How to receive email alerts for Audit logs

07/17/2023 26 People found this article helpful 228,195 Views

Description

Before proceeding with setting up email alerts for Auditing logs, make sure you have a working SMTP server configured on SonicWall.

Please refer to the below KB to make sure:

How can I e-mail logs and alerts via an SMTP server? | SonicWall

To display the auditing logs in the event logs, you need to first activate Enhanced Audit Logging. Then, choose the relevant category in the event logs to this receive via email whenever such an event takes place.

Resolution

Resolution for SonicOS 7.X

This release includes significant user interface changes and many new features that are different from the SonicOS 6.5 and earlier firmware. The below resolution is for customers using SonicOS 7.X firmware.

Navigate to Device | Settings | Administration .
Click Audit/SonicOS API Tab .
Enable Enhanced Audit Logging .This Enables logging all configuration changes in the Monitor | Logs | System Logs page. The log entry contains the parameter changed and user name.
Navigate to Device | Log | Settings and edit the category Log | Configuration Auditing
Select the priority as alert and provide your email address and save it.
Now whenever a configuration request is made on the firewall, an email should be sent to the designated alert email address.

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

Navigate to Manage | Appliance | Base Settings.
Enable Enhanced Audit Logging .This Enables logging of all configuration changes in the Monitor | Event Logs page. The log entry contains the parameter changed and user name.
Navigate to Manage | Log settings | Base setup and edit the category Log | Configuration Auditing
Select the priority as alert and provide your email address and save it.
Now whenever a configuration request is made on the firewall, an email should be sent to the designated alert email address.