The EVENTS tab lets you monitor and manage events that are generated by your Barracuda NG Control Center and Barracuda NG Firewalls. Before using this tab, you need to activate the generation of Firewall Audit data as described in How to Configure Event Notifications.
In this article:
On the Events page, you can determine the type and importance of each event by its icon and the font that it is displayed in. The following tables explain the meaning of each event icon and font:
|black normal text||Uncritical or confirmed event.|
|blue normal text||New and unread event.|
|black bold text||Indicates that changes were made to default values in the event configuration, such as Propagate to CC. For more information, see How to Configure Event Settings.|
Acknowledging Events and Alarms
Some events, such as error events or events that are displayed in black bold text, require acknowledgement. You can also determine if an event needs acknowledgment by double-clicking it to view its properties. When you acknowledge an event, it is then displayed in black normal text. If an event has an alarm, you can also either reset or disable the alarm.
To acknowledge an event that requires confirmation, right-click the event and select Send - Acknowledgement. Acknowledging the event also terminates any alarms (such as a sound playing or an email notification) that have been set for it.
- To acknowledge an event and remove a warning icon from it, select Send - Reset Alarm.
- To mark an uncritical event as read, select Send - Mark as Read.
- To temporarily disable the event alarm, select Temporary Disable. The event is then displayed in italic font.
To manage the list of events that are displayed, you can refresh the list automatically or manually, delete events, and specify which columns are displayed or hidden. To delete an event, right-click it and select Delete Event. To verify that an event has been properly deleted, refresh the event list. To automatically refresh the list of events in Live mode, click No Auto Refresh and then click Live.
Notification messages are only enabled in Live mode. This mode enables pop-up windows and sound. Hence to have the event monitor in normal mode can be seen as a display of the current event system status. To manually refresh the list of events. Click Refresh. To hide and show columns, right-click the list of events and select Columns. In the Show / Hide Event Columns window, select the columns that you want to be displayed.
To filter the list of events that are displayed, click Filter. To enter values for a filter setting, click the setting button. For example, to enter a layer ID, click Layer ID. In the Add Criterion window, add the values to the setting list and then click Add. After adding all of the required values for the filter, click Activate.
Viewing Event Properties
To view detailed information for an event, you can either double-click it or right-click it and select Properties. From the Page 1 tab, you can view the system, layer, class, and type for the event, as well as its event ID.
|Box||The IP address of the system that created the event.|
There are three layers:
There are there classes:
|Type||The event ID.|
From the Page 2 tab, you can view the dates and times of when the event was confirmed, acknowledged, or had its alarm disabled. You can also view information about the administrator who confirmed the event.
- by Admin – The administrator who confirmed the event. If the event is unconfirmed, this field is empty.
- by Peer – The IP address for the workstation of the administrator who confirmed the event. If the event is unconfirmed, this field is empty.
- Date – The date and time of when the event was read or confirmed. If the event is unconfirmed, this field is empty.
- Insert – The date and time of when the event was generated.
- Box – Internal system information related to the insert time (please ignore this value).
- Update – The date and time of any status changes for the event, such as when it was acknowledged or marked as read.
- Alarm – The date and time of when the alarm was sent.
- t. disabled – The date and time of when the alarm was disabled temporarily.