Skip to main content
The Aviatrix Controller and all of its managed gateways can be configured to forward their logs to well known log management systems. This section describes Aviatrix log keywords that can be identified by log management systems for further analysis.

​
Aviatrix Log Keywords

The following types of Aviatrix log keywords can be identified by the Log Management System for further analysis:

​
AviatrixVPNSession

This log is for gateways that have VPN enabled. Logs with this prefix come from the Controller and contain information such as the VPN username, the VPN gateway IP address and name where the user connects to, client virtual IP address, connection duration, total received bytes, total transmitted bytes, and login and logout time. Two logs will be generated for each VPN connection. One is when the connection is established, the other when it is disconnected. Example logs: Connect Log:
Disconnect log:

​
AviatrixUser

This log is for gateways that have VPN enabled. Logs with this prefix come from each VPN gateway managed by the Controller. The log contains the information for the TCP session, such as inbound and outbound interface, source IP address, destination IP address, TTL value, protocol name, and packet length. The log record is for each packet that passes through the VPN connection from the client to the destination. Two example logs:

​
AviatrixLicenseVPNUsers

This log is for gateways that have VPN enabled. Logs with this prefix come from the Controller and can be used to monitor the license usage of active vpn users connected to all vpn gateways. One example log:
There is a typo in some versions (as noted in the above example) that incorrectly shows this entry as AviatrixLicsenseVPNUsers instead of AviatrixLicenseVPNUsers.

​
AviatrixRule

You need to configure security policies to see AviatrixRule log. Logs with this prefix come from each gateway managed by the Controller. Any packet that triggers the security policy rule will generate a log record of this type with the first 100 bytes of the packet. It contains the information such as gateway IP address, inbound and outbound interface, MAC address, TTL value, protocol name, source IP address, destination IP address and packet length. An example for a deny rule event is shown below. The log event prefix is “AvxRl gw1 D:”, where the gateway name is gw1, “D” represents Drop.
Another example for an accept rule event is shown below. The log event prefix is “AvxRl StatefulGW2 A:”, where the gateway name is StatefulGW2, “A” represents Accept.

​
AviatrixGwMicroSegPacket

You need to configure Distributed Firewalling micro-segmentation policies to see AviatrixGwMicrosegPacket logs. Logs with this prefix come from your configured Distributed Firewalling micro-segmentation policies. These logs contain the following information:
  • timestamp
  • source IP
  • destination IP
  • protocol (for example, ICMP or TCP)
  • port number
  • if a policy is enforced
  • if a policy was allowed or denied
  • gateway name
  • policy ID
A micro-segmentation log example is shown below:

​
AviatrixGwNetStats

Logs with this prefix come from each gateway managed by the Controller. These logs are sampled every minute and give details about gateway network interface. Two example logs:

​
AviatrixGwSysStats

Logs with this prefix come from each gateway managed by the Controller. These logs are sampled every minute and give details about gateway memory, cpu and disk load. Two example logs:

​
AviatrixFQDNRule

You need to configure FQDN allow lists in order to see these logs. Logs with this prefix come from each gateway managed by the Controller. Domain name filtering can be configured per gateway via Controller. And every time a gateway tries to access a domain name, it will check if the domain name passes the configured filters. If it does, access will be allowed with the state as MATCHED, otherwise it will be discarded with state as NO_MATCH. Two example logs:

​
AviatrixTunnelStatusChange

Logs with this prefix come from the Controller whenever a tunnel status changes. old_state means old state of the tunnel, and new_state is the new changed state of tunnel. Example log:

​
AviatrixCMD

Logs with this prefix come from the Controller whenever a CLI command is issued. It contains information on the CLI command that was issued, the results of the execution, reason a message if there is a failure and who issued the command. Example log:

​
AviatrixBGPOverlapCIDR

Log messages with this prefix come from the Controller whenever it detects overlapping CIDRs between on-prem learned and Spoke VPC CIDRs. Example log:

​
AviatrixBGPRouteLimitThreshold

Log messages with this prefix come from the Controller whenever it detects that total BGP routes exceed the 80 routes. (AWS VGW has a total 100 route limit.) Example log:

​
AviatrixGuardDuty

Log messages with this prefix come from the Controller whenever it receives an alert message from AWS GuardDuty. Example log:

​
AviatrixFireNet

Log messages with this prefix come from the Controller whenever a firewall instance state changes. Example log:

​
AviatrixVPNVersion

Log messages with this prefix come from the Controller whenever it rejects an Aviatrix VPN client connection. Example log:

​
AviatrixGatewayStatusChanged

These log messages will be seen from the Controller’s syslogs when a gateway’s status changes. Example log: