AFA analysis syslog messages

AFA generates syslog messages for each analysis run, as well as additional information and administrative syslog messages as needed.

AFA analysis syslog message reference

The following table provides a basic description of the syslog messages generated for AFA analysis and links to more details below.

Message type	Description
Start and Start Refresh syslog messages	Indicate that an AFA analysis has begun
Findings syslog messages	Summarize the analysis results
End syslog messages	Indicate the completion of an analysis process, regardless of status
ReportData syslog messages	Provide details for a specific report
Info syslog messages	Contain additional details about report findings, such as changes in policies
Admin syslog messages	Indicate a situation that requires administrative attention

Start and Start Refresh syslog messages

Start messages indicate that an AFA analysis has begun, identifying the unique job-name assigned.

If you are refreshing an existing report, the event name and ID is Start Refresh instead of Start.

Severity level: 1.

Syntax:

Start syslog messages have the following syntax:

Start messages include the following parameters:

• report. The name assigned to the new report. For example, afa-3928.
• firewall. The name of the device being analyzed.

Findings syslog messages

Findings messages summarize the analysis results, and are sent when the report is ready.

If a failure occurred and no report was generated, no message is sent.

Severity level: Depends on the status message. For details, see Severity.

Syntax:

Findings messages include the following parameters:

• report. The name assigned to the new report. For example, afa-3928.
• firewall. The name of the device being analyzed.

• status. A description of the status found, such as:

  Status	Description	Severity
  No changes	The device policy has not changed since the previous analysis.	1
  Changes	Changes in the device policy were detected, but no new risk items were flagged.	3
  New risks	Changes in the device policy were detected, and additional risk items were flagged. This is the most sever status code that AFA produces.	5
  Manual run	The report was initiated manually, and is not scheduled. This may occur when an administrator is testing a new configuration or scenario.	1

• msg. A short, free-text summary of any risks found. For example: 1 high, 2 medium.

End syslog messages

End messages are always sent when an analysis process completes, regardless of the status.

Severity level: Depends on the analysis status. For details, see AFA analysis syslog messages.

Syntax:

End messages include the following parameters:

• report. The name assigned to the new report. For example, afa-3928.
• firewall. The name of the device being analyzed.

• status. One of the following:

  Status	Description	Severity
  Success	Analysis completed successfully.	1
  Failure	Analysis failed to complete.	7

• url. The URL of the report generated. For example: url=https://192.168.2.8/~sally/algosec/php/Login.php?type\=firewall&report\=sally-570

  Tip: This URL contains equal signs (=) and leading backslashes (\). Before using this URL as a hyperlink, you'll need to strip out the backslashes.

ReportData syslog messages

ReportData syslog messages are sent for each new report generated, and contain details about the report's contents.

Severity level: 0

Syntax:

ReportData messages include the following parameters:

• report. The name assigned to the new report. For example, afa-3928.
• firewall. The name of the device being analyzed.
• report data. Includes details from the report for the device analyzed, such as the number of risks of various severity, security rating scores, number of duplicate objects, number of covered rules, and so on. For details, see Sample ReportData message.

Info syslog messages

Info messages contain additional details about report findings, including a list of any detected risks, changes in the policy, and so on.

Severity: 0

Syntax:

Info messages include the following parameters:

• report. The name assigned to the new report. For example, afa-3928.

• firewall. The name of the device being analyzed.

• msg. Contains the additional details.

  For example: Start data collection or Summary: <risk-level> <count> <risk code> <title>

Admin syslog messages

Admin messages indicate a situation that requires administrative attention.

Severity: 7

Syntax:

Admin messages include the following parameters:

• msg. Contains details about the situation. For example: Low disk space or Over 95% of the disk space is in use

Sample AFA syslog messages

The following examples show syslog messages as they would look in the local /var/log/messages file.

• Sample normal report message sequence, no changes found
• Sample normal report message sequence, manual run
• Sample ReportData message
• Sample analysis failure message, manual run
• Sample admin message
• Sample admin message, High Availability clusters

Each message occupies a single line in the file.

Sample normal report message sequence, no changes found

Sample normal report message sequence, manual run

Sample ReportData message

Sample analysis failure message, manual run

Sample admin message

Sample admin message, High Availability clusters

 

â See also:

• Configure ASMS to generate and send Syslog messages
• AFA analysis syslog messages
• AFA policy change syslog messages
• Login and logout syslog messages