What are log forwarding and notification profiles for in AGS?

Short answer

Both are profiles that are defined under AGS → Integrations and bound to an AGS-enabled vService. A Log Forwarding profile forwards the audit log events of the vService over syslog to a SIEM or syslog server; a profile is a single destination (server, port, UDP/TCP, RFC 3164 or RFC 5424, JSON or CEF), and at most five profiles are added to the Audit Log Forwarders list of the vService. A Notification Profiles profile defines thresholds for the number of failed logins and failed MFAs (per minute), the number of active lockouts and the number of authenticated sessions; when a threshold is exceeded, it sends an alarm to the operator over the E-mail, SMS, SNMP and interface notification channels, and optionally sends the user an e-mail on every login. A single profile is selected in the Notification Profile field of the vService; even if no profile is selected, the AGS Engine status alarm arrives as an interface notification.

How Does It Work?

Log Forwarding:

1. If there is at least one profile in the Audit Log Forwarders list of the vService, the new audit log events written by the AGS engine are sent to the destination in the profile.
2. The event is formatted with Message Format (JSON by default, CEF) and placed in the Syslog Format envelope (RFC 3164 (BSD) by default, RFC 5424); error and warn events are forwarded with the same severity, and the others at the informational level.
3. The sending leaves from the route table selected in the Route Table field; the Send Test Event button in the profile preview sends a test event to the destination.

Notification Profiles:

1. The per-minute thresholds are compared with the number of failed logins and wrong MFAs in the last minute; when the number exceeds the threshold, an alarm is produced.
2. For the lockout and session thresholds, the alarm stays on as long as the instantaneous value reaches the threshold, and turns off when the value drops below it.
3. The alarm is sent to the channels in the profile.

Comparison

	Log Forwarding	Notification Profiles
What it sends	Every audit log event	Only the alarm when a threshold is exceeded and the return-to-normal notification
To whom	A SIEM or syslog server	The operator (E-mail, SMS, SNMP, interface notification); optionally the user themselves
Basic fields	Syslog Server, Port (514), Protocol (UDP by default, TCP), Syslog Format, Message Format, Application Name (TR7_AGS), Route Table	Failed Authentication Threshold (per min), Failed MFA Threshold (per min), Active Lockout Threshold, Authenticated Session Threshold; the channels E-mail, SMS, SNMP Notification, UI Notification (on by default); E-mail User on Sign-in
Field on the vService	Audit Log Forwarders (at most 5 profiles)	Notification Profile (a single profile)
Default	No profile; events are not forwarded	No profile; only the engine status alarm arrives as an interface notification

Log Forwarding and Notifications in TR7

• The profiles are defined under AGS → Integrations; there is no built-in profile. They are bound to the vService from the General Settings window or from the Monitoring & Notification row of the AGS Management tab.
• The same profile can be used on several vServices; the alarms are produced separately for each vService.
• All four thresholds are off by default; when one is turned on, the field comes with the value 30 for failed logins and MFA, 10 for lockouts and 1000 for sessions.
• If E-mail User on Sign-in is on, a notification is sent to the user's own e-mail address on every successful login; users whose e-mail address is unknown are skipped. The sending uses the general e-mail settings of the device.
• Log Forwarding forwards the events that occur after the profile is bound; earlier events are examined on the Audit Logs tab.

Common Misconceptions

• "Log Forwarding in Settings also sends the AGS logs." Settings → General Settings → Log Forwarding forwards the system logs of the device; AGS audit logs are sent only with AGS → Integrations → Log Forwarding profiles.
• "If I don't select a notification profile, no alarm arrives at all." The AGS engine status alarm arrives as an interface notification even if no profile is selected; if a profile is selected, it is sent with the channels of the profile.
• "If Send Test Event succeeds, the event has reached the SIEM." The message reports only that the event was sent; since UDP has no delivery confirmation, the event is verified on the SIEM side.
• "The notification profile reports every failed login." The profile reports threshold breaches, not individual events; Log Forwarding is used for an event-by-event record.

How it is done in the documentation

• Log Forwarding · What Is Log Forwarding?
• Log Forwarding · Operating Mechanism
• Notification Profiles · What Are Notification Profiles?
• Notification Profiles · Operating Mechanism

Related questions

• What are AGS Audit Logs; which events are recorded?
• What is the AGS engine; what does the Engine screen show?
• How do I send logs to a SIEM (Syslog)?
• How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)?