Define Alarm Settings
- Device > Log Settings
Use the Alarm Settings to configure Alarms for the CLI and the web interface. You can configure notifications for the following events:
- A security rule (or group of rules) has been matched at a specified threshold and within a specified time interval.
- Encryption/Decryption failure threshold is met.
- The Log database for each log type is nearing full; the quota by default is set to notify when 90% of the available disk space is used. Configuring alarms allows to take action before the disk is full, and logs are purged.
When you enable alarms, you can view the current list by clicking
Alarms( ) in the bottom of the web interface.
To add an alarm, edit the Alarm Settings described in the following table.
Alarm Log Settings
Alarms are visible only if you
If you disable alarms, the firewall does not alert you to critical events that require action. For example, an alarm tells you when the master key is about to expire; if the key expires before you change it, the firewall reboots into Maintenance mode and then requires a factory reset.
Enable CLI Alarm Notifications
Enable CLI alarm notifications whenever alarms occur.
Enable Web Alarm Notifications
Open a window to display alarms on user sessions, including when they occur and when they are acknowledged.
Enable Audible Alarms
An audible alarm tone will play every 15 seconds on the administrator's computer when the administrator is logged into the web interface and unacknowledged alarms exist. The alarm tone will play until the administrator acknowledges all alarms.
To view and acknowledge alarms, click
This feature is only available when the firewall is in FIPS-CC mode.
Encryption/Decryption Failure Threshold
Specify the number of encryption/decryption failures after which an alarm is generated.
Log-type> Log DB
Generate an alarm when a log database reaches the indicated percentage of the maximum size.
Security Violations Threshold /
Security Violations Time Period
An alarm is generated if a particular IP address or port hits a deny rule the specified number of times in the
Security Violations Thresholdsetting within the period (seconds) specified in the
Security Violations Time Periodsetting.
Violations Threshold /
Violations Time Period /
Security Policy Tags
An alarm is generated if the collection of rules reaches the number of rule limit violations specified in the
Violations Thresholdfield during the period specified in the
Violations Time Periodfield. Violations are counted when a session matches an explicit deny policy.
Security Policy Tagsto specify the tags for which the rule limit thresholds will generate alarms. These tags become available to be specified when defining security policies.
The selective audit options are only available when the firewall is in FIPS-CC mode.
Specify the following settings:
Alarms Logs An alarm is a firewall-generated message indicating that the number of events of a particular type (for example, encryption and decryption failures) has ...
Alarms An alarm is a firewall-generated message indicating that the number of events of a particular type (for example, encryption and decryption failures) has exceeded ...
Use VMware Tools on the VM-Series Firewall on ESXi and vClo...
Use VMware Tools on the VM-Series Firewall on ESXi and vCloud Air VMware Tools is a utility that improves the ability to manage the VM-Series ...
Enable CloudWatch Monitoring on the VM-Series Firewall on A...
Enable CloudWatch Monitoring on the VM-Series Firewall on AWS The VM-Series firewall on AWS can publish native PAN-OS metrics to AWS CloudWatch, which you can ...
Log Types The firewall displays all logs so that role-based administration permissions are respected. Only the information that you have permission to see is included, ...
Device > Master Key and Diagnostics
Device > Master Key and Diagnostics Select Device Master Key and Diagnostics or Panorama Master Key and Diagnostics to configure the master key that encrypts ...
Flood Protection A zone protection profile with flood protection configured defends an entire ingress zone against SYN, ICMP, ICMPv6, UDP, and other IP floods. The ...
Provide Granular Access to Global Settings
Provide Granular Access to Global Settings To define what global settings and administrator has access to, when creating or editing an admin role profile ( ...
Flood Protection Network > Network Profiles > Zone Protection > Flood Protection Configure a profile that provides flood protection against SYN, ICMP, ICMPv6, and UDP ...