The Barracuda NG Firewall generates log events for system processes on the box layer and, if present, for the virtual server layer and each configured service. To limit the size of a single log file, the Barracuda NG Firewall creates a new log file for each service every four hours. All log files are stored in plain text in the system's
/var/phion/logs directory and can be viewed and filtered conveniently with the log viewer in the Barracuda NG Admin application. For information on how to view and filter log file entries, see the Logs Tab.
/var/phion/logcache directory contains the Log Access Files (
*.laf) for internal log file processing only. These are BDB (Berkeley DB) files that are suitable for fast access to large log files. Intervention via the command line is generally not recommended. To view the contents of the
.laf files, use the
In this article:
Configure Log File Handling
- Open the Log Configuration page (Config > Full Config > Box > Infrastructure Services).
- Click Lock.
- Set the parameters for Generate Log Data and Log to Storage.
- Click Send Changes and Activate.
The following table displays how the log daemon saves log files, when the parameters are set:
Generate Log Data
Log to Storage
|yes||yes||Logs are sent to the syslog service and written to disk.|
|yes||no||Logs are sent to the syslog service but not written to disk.|
|no||yes||Logs are neither sent to the syslog service nor written to disk. If you want to activate the writing of log files to disk only, you must set parameters Generate Log Data AND Log to Storage to yes and disable syslog streaming by setting the parameter Idle Mode in the Syslog Streaming - Basic Setup to yes.|
|no||no||Logs are neither sent to the syslog service nor written to disk.|
Format and Types
Log file entries are divided into the following segments:
- Time – The time when an event has taken place. This indicator marks individual log entries.
- Type – Shows the following types of the log files.
- Warning – Uncritical log event (e.g. login to the system)
- Error – Log event error (e.g. system calls or clock skew)
- Fatal – System critical log events.
- Notice – Normal system log events.
- Security – Security relevant log events.
- Panic – Marks critical log events compromising the system's functionality and stability.
- TZ – Displays the UTC time zone offset compared to the local box time.
- Message – Description of the log event.
Viewing Log File Entries
The Barracuda NG Admin application offers a graphical log file interpreter for viewing and filtering log files. For a list of all available log files in the log file tree, see Available Log Files and Structure).
Log File Propagation
Log files are by default stored on the local filesystem of the unit. In addition, log files can be sent to external Syslog servers. Firewall log events can be forwarded to the Barracuda NG Control Center for central log consolidation for centralized management. For more information, see How to Configure Syslog Streaming and How to Enable the Firewall Audit Log Service.