Each event is assigned a severity level, which defines how urgent or critical an event is. Security events are classified by a severity ID of 1, 2, or 3. Operative events are classified by a severity ID of 6, 7, or 8. You can also configure a server or client action (such as executing a program or sending emails and SNMP traps) to be performed when the event occurs and specify whether a specific event or all events should be propagated to a Control Center.
In this article:
Configure Event Settings
- Go to CONFIGURATION > Full Configuration > Box > Infrastructure Services > Eventing.
- Click Lock.
- Configure your event settings.
- To search for a specific event, enter its ID number in the Lookup field at the bottom of the page.
- To edit an event, select it and then click Change. You can also double-click the event entry.
- Click Send Changes and Activate.
|Event ID||This read-only field displays the event ID.|
|Description||The event description is written to the event monitor and to logging facilities and is sometimes extended by additional information in case the event is triggered by multiple processes.|
|Severity ID||The severity level that has been assigned to the event. Severity categories range from informational events to security events.|
|Notification ID||The effective notification setting that applies to the event.|
|Comment||The notification description.|
|Persistent||To prevent events from being forwarded multiple times, select this check box. Each event is forwarded to the NextGen Control Center only once, even if it occurs multiple times. The event can only be forwarded to the NextGen Control Center again after it is deleted. This setting is only of interest on Control Center-administered systems.|
|Propagate to CC|
To enable propagation of the event to a NextGen Control Center, select this check box. This setting overrules any conflicting settings from the Severity tab.
|Drop Event||To drop the event so that it is not entered in the local database or propagated, select this check box. Events that have been marked as Drop Event are displayed in black bold italics.|
|Severity ID||The severity ID. When assigning a severity to an event, select the severity ID in the event settings.|
|Category||The category of the severity. Severity categories range from informational events to security events.|
|Description||Description of the severity.|
|Priority||This read-only field displays the priority of the severity.|
|Notification ID||The notification setting that applies to the severity. Notifications are configured in the Notification tab.|
|Propagate to CC|
To enable the forwarding of events using this severity level to a NextGen Control Center, select this check box. This setting may be overruled by customized settings for events from the Events tab.
|Drop Event||If enabled, events using this severity are not stored in the local event database of the NextGen F-Series Firewall or forwarded to a NextGen Control Center. When a severity has the Drop Event check box selected, all events with this severity are displayed in italics.|
Changing the Severity ID has no effect on how events are displayed. But when set to 0, the severity is displayed in red italics, and all events with this severity assigned change to italics in the Events tab.
|The notification ID.|
|Description||Description of the notification.|
|Event must be confirmed||When selected, the assigned event remains in alarm status until it is confirmed by the administrator.|
From this tab, you can specify an action to be performed by the F-Series Firewall when the assigned event occurs. After selecting the Enable check box, you can select and configure one of the following action types:
You can also specify how often the action is repeated until the event is confirmed by the administrator. Select the Repeat Every check box and then define the interval in which the action is repeated. You can only specify this setting if the Event must be confirmed check box is also selected.
From this tab, you can enable an action to be performed by the MS Windows client that Barracuda NextGen Admin is running on when the assigned event occurs.
From this tab, you can define how often the assigned event must occur in a specific time period before the specified server or client action for the notification is performed. To specify the thresholds for event notifications, you must also select the Activate Notification if any of these thresholds are reached check box.
|Send Event to CC|
Firewalls managed by a Barracuda NextGen Control Center will forward their events to the Control Center. This includes events that are generated by the NextGen Control Center itself. This setting overrides conflicting settings from the Events or Severity tab.
|Silent Box||If enabled, event alarms are disabled, but event collection is still performed.|
|Max Event Records|
Defines the maximum number of events that are displayed on the Events page. When this limit is reached, new events are not recorded on the Events page. It is recommended that you regularly delete old events and refer to the Logs and Statistics pages to view past events.