Monitor Security Analytics and Logging service availability

Monitor the availability and health of Security Analytics and Logging(SaaS) service, review Firewall Threat Defense device event logging status, and determine when Security Analytics and Logging last received events from managed devices.

Note	The Service Status tab currently supports Firewall Threat Defense devices.

Before you begin

Enable the managed Firewall Threat Defense devices to send events to the Security Analytics and Logging cloud so you can view meaningful device logging status and last-event details.

Procedure

Step 1

Choose Administration > Logging Settings.

Step 2

Click View Logging Storage Usage.

Tip	Alternatively, navigate to Events & Logs > Events > Event Logging and then click the View Dashboard button to view the Security Analytics and Logging service status.

Step 3

Click the Service Status tab.

Step 4

Review the SAL Service Availability widget to check the current Security Analytics and Logging service status.

If the Security Analytics and Logging service status displays Degraded, your Security Analytics and Logging service is affected and event ingestion might be delayed or disrupted.

Step 5

Check the Last Event Received widget to determine when Security Analytics and Logging last received an event from a device.

Step 6

Review the Firewall Logging Status widget to check Firewall Threat Defense device event logging status.

Connected: Indicates the number of Firewall Threat Defense devices that are enabled to send events to the Security Analytics and Logging.
Disabled: Indicates the number of Firewall Threat Defense devices that are disabled from sending events to the Security Analytics and Logging.

Step 7

In the Firewall Details list, check when each Firewall Threat Defense device last sent an event to Security Analytics and Logging.

Use this information along with SAL Service Availability and Last Event Received widgets to identify whether events might be delayed or not ingested.