Gijo,
The two packet logging options actually do separate things:
- packetlog.enabled in the sensor's properties: This logs all traffic
from the monitoring interface of the sensor. This is useful if you
are concerned the sensor is listening on the wrong interface and may
not be seeing the traffic you are expecting it to see. This option is
not related to what events get fired.
By default, these packet logs will be saved to the sensor's Logs\
directory and will be named Log001.enc through Log010.enc. Options
for this are configurable in the sensor's Advanced Parameters of the
sensor Properties.
- Log Evidence: This is what logs the network traffic which occurs
after an event fires. Only events which have the Log Evidence
response turned on will save packet captures. The packetlog.enabled
option does not have to turned on in order for this to work. By
default, these packet logs will be saved to the sensor's Logs\
directory and will be named ev001.enc through ev035.enc. Options for
this are configurable in the Response policy applied to the sensor.
Keep in mind these are completely separate -- they can be turned on
independently of each other. If you find that your Log Evidence (or
files which begin with "ev") packets are not being saved, make sure
the events which you turned this response on for have actually fired
after you applied the Policy that turned this response on.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
