Rule Trap and Syslog for ONEPolicy

You can be notified when a policy rule is used by enabling “Syslog” or “trap” actions:

The Syslog action sends an entry in the log after first rule use with the EMS tag “Policy.LogRuleHit”.
The trap action sends an etsysPolicyRulePortHitNotification SNMP trap to the configured trap receiver.

By default, the Syslog and trap actions only occur when the rule is first used. However, for the Syslog action, you can configure the system to send messages every time the rule is used at a maximum rate of once every five seconds.

Additionally, a rule counter tracks the number of times a packet triggers a rule. By default, the counter is enabled for all rules.You can set an interval for how often this counter is cleared, or manually clear it at any time.

For information about configuring rule trap/Syslog, and the rule counter, see Setting up Rule Trap and Syslog.

Limitations

Not supported on admin profile rules.