Notifications

Notifications are sent by email or as SNMP traps.

In addition to the default notifications, Sophos Firewall sends notifications automatically for some events.

These notifications are sent automatically and you can’t remove them.

Here's a list of all notifications the firewall sends:

Admin

Sign-in failed.

This notification is sent when users sign in to the firewall with the wrong credentials or OTP.
Too many failed sign-in attempts.

This notification is sent when a user reaches the number of unsuccessful attempts to sign in to the firewall as configured on Administration > Admin and user settings > Login security.

This notification is sent when the firewall logs and drops the packet for an IPS threat.

Alert

This notification is sent when the firewall logs the threat but still allows the data flow.
Drop

This notification is sent when the firewall logs and drops the packet for a threat.

Disk usage notifications are sent when thresholds are met.

The following table shows the details:

Notification	Threshold	Frequency	Behavior
Configuration disk usage exceeded threshold.	80 percent and above	50 seconds	Once the configuration disk usage reaches 80 percent and stays at or above this figure for 50 seconds, the first notification log is generated. Logs are generated every 50 seconds until the usage drops below 80 percent.
Signature disk usage exceeded threshold.	90 percent and above	50 seconds	Once the signature disk usage reaches 90 percent and stays at or above this figure for 50 seconds, the first notification log is generated. Logs are generated every 50 seconds until the usage drops below 90 percent.
/var partition exceeded usage threshold.	80 percent and above	12 hours	When the reports disk usage reaches 80 percent and stays at or above this figure for 50 seconds, the first notification log is generated. Logs are generated every 12 hours until the usage drops down below 80 percent.

WebCat database upgrade failed.
IPS signature upgrade failed.
Antivirus definition upgrade failed.
System started.

This notification is sent when the firewall device is started or restarted.
High CPU usage.

Once the CPU usage reaches 95 percent and stays at or above this figure for 25 minutes, the first notification log is generated. Logs are generated every 25 minutes until the usage drops down below 95 percent.
Gateway status.

These notifications are turned on by default. To send them, turn on Email notifications.

VPN notifications are sent when an event occurs. These are sent at approximately 60-second intervals until the triggering event is resolved.

For site-to-site connections with more than one local and remote network, a notification is sent for each subnet pair.

Notifications include a description of the IPsec connection if the administrator enters the information in the connection settings.

IPsec notifications are sent only when host-to-host and site-to-site tunnel connections are disconnected for these reasons:

Dead peer detection (DPD).
Failed to re-establish connection after DPD.
IPsec Security Association (SA) expired and must be re-established.
After losing connectivity, the IPsec tunnel comes up without administrator intervention.

Here's a list of all VPN notifications: