topic Re: Evnet IDs descriptions in General Topics

Evnet IDs descriptions

Psrivastava — Fri, 08 Feb 2019 16:21:17 GMT

I am looking for a KB article or document which explains event IDs related to System logs. For e.g. Logs> System > type (general)- event ID (system-start).

How many type of event IDs are in PAN firewalls system logs & their descriptions ?

Re: Evnet IDs descriptions

reaper — Tue, 12 Feb 2019 14:43:30 GMT

the event IDs are a description of what is going on in a process that's outlined in the description field, so each process has it's own event IDs

eg pppoe can have initiating, connect-fail, connected, ..., , so there is plenty of them. "severity" is probably the best measure to go by

Re: Evnet IDs descriptions

OtakarKlier — Wed, 13 Feb 2019 17:16:50 GMT

Hello,

As Reaper mentioned, severity is the best measure to go by. For the past few companies I have worked for, we always blocked anything that was severity medium or higher. Low and Informational just seemed to break a lot of stuff when we enabled it, but if you do I highly recommend you take your time and understand the traffic and ones that are getting hit before blocking them.

Regards,