Activity Information 306 --- Simple
PPP Dial-up User Activity Information 286 --- Standard
String
Service
SONICOS LOG EVENT REFERENCE GUIDE 41

PPP Dial-Up:
Connection
disconnected as
scheduled.
PPP Dial-Up:
Dial initiated by %s
PPP Dial-Up:
Dialed number did
not answer
PPP Dial-Up:
Dialed number is
busy
PPP Dial-Up:
Dialing not allowed
by schedule. %s
PPP Dial-Up:
Dialing: %s
PPP Dial-Up: Idle
time limit exceeded
- disconnecting
PPP Dial-Up:
Initialization : %s
PPP Dial-Up: Link
carrier lost
PPP Dial-Up:
Manual
intervention
needed. Check
Primary Profile or
Profile details
PPP Dial-Up:
Maximum
connection time
exceeded -
disconnecting
PPP Dial-Up: No
dialtone detected -
check phone-line
connection
PPP Dial-up --- Information 666 --- Standard
PPP Dial-up Maintenance Information 324 --- Standard
Message
String
PPP Dial-up User Activity Information 285 --- Simple
PPP Dial-up User Activity Information 284 --- Simple
PPP Dial-up --- Information 665 --- Standard
Message
String
PPP Dial-up User Activity Information 281 --- Standard
String
Service
PPP Dial-up User Activity Information 297 --- Simple
PPP Dial-up User Activity Information 303 --- Standard
String
Service
PPP Dial-up User Activity Information 288 --- Simple
PPP Dial-up User Activity Information 321 --- Simple
PPP Dial-up User Activity Information 327 --- Simple
PPP Dial-up User Activity Information 282 --- Simple
42 SONICOS LOG EVENT REFERENCE GUIDE

PPP Dial-Up: No
link carrier
detected - check
phone number
PPP Dial-Up: No
peer IP address
from Dial-Up ISP,
local and remote
IPs will be the
same
PPP Dial-Up:
PPP link down
PPP Dial-Up:
PPP link
established
PPP Dial-Up:
Previous session
was connected for
%s
PPP Dial-Up:
Received new IP
address
PPP Dial-Up:
Shutting down link
PPP Dial-Up: The
profile in use
disabled VPN
networking.
PPP Dial-Up:
Trying to failover
but Alternate
Profile is manual
PPP Dial-Up:
Trying to failover
but Primary Profile
is manual
PPP Dial-Up:
Unknown dialing
failure
PPP Dial-Up:
User requested
connect
PPP Dial-up User Activity Information 283 --- Simple
PPP Dial-up Maintenance Information 481 --- Simple
PPP Dial-up User Activity Information 301 --- Simple
PPP Dial-up User Activity Information 300 --- Simple
PPP Dial-up User Activity Information 542 --- Standard
String
Service
PPP Dial-up User Activity Information 299 --- Standard
PPP Dial-up User Activity Information 302 --- Simple
PPP Dial-up Maintenance Information 330 --- Simple
WAN Failover User Activity Information 434 --- Simple
PPP Dial-up User Activity Information 322 --- Simple
PPP Dial-up User Activity Information 287 --- Simple
PPP Dial-up User Activity Information 305 --- Simple
SONICOS LOG EVENT REFERENCE GUIDE 43

PPP Dial-Up:
User requested
disconnect
PPP Dial-Up:
VPN networking
restored.
PPP:
Authentication
successful
PPP: CHAP
authentication
failed - check
username /
password
PPP: MS-CHAP
authentication
failed - check
username /
password
PPP: PAP
Authentication
failed - check
username /
password
PPP: Starting
CHAP
authentication
PPP: Starting
MS-CHAP
authentication
PPP: Starting PAP
authentication
PPP Dial-up User Activity Information 304 --- Simple
PPP Dial-up Maintenance Information 331 --- Simple
PPP User Activity Information 289 --- Simple
PPP User Activity Information 291 --- Simple
PPP User Activity Information 292 --- Simple
PPP User Activity Information 290 --- Simple
PPP User Activity Information 294 --- Simple
PPP User Activity Information 293 --- Simple
PPP User Activity Information 295 --- Simple
PPPoE terminated PPPoE Maintenance Information 130 --- Simple
PPPoE discovery
process complete
PPPoE enabled but
not ready
PPPoE LCP Link
Down
PPPoE LCP Link
Up
PPPoE Network
Connected
PPPoE Maintenance Information 133 --- Simple
PPPoE Maintenance Information 499 --- Simple
PPPoE Maintenance Information 129 --- Simple
PPPoE Maintenance Information 128 --- Simple
PPPoE Maintenance Information 131 --- Simple
44 SONICOS LOG EVENT REFERENCE GUIDE

PPPoE Network
Disconnected
PPPoE starting
CHAP
Authentication
PPTP enabled but
not ready
PPTP Connect
Initiated by the
User
PPTP Control
Connection
Established
PPTP Control
Connection
Negotiation Started
PPTP decode
failure
PPTP Disconnect
Initiated by the
User
PPTP PAP
Authentication
success.
PPPoE Maintenance Information 132 --- Simple
PPPoE Maintenance Information 134 --- Simple
PPTP Maintenance Information 501 --- Simple
PPTP Maintenance Information 390 --- Standard
Destination
PPTP Maintenance Information 378 --- Simple
PPTP Maintenance Information 375 --- Simple
PPTP Debug Debug 596 --- Standard
PPTP Maintenance Information 388 --- Standard
Destination
PPTP Maintenance Information 396 --- Simple
PPTP PPP Down PPTP Maintenance Information 385 --- Simple
PPTP PPP Link
down
PPTP PPP Link
Finished
PPTP Maintenance Information 399 --- Simple
PPTP Maintenance Information 400 --- Simple
PPTP PPP Link Up PPTP Maintenance Information 398 --- Simple
PPTP PPP
Negotiation Started
PPTP PPP Session
Up
PPTP Server is not
responding, check
if the server is UP
and running.
PPTP server
rejected control
connection
PPTP Maintenance Information 382 --- Simple
PPTP Maintenance Information 384 --- Simple
PPTP Maintenance Information 444 --- Simple
PPTP Maintenance Information 432 --- Simple
SONICOS LOG EVENT REFERENCE GUIDE 45

PPTP server
rejected the call
request
PPTP Session
Disconnect from
Remote
PPTP Session
Established
PPTP Session
Negotiation Started
PPTP starting
CHAP
Authentication
PPTP starting PAP
Authentication
PPTP Tunnel
Disconnect from
Remote
PPTP Maintenance Information 433 --- Simple
PPTP Maintenance Information 381 --- Simple
PPTP Maintenance Information 380 --- Simple
PPTP Maintenance Information 376 --- Simple
PPTP Maintenance Information 392 --- Simple
PPTP Maintenance Information 393 --- Simple
PPTP Maintenance Information 379 --- Simple
Primary firewall
has transitioned to
Active
Primary firewall
has transitioned to
Idle
Primary firewall
preempting
Backup
Primary missed
heartbeats from
Backup
Primary received
error signal from
Backup
Primary received
reboot signal from
Backup
Priority attack
dropped
Probable port scan
dropped
Probable TCP FIN
scan dropped
High Availability
High Availability
High
Availability
High
Availability
High
Availability
High
Availability
Intrusion
Detection
Intrusion
Detection
Intrusion
Detection
Maintenance Information 144 --- Simple
System Error Error 146 614 Simple
System Error Error 153 620 Simple
System Error Error 148 615 Simple
System Error Error 150 617 Simple
System Error Error 671 665 Simple
Attack Alert 79 518 Standard
Attack Alert 83 522 Standard
Note String
Attack Alert 177 528 Standard
46 SONICOS LOG EVENT REFERENCE GUIDE

Probable TCP
NULL scan
dropped
Probable TCP
XMAS scan
dropped
Intrusion
Detection
Intrusion
Detection
Attack Alert 179 530 Standard
Attack Alert 178 529 Standard
Probing failure on
%s
Probing succeeded
on %s
WAN Failover System Error Alert 326 637 Standard
Message
String
WAN Failover System Error Alert 436 638 Standard
Message
String
Problem loading
the URL List;
Appliance not
registered.
Problem loading
the URL List;
check Filter
settings
Problem loading
the URL List;
check your DNS
server
Problem loading
the URL List; Flash
write failure.
Problem loading
the URL List;
Retrying later.
Problem loading
the URL List;
Subscription
expired.
Problem loading
the URL List; Try
loading it again.
Problem sending
log email; check
log settings.
Real time clock
battery failure.
Time values may
be incorrect.
Security
Services
Security
Services
Security
Services
Security
Services
Security
Services
Security
Services
Security
Services
Firewall
Logging
Firewall
Hardware
System Error Error 183 623 Simple
System Error Error 10 602 Standard
Note Code
System Error Error 11 603 Simple
System Error Error 187 627 Simple
System Error Error 186 626 Standard
System Error Error 184 624 Standard
System Error Error 185 625 Simple
System Error Warning 12 604 Simple
System Error Warning 539 644 Simple
SONICOS LOG EVENT REFERENCE GUIDE 47

Received a path
MTU icmp
message from
router/gateway
Received a path
MTU icmp
message from
router/gateway
Network User Activity Information 182 --- Standard
Note SPI
Network User Activity Information 188 --- Standard
Note MTU
Received AV Alert:
%s
Received AV Alert:
Your SonicWALL
Network Anti-Virus
subscription has
expired. %s
Received AV Alert:
Your SonicWALL
Network Anti-Virus
subscription will
expire in 7 days.
%s
Received CFS
Alert: Your
SonicWALL
Content Filtering
subscription has
expired.
Received CFS
Alert: Your
SonicWALL
Content Filtering
subscription will
expire in 7 days.
Security
Services
Security
Services
Security
Services
Security
Services
Security
Services
Maintenance Warning 125 524 Standard
String
Service
Maintenance Warning 159 526 Standard
String
Service
Maintenance Warning 482 552 Standard
String
Service
Maintenance Warning 490 563 Simple
Maintenance Warning 489 562 Simple
Received DHCP
offer packet has
errors
DHCP Client Maintenance Information 588 --- Standard
Destination
Received E-Mail
Filter Alert: Your
SonicWALL E-Mail
Filtering
subscription has
expired.
Security
Services
Maintenance Warning 492 565 Simple
48 SONICOS LOG EVENT REFERENCE GUIDE

Received E-Mail
Filter Alert: Your
SonicWALL E-Mail
Filtering
subscription will
expire in 7 days.
Security
Services
Maintenance Warning 491 564 Simple
Received
fragmented packet
or fragmentation
needed
Received IKE SA
delete request
Network Debug Debug 63 --- Standard
VPN IKE User Activity Information 413 --- Standard
Received IPS Alert:
Your SonicWALL
Intrusion
Prevention (IDP)
subscription has
expired.
Security
Services
Maintenance Warning 614 571 Simple
Received IPSEC
SA delete request
Received ISAKMP
packet destined to
port %s
Received LCP
Echo Reply
Received LCP
Echo Request
Received notify:
INVALID_COOKIES
Received notify:
INVALID_ID_INFO
Received notify:
INVALID_PAYLOAD
Received notify:
INVALID_SPI
Received notify:
ISAKMP_AUTH_
FAILED
Received notify:
PAYLOAD_
MALFORMED
VPN IKE User Activity Information 412 --- Standard
Destination
VPN IKE Debug | UDP Information 607 --- Standard
Message
String
PPPoE Maintenance Information 723 --- Simple
PPPoE Maintenance Information 721 --- Simple
VPN IKE User Activity Information 414 --- Standard
Destination
VPN IPSec User Activity Warning 483 --- Standard
VPN IKE User Activity Error 661 --- Standard
VPN IKE User Activity Information 416 --- Standard
Destination
VPN IKE User Activity Warning 409 --- Standard
Destination
VPN IKE User Activity Warning 411 --- Standard
Destination
SONICOS LOG EVENT REFERENCE GUIDE 49

Received notify:
RESPONDER_
LIFETIME
Received packet
retransmission.
Drop duplicate
packet
Received PPPoE
Active Discovery
Offer
Received PPPoE
Active Discovery
Session_
confirmation
Received response
packet for DHCP
request has errors
Received
unencrypted
packet while crypto
active
Regulatory
requirements
prohibit %s from
being re-dialed for
30 minutes
Remotely
Triggered Dial-out
session ended.
Valid WAN bound
data found.
Normal dial-up
sequence will
commence
Remotely
Triggered Dial-out
session started.
Requesting
authentication
Request for Relay
IP Table from
Central Gateway
Requesting CRL
from
VPN IKE User Activity Information 415 --- Standard
Destination
VPN IKE User Activity Warning 406 --- Standard
PPPoE Maintenance Information 593 --- Simple
PPPoE Maintenance Information 594 --- Simple
DHCP Client Maintenance Information 589 --- Standard
Destination
VPN IKE User Activity Warning 605 --- Standard
PPP Dial-up Attack Error 592 567 Standard
Message
String
Authentication User Activity Information 822 --- Simple
Authentication User Activity Information 818 --- Simple
DHCP Relay Maintenance Information 230 --- Standard
VPN PKI User Activity Information 269 --- Simple
Destination
50 SONICOS LOG EVENT REFERENCE GUIDE

Requesting Relay
IP Table from
Remote Gateway
Retransmitting
DHCP DISCOVER
Retransmitting
DHCP REQUEST
(Rebinding)
Retransmitting
DHCP REQUEST
(Rebooting)
Retransmitting
DHCP REQUEST
(Renewing)
Retransmitting
DHCP REQUEST
(Requesting)
Retransmitting
DHCP REQUEST
(Verifying)
RIP disabled on
interface %s
DHCP Relay Maintenance Information 231 --- Standard
DHCP Client Maintenance Information 99 --- Standard
Destination
DHCP Client Maintenance Information 102 --- Standard
Destination
DHCP Client Maintenance Information 103 --- Standard
Destination
DHCP Client Maintenance Information 101 --- Standard
Destination
DHCP Client Maintenance Information 100 --- Standard
Destination
DHCP Client Maintenance Information 104 --- Standard
Destination
RIP Maintenance Information 419 --- Standard
String
Service
Ripper attack
dropped
Intrusion
Detection
Attack Alert 76 515 Standard
RIPv1 enabled on
interface %s
RIPv2
compatibility
(broadcast) mode
enabled on
interface %s
RIPv2 enabled on
interface %s
Router IGMP
General query
received on
interface %s
Router IGMP
Membership query
received on
interface %s
RIP Maintenance Information 420 --- Standard
String
Service
RIP Maintenance Information 422 --- Standard
String
Service
RIP Maintenance Information 421 --- Standard
String
Service
Multicast --- Debug 680 --- Standard
Message
String
Multicast --- Debug 681 --- Standard
Message
String
SONICOS LOG EVENT REFERENCE GUIDE 51

Sending DHCP
DISCOVER.
Sending DHCP
RELEASE.
Sending DHCP
REQUEST
(Rebinding).
Sending DHCP
REQUEST
(Rebooting).
Sending DHCP
REQUEST
(Renewing).
Sending DHCP
REQUEST
(Verifying).
Sending DHCP
REQUEST.
Sending LCP Echo
Reply
Sending LCP Echo
Request
Sending PPPoE
Active Discovery
Request
DHCP Client Maintenance Information 105 --- Standard
Destination
DHCP Client Maintenance Information 122 --- Standard
Destination
DHCP Client Maintenance Information 116 --- Standard
Destination
DHCP Client Maintenance Information 117 --- Standard
Destination
DHCP Client Maintenance Information 115 --- Standard
Destination
DHCP Client Maintenance Information 118 --- Standard
Destination
DHCP Client Maintenance Information 108 --- Standard
Destination
PPPoE Maintenance Information 722 --- Simple
PPPoE Maintenance Information 720 --- Simple
PPPoE Maintenance Information 595 --- Simple
Senna Spy attack
dropped
Intrusion
Detection
Attack Alert 78 517 Standard
Sent Relay IP Table
to Central Gateway
SIP Register expiration
exceeds
configured
Signaling
inactivity time out
DHCP Relay Maintenance Information 232 --- Standard
VoIP VoIP Warning 645 --- Standard
Note String
SIP Request VoIP VoIP Debug 643 --- Standard
Note String
SIP Response VoIP VoIP Debug 644 --- Standard
Note String
SMTP
POP-Before-SMTP
authentication
failed
Firewall
Logging
System Error Warning 656 --- Simple
52 SONICOS LOG EVENT REFERENCE GUIDE

SMTP server found
on RBL blacklist
RBL --- Notice 799 --- Standard
Note String
Smurf
Amplification
attack dropped
Intrusion
Detection
Attack Alert 81 520 Standard
SonicPoint
Provision
SonicPoint
statistics report
SonicPoint SonicPoint Information 727 --- Simple
Destination
GMS --- Information 806 --- Simple
SonicPoint
Statistics
SonicPoint Status SonicPoint SonicPoint Information 667 --- Simple
Destination
SonicWALL
activated
SonicWALL
initializing
Firewall Event Maintenance Alert 4 --- Simple
Firewall Event Maintenance Information 521 --- Simple
Source routed IP
packet dropped
Spank attack
multicast packet
dropped
Intrusion
Detection
Intrusion
Detection
Debug Warning 428 --- Standard
Attack Alert 606 568 Standard
Starting IKE
negotiation
Starting PPPoE
discovery
VPN IKE User Activity Information 90 --- Standard
Note String
PPPoE Maintenance Information 127 --- Simple
Status GMS Maintenance Emergency 96 --- Simple
GMS
Status
Striker attack
dropped
Sub Seven attack
dropped
Success to reach
Interface %s probe
Intrusion
Detection
Intrusion
Detection
High
Availability
Attack Alert 77 516 Standard
Attack Alert 75 514 Standard
System Error Information 674 --- Standard
String
Service
Successful
authentication
received for
Remotely
Triggered Dial-out
Authentication User Activity Information 820 --- Simple
SONICOS LOG EVENT REFERENCE GUIDE 53

SYN Flood
Blacklist on IF %s
continues
SYN Flood
blacklisting
disabled by user
SYN Flood
blacklisting
enabled by user
SYN flood ceased
or flooding
machines
blacklisted -
connection proxy
disabled
SYN Flood Mode
changed by user
to: Always proxy
WAN connections
SYN Flood Mode
changed by user
to: Watch and
proxy WAN
connections when
under attack
SYN Flood Mode
changed by user
to: Watch and
report possible
SYN floods
Synchronizing
preferences to HA
Peer Firewall
SYN-Flooding
machine %s
blacklisted
TCP checksum
error
TCP connection
dropped
TCP connection
from LAN denied
Intrusion
Detection
Intrusion
Detection
Intrusion
Detection
Intrusion
Detection
Intrusion
Detection
Intrusion
Detection
Intrusion
Detection
High
Availability
Intrusion
Detection
Network
Access
Network
Access
Network
Access
--- Warning 868 --- Standard
String
Service
--- Warning 863 --- Standard
--- Warning 862 --- Standard
--- Alert 861 --- Standard
--- Warning 858 --- Standard
--- Warning 857 --- Standard
--- Warning 856 --- Standard
Maintenance Information 673 --- Simple
--- Alert 864 --- Standard
String
Service
UDP Notice 884 --- Standard
UDP Notice 36 --- Standard
Policy
LAN TCP Notice 173 --- Standard
Service
TCP FIN packet
dropped
Network Debug Debug 181 --- Standard
54 SONICOS LOG EVENT REFERENCE GUIDE

TCP stateful
inspection
enforcement:
Bad header
dropped
TCP stateful
inspection
enforcement:
Connection
aborted
TCP stateful
inspection
enforcement:
Connection
refused
TCP stateful
inspection
enforcement:
Invalid ack
dropped
TCP stateful
inspection
enforcement:
Invalid flag
dropped
TCP stateful
inspection
enforcement:
Invalid sequence
dropped
Network Debug Debug 711 --- Standard
Network Debug Debug 713 --- Standard
Network Debug Debug 712 --- Standard
Network Debug Debug 709 --- Standard
Network Debug Information 710 --- Standard
Network Debug Debug 708 --- Standard
TCP SYN received
TCP Syn/Fin
packet dropped
TCP Xmas Tree
dropped
Intrusion
Detection
Network
Access
Intrusion
Detection
--- Debug 869 --- Standard
Attack Alert 580 558 Standard
Attack Alert 267 547 Standard
The cache is full;
%u open
connections; some
will be dropped
Firewall Event System Error Error 53 607 Standard
Message
Number
The loaded
content URL List
has expired
Security
Services
System Error Error 190 628 Simple
SONICOS LOG EVENT REFERENCE GUIDE 55

The network
connection in use
is %s
The preferences
file is too large to
be saved in
available flash
memory
WAN Failover System Error Warning 307 639 Standard
Message
String
Firewall Event System Error Warning 573 649 Simple
Thermal Red
Firewall
Hardware
System
Environment
Alert 578 104 Simple
Thermal Red Timer
Exceeded
Firewall
Hardware
System
Environment
Alert 579 105 Simple
Thermal Yellow
Firewall
Hardware
System
Environment
Alert 577 103 Simple
Time of day
settings for firewall
policies were
not upgraded.
Firewall Event Maintenance Information 742 --- Simple
UDP checksum
error
UDP packet
dropped
Network
Access
Network
Access
UDP Notice 885 --- Standard
UDP Notice 37 --- Standard
Policy
UDP packet from
LAN dropped
Network
Access
LAN UDP |
LAN TCP
Notice 174 --- Standard
Service
Unable to
download IPS/GAV/
Aspy Signature
database. Firewall
must first be
restarted to free
memory used by
downloaded
firmware.
Unused --- Warning 873 --- Simple
Unknown protocol
dropped
Network
Access
Debug Notice 41 --- Standard
Note String
Unknown reason VPN PKI User Activity Error 275 --- Simple
Destination
User logged out Authentication User Activity Information 263 --- Standard
String
Service
User logged
out - inactivity
timer expired
Authentication User Activity Information 265 --- Standard
Note String
56 SONICOS LOG EVENT REFERENCE GUIDE

User logged
out - max session
time exceeded
User logged
out - user
disconnect
detected (heartbeat
timer expired)
User login denied -
insufficient access
on LDAP server
User login denied -
invalid credentials
on LDAP server
User login denied -
LDAP
authentication failure
User login denied -
LDAP
communication
problem
User login denied -
LDAP directory
mismatch
User login denied -
LDAP schema
mismatch
User login denied -
LDAP server
certificate not valid
User login denied -
LDAP server down
or misconfigured
User login denied -
LDAP server name
resolution failed
User login denied -
LDAP server
timeout
User login denied -
RADIUS
authentication
failure
Authentication User Activity Information 264 --- Standard
Note String
Authentication User Activity Information 24 --- Standard
Note String
RADIUS User Activity Warning 750 --- Standard
String Service
RADIUS User Activity Warning 749 --- Standard
String Service
RADIUS User Activity Information 745 --- Standard
String Service
RADIUS User Activity Warning 748 --- Standard
String
Service
RADIUS User Activity Warning 757 --- Standard
String
Service
RADIUS User Activity Warning 751 --- Standard
String
Service
RADIUS User Activity Warning 755 --- Standard
String
Service
RADIUS User Activity Warning 747 --- Standard
String
Service
RADIUS User Activity Warning 753 --- Standard
String
Service
RADIUS User Activity Warning 746 --- Standard
String
Service
RADIUS User Activity Information 243 --- Standard
String
Service
SONICOS LOG EVENT REFERENCE GUIDE 57

User login denied -
RADIUS
communication
problem
User login denied -
RADIUS
configuration error
User login denied -
RADIUS server
name resolution
failed
User login denied -
RADIUS server
timeout
User login denied -
TLS or local
certificate problem
User login denied -
User has no
privileges for login
from that location
User login denied -
User has no
privileges for
WLAN guest
service
User login denied
due to bad
credentials
User login disabled
from %s
User login failed -
Guest service limit
reached
User login failure
rate exceeded -
logins from user IP
address denied
RADIUS User Activity Warning 744 --- Standard
String
Service
RADIUS User Activity Information 245 --- Standard
String
Service
RADIUS User Activity Warning 754 --- Standard
String
Service
RADIUS User Activity Information 244 --- Standard
String
Service
RADIUS User Activity Warning 756 --- Standard
String
Service
RADIUS User Activity Information 246 --- Standard
String
Service
Authentication User Activity Information 486 --- Standard
Destination
Authentication User Activity Information 33 --- Standard
String
Service
Authentication Attack Error 583 559 Standard
Message
String
Authentication User Activity Information 549 --- Standard
Note String
Authentication Attack Error 329 561 Standard
Destination
Virtual Access
Point is disabled
Virtual Access
Point is enabled
SonicPoint 802.11b
Management
SonicPoint 802.11b
Management
Information 731 --- Simple
Destination
Information 730 --- Simple
Destination
58 SONICOS LOG EVENT REFERENCE GUIDE

VoIP %s Endpoint
added
VoIP %s Endpoint
not added -
configured 'public'
endpoint limit
reached
VoIP %s Endpoint
removed
VoIP Call
Connected
VoIP Call
Disconnected
VoIP VoIP Debug 637 --- Standard
String
Service
VoIP VoIP Warning 639 --- Standard
String
Service
VoIP VoIP Debug 638 --- Standard
String
Service
VoIP VoIP Information 622 --- Standard
Note String
VoIP VoIP Information 623 --- Standard
Note String
Voltages Out of
Tolerance
Firewall Hardware
System Environment
Error 575 101 Simple
VPN Cleanup:
Dynamic network
settings change
VPN Client Policy
Provisioning
VPN disabled by
administrator
VPN disabled for
active dial up
VPN enabled by
administrator
VPN User Activity Information 471 --- Standard
VPN Client User Activity Information 371 --- Standard
Destination
Authentication Maintenance Information 506 --- Simple
Unused Maintenance Information 503 --- Simple
Authentication Maintenance Information 507 --- Simple
VPN Log Debug VPN IKE Debug Information 172 --- Simple
String
VPN policy count
received exceeds
the limit; %s
VPN zone
administrator login
allowed
VPN zone remote
user login allowed
WAN Interface not
setup
VPN System Error Error 719 --- Standard
String
Service
Authentication User Activity Information 235 --- Standard
Authentication User Activity Information 237 --- Standard
String
Service
Firewall Event Maintenance Information 498 --- Simple
WAN IP Changed Firewall Event System Error Warning 138 636 Standard
SONICOS LOG EVENT REFERENCE GUIDE 59

WAN not ready Firewall Event Maintenance Information 502 --- Simple
WAN zone
administrator login
allowed
WAN zone remote
user login allowed
WARNING: DHCP
lease relayed from
Central Gateway
conflicts with IP in
Static Devices list
Authentication User Activity Information 236 --- Standard
Authentication User Activity Information 238 --- Standard
String Service
DHCP Relay Maintenance Information 227 --- Standard
Destination
Web access
request dropped
Web management
request allowed
Web site access
allowed
Web site access
denied
Network
Access
Network
Access
Network
Access
Network
Access
UDP Notice 524 --- Standard
Policy
User Activity Notice 526 --- Standard
Service
Blocked Sites Notice 16 703 Standard
Note
Blocked
Blocked Sites Notice 14 701 Standard
Note
Blocked
Wireless MAC
Filter List disabled
by administrator
Wireless MAC
Filter List enabled
by administrator
WLAN client null
probing
WLAN disabled by
administrator
WLAN disabled by
schedule
Authentication Maintenance Information 513 --- Simple
Authentication Maintenance Information 512 --- Simple
WLAN IDS WLAN IDS Warning 615 904 Standard
Destination
Authentication Maintenance Information 508 --- Simple
Authentication Maintenance Information 728 --- Simple
Wlan drop traffic to
deny network
Network
Access
--- Information 724 --- Standard
Note String
WLAN enabled by
administrator
WLAN enabled by
schedule
Authentication Maintenance Information 509 --- Simple
Authentication Maintenance Information 729 --- Simple
60 SONICOS LOG EVENT REFERENCE GUIDE

WLAN firmware
image has been
updated
WLAN Guest
Account Timeout
WLAN Guest Idle
Timeout
WLAN Guest
Session Timeout
Wireless Maintenance Information 487 --- Simple
String
Authentication User Activity Information 551 --- Standard
Note String
Authentication User Activity Information 564 --- Standard
Note String
Authentication User Activity Information 550 --- Standard
Note String
WLAN max
concurrent users
reached already
Network
Access
--- Information 726 --- Standard
Note String
WLAN not in AP
mode, DHCP
server will not
provide lease to
clients on WLAN
Wireless Maintenance Information 617 --- Simple
WLAN pass traffic
to access allow
network
Network
Access
--- Information 725 --- Standard
Note String
WLAN recovery Wireless Maintenance Information 519 --- Simple
String
WLAN sequence
number out of
order
WLB Failback
initiated by %s
WLB Failover in
progress
WLB Resource
failed
WLB Resource is
now available
WLB Spill-over
started,
configured
threshold
exceeded
WLB Spill-over
stopped
WLAN IDS WLAN IDS Warning 547 902 Simple
Destination
WAN Failover System Error Alert 435 652 Standard
Message
String
WAN Failover System Error Alert 584 651 Standard
WAN Failover System Error Alert 586 654 Standard
WAN Failover System Error Alert 585 653 Standard
WAN Failover Maintenance Warning 581 --- Simple
WAN Failover Maintenance Warning 582 --- Simple
SONICOS LOG EVENT REFERENCE GUIDE 61

WPA MIC Failure Wireless 802.11b
Management
Warning 663 --- Simple
Destination
WPA Radius Server
Timeout
Wireless 802.11b
Management
Information 664 --- Simple
Destination
XAUTH Failed with
VPN client,
Authentication
failure
XAUTH Failed with
VPN client, Cannot
Contact RADIUS
Server
XAUTH Succeeded
with VPN client
VPN Client User Activity Information 140 --- Standard
Destination
VPN Client User Activity Information 141 --- Standard
Destination
VPN Client User Activity Information 139 --- Standard
Destination
62 SONICOS LOG EVENT REFERENCE GUIDE

Index of Syslog Tag Field Description
This section provides an alphabetical listing of Syslog tags and the associated field description.
Tag Field Description
Syslog message prefix The beginning of each syslog message has a
string of the form where ddd is a decimal
number indicating facility and priority of the message.
(See [1] Section 4.1.1)
arg URL Used to render a URL: arg represents the URL
path name part.
bcastRx Interface statistics report Displays the broadcast packets received
bcastTx Interface statistics report Displays the broadcast packets transmitted
bytesRx Interface statistics report Displays the bytes received
bytesTx Interface statistics report Displays the bytes transmitted
c Message category (legacy only) Indicates the legacy category number (Note: We
are not currently sending new category information.)
change Configuration change webpage Displays the basename of the firewall web page
that performed the last configuration change
code Blocking code Indicates the CFS block code category
code ICMP type and code Indicates the ICMP code
conns Firewall status report Indicates the number of connections in use
cpuUtil Firewall status report Displays the CPU utilization (not in use)
dst Destination Destination IP address, and optionally, port, network
interface, and resolved name.
dstname Destination URL Displays the URL of web site hit and other legacy
destination strings
dstname URL Used to render a URL: dstname represents the
URL host part
dyn Firewall status report Displays the HA and dialup connection state (rendered
as “h.d” where “h” is “n” (not enabled), “b”
(backup), or “p” (primary) and “d” is “1” (enabled)
or “0” (disabled))
fw Firewall WAN IP Indicates the WAN IP Address
fwlan Firewall status report Indicates the LAN zone IP address
goodRxBytes SonicPoint statistics report Indicates the well formed bytes recevied
goodTxBytes SonicPoint statistics report Indicates the well formed bytes transmitted
SONICOS LOG EVENT REFERENCE GUIDE 63

i Firewall status report Displays the GMS message interval in seconds
id=firewall Webtrends prefix Syntactic sugar for WebTrends (and GMS by
habit)
if Interface statistics report Displays the interface on which statistics are
reported
ipscat IPS message Displays the IPS category
ipspri IPS message Displays the IPS priority
lic Firewall status report Indicates the number of licenses for firewalls with
limited modes
m Message ID Provides the message ID number
mac MAC address Provides the MAC address
msg Static message Displays the event message (from spreadsheet)
msg Dynamically-defined message Displays a dynamically defined message string
msg Static message with dynamic string Displays a message using the predefined message
string containing a “%s” and a dynamic
string argument.
msg
Static message with dynamic number
Displays a message using the predefined string
string containing a “%s” and a dynamic numeric
argument.
msg IPS message Displays a message using the predefined message
string containing a “%s” and a dynamic
string argument.
msg Anti-Spyware message Displays the event message (from spreadsheet)
n Message count Indicates the number of times event occurs
op HTTP OP code Displays the HTTP operation (GET, POST, etc.)
of web site hit
pri Message priority Displays the event priority level (0=emergency..7=debug)
proto IP protocol Indicates the IP protocol and detail information
proto Protocol and service Displays the protocol information (rendered as
“proto/service”)
proto Protocol and service Displays the protocol information (rendered as
“proto/service”)
pt Firewall status report Displays the HTTP/HTTPS management port
(rendered as “hhh.sss”)
radio SonicPoint statistics report Displays the SonicPoint radio on which event
occurred
ramUtil Firewall status report Displays the RAM utilization (not in use)
64 SONICOS LOG EVENT REFERENCE GUIDE

cvd Bytes received Indicates the number of bytes received within
connection
result HTTP Result code Displays the HTTP result code (200, 403, etc.) of
web site hit
rule Rule ID Displays the Access Rule number causing packet
drop
sent Bytes sent Displays the number of bytes sent within connection
sid IPS message Provides the IPS signature ID
sid Anti-Spyware message Provides the AntiSpyware signature ID
sn Firewall serial number Indicates the device serial number
spycat Anti-Spyware message Displays the antiSpyware category
spypri Anti-Spyware message Displays the AntiSpyware priority
src Source Indicates the source IP address, and optionally,
port, network interface, and resolved name.
station SonicPoint statistics report Displays the client (station) on which event
occurred
time Time Reports the time of event
type ICMP type and code Indicates the ICMP type
ucastRx Interface statistics report Displays the unicast packets received
ucastTx Interface statistics report Displays the unicast packets transmitted
unsynched Firewall status report Reports the time since last local change in seconds
usesstandbysa Firewall status report Displays whether standby SA is in use (“1” or “0”)
for GMS management
usr (or user) User Displays the user name (“user” is the tag used by
WebTrends)
vpnpolicy VPN policy name Displays the VPN policy name of event
SONICOS LOG EVENT REFERENCE GUIDE 65

66 SONICOS LOG EVENT REFERENCE GUIDE

SonicWALL,Inc.
1143 Borregas Avenue
Sunnyvale,CA 94089-1306
T: 408.745.9600
F: 408.745.9300
www.sonicwall.com
© 2002 SonicWALL, I n c .SonicWALL is a registered trademark of SonicWALL, I n c .Other product and company names mentioned herein may be
t rademarks and/ or registered trademarks of their respective companies. Specifications and descriptions subject to change with out notice.
P/ N 232-000827-00
Rev B 6/05