EVENTS Tab

Last updated on 2023-11-13 09:52:51

The Barracuda Firewall Admin EVENTS page lets you monitor and manage events generated by the Barracuda Firewall Control Center and CloudGen Firewalls. To access the EVENTS page, click the EVENTS tab in the ribbon bar. For information how to configure eventing, see Events.

The events table displays events information in the following columns:

Severity – The event type.
Category – The event category.
Flags – The event status.
Event – The name of the event.
Event Time – The date and time the event was generated.
Desc – The event description.
Count – The number of times the event occurred.
From Box – (CC only) The name of the system that created the event.
Layer – The layer that the event occurs on.
Class – The class that the event belongs to.

On the Events page, the importance and type of each event is determined by its icon:

Icon	Event Type
	Information
	Notice
	Warning
	Error
	Security

The Flags column shows the event status indicated by the following icons:

Text Type	Event Type
	New and unread event.
	Confirmed event.
	Event that must be confirmed.
	Event with alarm.

For more information, see How to Configure Basic, Severity, and Notification Settings for Events.

Managing Events

To manage the list of events that are displayed, you can refresh the list automatically or manually, delete events, and specify which content is shown on the list. To delete an event, right-click it and select Delete Event. To verify that an event has been properly deleted, refresh the event list.

Select an event and use the quick access bar at the top of the page to perform the following actions:

Confirm – Confirm the selected event.
Reset Alarm – Reset the alarm for the selected event.
Delete – Delete the selected event.
Refresh – Refresh the list of events manually.

Notification messages are only enabled in Live Mode view. This mode displays the current event system status and enables pop-up windows and sound. To manually refresh the list of events, click Refresh. To automatically refresh the list of events in Live mode, click No Auto Refresh and then click Live.

Acknowledging Events and Alarms

Some events, such as error events, require confirmation. You can also determine if an event needs acknowledgment by double-clicking it to view its properties. If an event has an alarm, you can also either reset or disable the alarm.

If an event must be confirmed and is in alarm condition, deleting the alarm will also delete the request for confirmation. If an alarm is stopped, any configured repeating server actions are also stopped.

To acknowledge an event that requires confirmation, right-click the event and select Confirm as Read. Acknowledging the event also terminates any alarms (such as a sound playing or an email notification) that have been set for it.

To acknowledge an event and remove a warning icon from it, select Reset Alarm and Confirm as Read.
To temporarily disable the event alarm, select Temporary Disable and enter the time span for disabling the alarm. The event is then displayed with a 'Mute' icon.

Filter Options

To filter the list of events that are displayed, click the fields on top of the columns. Select a filter and/or enter values for a filter setting. The entries will be displayed according to the selected criteria.

To reset the view, click Clear Filter on the top right of the page.

Viewing Event Properties

To view detailed information for an event, you can either double-click it or right-click it and select View Event. In the Event Properties window, you can view the system, layer, class, and type for the event, as well as its event ID.

Field	Description
Box	The IP address of the system that created the event.
Layer	There are three layers: 1 – Boot layer. 2 – Box layer. 3 – Server/Service layer.
Class	There are there classes: 1 – Operative 2 – Resources 3 – Security
Type	The event ID.

In the lower section of the Event Properties window, you can view the dates and times of when the event was confirmed, acknowledged, or had its alarm disabled. You can also view information about the administrator who confirmed the event.

By Admin – The administrator who confirmed the event. If the event is unconfirmed, this field is empty.
By Peer – The IP address for the workstation of the administrator who confirmed the event. If the event is unconfirmed, this field is empty.
Date – The date and time of when the event was read or confirmed. If the event is unconfirmed, this field is empty.
Insert – The date and time of when the event was generated.
Box – Internal system information related to the insert time (please ignore this value).
Update – The date and time of any status changes for the event, such as when it was acknowledged or marked as read.
Alarm – The date and time of when the alarm was sent.
Temp. disabled – The date and time of when the alarm was disabled temporarily.