Description

Unable to find logs related to Anti-Virus.

Symptoms

  • Anti-Virus is running on the device
  • Anti-Virus is enabled on policy
  • Unable to find event logs related to Anti-Virus

Solution

By default, only critical level messages are logged in the system Syslog.  Most of the Anti-Virus related logs are not critical level.  To ensure that you receive all AV related logs, configure system Syslog to log any level that has the keyword of "AntiVirus" in the logs.

Example: 

root@test# edit system syslog 

[edit system syslog]
root@test# show 
user * {
    any emergency;
}
file messages {
    any critical;
    authorization info;
}
file interactive-commands {
    interactive-commands error;
}
file utm-messages {
    any any;
    authorization any;
    match Antivirus;
}

[edit system syslog]
root@test#
In this example, any log message that includes the string "AntiVirus" will be logged to the file utm-messages (this includes all severity levels to all facilities).  Here is an example of an AV event log message that is being written to the file utm-messages: 
Dec 23 12:30:44  test RT_UTM: AV_VIRUS_DETECTED_MT: AntiVirus: Virus detected: 
from 188.40.238.250:80 to 192.168.10.60:2949 source-zone untrust www.eicar.org/
download/eicar.com.txt file www.eicar.org/download/eicar.com.txt/packed virus 
EICAR-Test-File URL:http://www.viruslist.com/en/search?VN=EICAR-Test-File

Modification History

2020-10-15: Minor, non-technical edits.