Traffic : Local 1

Traffic : Local

Base Rule

General Traffic Log

Network Traffic

Traffic Local Closed

Sub Rule

General Traffic Other Notice

Information

Local Traffic Timeout

Sub Rule

Session Disconnected

Information

Traffic Local Accepted

Sub Rule

Traffic Allowed by Network Firewall

Network Allow

Local Traffic Accepted

Sub Rule

Traffic Allowed by Network Firewall

Network Allow

Traffic Local Deny

Sub Rule

Traffic Denied by Network Firewall

Network Deny

Forward Traffic Deny

Sub Rule

Traffic Denied by Network Firewall

Network Deny

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

logid

<vmid>

<tag1>

Number

The ID (logid) is a 10-digit field. It is a unique identifier for that specific log.

srcip

<sip>

IP Address

IP address of the traffic’s origin.

dstip

<dip>

IP Address

Destination IP address for the web.

srcport

<sport>

Number

Port number of the traffic's origin.

dstport

<dport>

Number

Port number of the traffic's destination.

srcintf

<sinterface>

Text\String

Interface name of the traffic's origin.

dstintf

<dinterface>

Text\String

Interface of the traffic's destination.

proto

<protnum>

Number

The protocol used by web traffic (tcp by default),

sessionid

<session>

Number

ID for the session.

appcat

<objectname>

Text\String

Category of the application.

devname

<subject>

Text\String

N/A

policyid

<policy>

Number

N/A

action

<action>

<tag2>

Text\String

N/A

rcvdbyte

<bytesin>

Number

N/A

sentbyte

<bytesout>

Number

N/A

rcvdpkt

<packetsin>

Number

N/A

sentpkt

<packetsout>

Number

N/A