topic Re: Block and NOT Alert in General Topics

Block and NOT Alert

apackard — Wed, 06 Jun 2012 13:17:44 GMT

Is there any way of blocking an attack (threat) but not logging it?

By this I mean I have some attacks that I want to drop but don't really want to get spammed in the logs because they are just 'noise' as far as I'm concerned.

Re: Block and NOT Alert

rmonvon — Wed, 06 Jun 2012 18:33:12 GMT

Hi...Within the threat profiles we log events where we took actions block/drop/reset for auditing purposes and the logging cannot be turned off. Log suppression is ON by default to reduce repeated events and create only 1 log entry.

Thanks.

Re: Block and NOT Alert

mikand — Wed, 06 Jun 2012 19:06:08 GMT

Is that suppression setting tweakable?

For example if I like to have it suppressed in ACC but not when sent to syslog-server?

Re: Block and NOT Alert

rmonvon — Wed, 06 Jun 2012 19:22:01 GMT

The log suppression is a system-wide setting, and its setting can be configured via the CLI:

> show system setting logging

> set system setting logging log-suppression

The suppresion counter is shown as 'repeat count' in the log details. Thanks.