Recently took over the administration of our Pix firewall and got Syslogging turned on. I've been watching the logs to try and educate myself and have a newbie question about what log entries are "important" and what's standard operational messages.
I've seeing a lot of this:
Jun 07 2004 00:17:26: %PIX-5-611103: User logged out: Uname: enable_1
It occurs about every 20 minutes and will generate about 3-5 identical events. I don't see any corresponding 611101 Authentication succeeded messages.
Any idea what causes these? No person should be logged into the Pix at this time. Is this a standard operational message?
I've seeing a lot of this:
Jun 07 2004 00:17:26: %PIX-5-611103: User logged out: Uname: enable_1
It occurs about every 20 minutes and will generate about 3-5 identical events. I don't see any corresponding 611101 Authentication succeeded messages.
Any idea what causes these? No person should be logged into the Pix at this time. Is this a standard operational message?