se commands apply only to the PIX itself. To send logs to a syslog host, you must configure a trap destination level, the syslog facility, and the host to receive the logs: logging trap debugging logging facility 22 logging host inside 192.168.1.200 On the syslog server, you then need to configure syslog to receive these alerts. Detailed syslog configuration is outside the scope of this book, SO I'll just include the letc/syslog.conf entries from my Solaris server: # Configuration for PIX logging local6.debug /var/log/PIX This will capture the PIX syslog entries, and place them into the /var/log/PIX file. Notice that the PIX is configured for facility 22, but the server is configured for local6.debug The facilities are mapped as 16(LOCAL0)-23(LOCAL7). The default is 20(LOCAL4). Once you've begun collecting syslog entries into a file, you can use the server to view and parse the log file without affecting your CLI window. On Unix systems, you can use commands like tail -f /var/log/PIX to view the log in real time. You can also add filters. For example, if you only wanted to see log entries containing the URL/lablindex. html/, you could use the command tail /var/log/PIX | grep /lab/index.html/'. For more information on logging, type help logging in PIX configura- tion mode. On a Unix system, you can learn more about syslog with the man syslog and man syslogd commands. Chapter 26: PIX Firewall Configuration Troubleshooting If you change an access list, change NAT, or do anything else that can alter what packets are allowed to flow through the firewall, you may not see the results until you execute the clear xlate command. Xlate is short for translation. A translation is created for every conversation that is active on the PIX. To see what xlates are active on your PIX, use the show xlate command: PIX# sho xlate 10 in use, 114 most used PAT Global 10.0.0.5(9364) Local 192.168.1.110(1141) PAT Global 10.0.0.5(1211) Local 192.168.1.100 (3090) PAT Global 10.0.0.5(1210 Local 192.168.1.100 (3089) PAT Global 10.0.0.5(1209) 