TMS zl Management and Configuration Guide ST.1.1.100226

C-16
Log Messages
Log Message Formats and Fields
IPS: IPS Traffic Anomaly Family
Log messages from the IPS traffic anomaly family
(id=ips_traffic_anomaly_family) may also contain these fields:
■ actiontype=[notify | limit | block]
The action setting of the IDS rule
■ attacktime=[YYYY-MM-DD HH:MM:SS]
The time of the attack
■ filterdescription=[text]
The description of the filter
rulefam [general | backdoor | DOS
exploits | gain | access |
traffic | info | traffic |
anomaly | protocol anomaly
| reconnaissance |
malware | virus |
inappropriate | botnet |
spamhaus]
The signature family of the rule that was triggered
rulename text Name of the signature
rulethreat [Critical | Severe | Minor |
warning | Information]
tcpoptions integer TCP options
timetolive integer The time to live of the packet that triggered the IPS rule
Field Name Value Format Description