Screen OS

We have some traffic that is going outbound after hours and I want to track the source down from the SSG5.

Is there a way to monitor traffic on an interface based on schedule? I want to review the traffic at a later date.

Yes - you can create policies and have them be schedule (time) dependent. Under the policy elements you can create a schedule. Then create a policy and apply the schedule to it and the policy will only be in effect during the schedule period.

how do I log to an external server? I look at syslog but the policy hits aren't getting logged.

You need to verify that syslog is configured to forward the traffic logs.  

You can verify this by checking it via the "get syslog" command.  Make sure that the traffic log is enabled.

If not you can set this up by either defining it specifically or by enabling all logs. 

set syslog config x.x.x.x log traffic  ( you can also make this more expansive by using "all" instead of the keyword traffic )

set syslog enable

save

That worked. Found our syslog server was having issues. I fixed that and found information being sent.

Hi

Please send me the get syslog output . do u already enable logging on policy ?

thanks

EL