Troubleshooting Sonicwall Firewall
Common Issues and Solutions
Installation Issues
Issue: Integration fails to install
Solution: Verify Logpoint version compatibility (v6.7.4 or later)
Solution: Check available disk space and system resources
Solution: Ensure proper administrative privileges
Issue: Integration not visible after installation
Solution: Refresh the browser and check under Settings >> System Settings >> Plugins
Solution: Restart Logpoint if necessary
Configuration Issues
Issue: Cannot configure syslog forwarding on SonicWall device
Solution: Verify you have administrative access to SonicWall device
Solution: Ensure Logpoint IP address is reachable from SonicWall device
Solution: Check firewall rules allow syslog traffic (typically UDP port 514)
Solution: Consult SonicWall documentation for proper syslog configuration
Issue: Wrong normalizer selected
Solution: Use SonicFirewallCompiledNormalizer for standard SonicWall logs
Solution: Use SonicWallAventailCompiledNormalizer for SonicWall Aventail logs
Solution: Verify log format from SonicWall matches selected normalizer
Issue: Processing policy configuration errors
Solution: Ensure normalization policy is created before processing policy
Solution: Verify the correct normalizer is selected in the normalization policy
Solution: Check that routing and enrichment policies are properly configured
Data Ingestion Issues
Issue: No logs being ingested
Solution: Verify SonicWall device is configured to forward syslog to Logpoint
Solution: Check if syslog service is running on SonicWall device
Solution: Confirm syslog collector is active in Logpoint
Solution: Test network connectivity from SonicWall to Logpoint
Solution: Verify SonicWall syslog configuration includes correct destination IP and port
Issue: Incomplete log ingestion
Solution: Check routing criteria configuration - ensure it matches SonicWall log structure
Solution: Verify the correct normalizer and normalization packages are selected
Solution: Monitor collector logs for errors or warnings
Solution: Check if specific log types are disabled on SonicWall
Issue: Logs not normalized correctly
Solution: Verify appropriate Compiled Normalizer is selected (SonicFirewallCompiledNormalizer or SonicWallAventailCompiledNormalizer)
Solution: Check log format matches expected format
Solution: Ensure SyslogParser is selected as the parser
Solution: Verify SonicWall firmware version is supported
Issue: Date/timestamp parsing errors
Solution: Check SonicWall timezone configuration matches Logpoint device timezone
Solution: Ensure date and time fields are present in SonicWall logs
Solution: Verify timestamp format in logs matches expected format
Dashboard and Analytics Issues
Issue: Dashboard widgets not displaying data
Solution: Verify repository selection matches where SonicWall logs are stored
Solution: Check time range settings on dashboard
Solution: Confirm normalization is working correctly using search query:
norm_id = "Sonic*"Solution: Ensure device timezone matches log source timezone
Issue: Bandwidth widgets showing no data
Solution: Verify traffic logs are being generated by SonicWall
Solution: Check that byte count fields are populated
Solution: Ensure bandwidth logging is enabled on SonicWall
Solution: Verify bandwidth calculation fields are being normalized correctly
Issue: User activity widgets showing no data
Solution: Verify user authentication logging is enabled on SonicWall
Solution: Check that user field is populated in logs
Solution: Ensure authentication events are being forwarded
Solution: Verify user activity normalization is working correctly
Issue: Severity widgets showing incorrect data
Solution: Verify severity field is being parsed correctly
Solution: Check severity value mapping (0=High to 7=Low)
Solution: Ensure severity levels are configured on SonicWall
Solution: Verify severity normalization matches SonicWall format
Issue: Geographic data not appearing
Solution: Verify GeoIP enrichment policy is configured in Logpoint
Solution: Check that source_address and destination_address fields are populated
Solution: Ensure GeoIP database is up to date in Logpoint
Solution: Verify IP addresses are public (not RFC 1918 private IPs)
Issue: Administrative tasks widget empty
Solution: Verify administrative action logging is enabled on SonicWall
Solution: Check that admin events are being generated
Solution: Ensure admin user actions are logged
Solution: Verify event_type field contains "admin" value
Alert Issues
Issue: Alerts not triggering
Solution: Review alert queries and ensure they match SonicWall log format
Solution: Check alert policy configuration and notification settings
Solution: Verify logs contain expected fields for alert matching
Solution: Test alert query manually in search to confirm matching events exist
Issue: False positive alerts
Solution: Tune alert thresholds to reduce noise
Solution: Add exclusion criteria for known benign events
Solution: Review alert query logic for overly broad matching
Solution: Implement correlation rules for more accurate detection
Performance Issues
Issue: Slow query performance
Solution: Optimize queries by adding time range constraints
Solution: Use indexed fields in search queries where possible
Solution: Consider data retention policies to manage repository size
Solution: Filter by specific event types to reduce scope
Issue: High resource usage
Solution: Monitor syslog collector resource consumption
Solution: Implement log filtering using routing criteria to reduce unnecessary data ingestion
Solution: Monitor and tune normalization policies
Solution: Consider adjusting SonicWall logging levels to reduce volume
Issue: High log volume from SonicWall
Solution: Adjust logging levels on SonicWall to reduce verbosity
Solution: Disable logging for low-priority events
Solution: Configure SonicWall to log only security-relevant events
Solution: Use log filtering on SonicWall before forwarding to Logpoint
Solution: Implement selective routing criteria in Logpoint
Event-Specific Issues
Issue: Connection events not appearing
Solution: Verify connection logging is enabled on SonicWall
Solution: Check that connection tracking is active
Solution: Ensure firewall policies include logging
Solution: Verify connection detail fields are populated
Issue: Port scan detection not working
Solution: Verify IPS features are enabled on SonicWall
Solution: Check that port scan detection is configured
Solution: Ensure intrusion prevention signatures are up to date
Solution: Verify message field contains port scan indicators
Issue: Upload/download events missing
Solution: Verify file transfer logging is enabled
Solution: Check that action field captures upload/download operations
Solution: Ensure content inspection is active
Solution: Verify data size fields are being populated
Integration-Specific Issues
Issue: SMA (Secure Mobile Access) logs not normalizing
Solution: Verify LP_SonicWall SMA normalization package is selected
Solution: Check SMA log format compatibility
Solution: Ensure SMA is forwarding logs correctly
Solution: Verify network connectivity from SMA to Logpoint
Issue: Multiple SonicWall devices logging inconsistently
Solution: Ensure all SonicWall devices use consistent syslog configuration
Solution: Verify firmware versions are compatible across devices
Solution: Check that logging settings are uniform across devices
Solution: Use device-specific normalization if needed
Issue: Aventail-specific logs not processing
Solution: Verify SonicWallAventailCompiledNormalizer is selected
Solution: Check Aventail log format matches expected structure
Solution: Ensure Aventail-specific fields are being captured
Solution: Verify Aventail devices are forwarding logs to Logpoint
Uninstalling SonicWall Firewall
If you need to remove the SonicWall Firewall integration:
Remove Configuration Dependencies
Delete or modify any dashboards using SonicWall data
Remove alert rules based on SonicWall events
Disable collectors fetching SonicWall logs
Remove device configurations for SonicWall
Uninstall the Integration
Go to Settings >> System Settings >> Applications.
Locate the SonicWall Firewall integration.
Click the Uninstall icon from the Actions column.
Note: You must remove all SonicWall Firewall configurations before the integration can be completely deleted.
Last updated
Was this helpful?