Limit Types of Log Records Sent to Syslog Server

yes some what... You can set the log type and severity from the cli in a filter

e.g

config log syslogd filter 

and

config log eventfilter

{

    set severity information

    set forward-traffic enable

    set local-traffic enable

    set multicast-traffic enable

    set sniffer-traffic enable

    set anomaly enable

    set netscan-discovery enable

    set netscan-vulnerability enable

    set voip enable

}

You can also set specific filter for traffic per-se, but you have generic filters that you can apply by policies if you play it smart. You need to determine what fwpolicies and/or create more fwpolicies by service/dst/src etc.

e.g 

 edit 1

        set srcintf "lan"

        set dstintf "wan1"

        set srcaddr "all"

        set dstaddr "all"

        set action accept

        set schedule "always"

       ---> set service "ALL"  <-----HERE 

        set logtraffic all

        set nat enable

    next

That might generate excessive log traffic is you only want logging  for  HTTP/HTTPS traffic. So you could add a HTTP/HTTPS services  in a fwpolicy,  and remove the  logging from the more broader traffic

e.g 

 edit 11

        set srcintf "lan"

        set dstintf "wan1"

        set srcaddr "all"

        set dstaddr "all"

        set action accept

        set schedule "always"

        set service "HTTP"

        set logtraffic all

        set nat enable

    next

 edit 10

        set srcintf "lan"

        set dstintf "wan1"

        set srcaddr "all"

        set dstaddr "all"

        set action accept

        set schedule "always"

        set service "HTTPS"

        set logtraffic all

        set nat enable

    next

 edit 1

        set srcintf "lan"

        set dstintf "wan1"

        set srcaddr "all"

        set dstaddr "all"

        set action accept

        set schedule "always"

        set service "ALL"

        unset logtraffic 

        set nat enable

    next

You have a limit means for traffic log filter and system events but it is doable to some degree. Just think it out and play with your filters and define logging on policies that you deem necessary.

YMMV ;)

Ken

Yes and because my logs are empty which does give me conformation.

XXXXXXX (setting) # show

config log setting

set fwpolicy-implicit-log enable

set local-in-allow enable

set local-in-deny-unicast enable

set local-in-deny-broadcast enable

set local-out enable

end

XXXXXXX # execute log filter cat 0

XXXXXXX # execute log filter field action deny XXXXXXX # execute log display

0 logs found.

0 logs returned.