AUDIT LOGS FOR DELETED RECORD

Hi Mabule

Please make sure that in the firewall rules used for Internet traffic in LAN to WAN or DMZ to WAN or any custom zone to WAN, "Log firewall" option is enabled and you have applied at least "Allow All" Web and application filter policy on the firewall rule to get reports in "Reports".

Enable Local Logging Go to Configure > System Services > Log Settings and select the checkbox 

Log Type (System) to enable local logging. We recommend you enable logging for all modules.

How to troubleshoot on-box reporting issues- https://community.sophos.com/kb/en-us/123209

Please refer to the article- https://docs.sophos.com/nsg/sophos-firewall/v17.1.0/PDF/Sophos%20XG%20Firewall%20Reports%20Guide.pdf

Hi Mabule 

XG will preserve historical logs based on below settings defined under XG.

Step 2: Check the Log Retention Period under Data Management

https://community.sophos.com/kb/en-us/123211

Sophos XG Firewall: How to view Web Surfing Reports for a user

https://community.sophos.com/kb/en-us/123214

However if there is any mis-configuration of rule present where traffic is going from plan rule with no policy and scanning on that rule then also you will not able to see any activity reports.

Sophos XG Firewall: How to troubleshoot on-box reporting issues

https://community.sophos.com/kb/en-us/123209

You may refer above KBA to verify the reports on appliance and some of the pre-requisite which needed to be set on to generate the report.

Thanks, Vishal

We have preserved a historical log for web traffic for a period of three months but funny enough we cannot see logs for some of the days in last month which is within the preserved log history. That is why I need assistance on seeing the audit logs maybe someone has deleted the logs. please assist.

Dear Keyur,

Thanks for your support, "log firewall" is enabled and I can see reports for some days but some days are missing with no records found and I need to figure out why are they missing.

Logging for all modules has been also enabled.

Please assist.

Hi Mabule 

Is device running in HA Active Passive setup? If yes then check the reports on another appliance for the missing days to confirm if another device containing reports for those days. 

If it is not in HA setup and only stand alone device then this required further advance logs checking and log files.For that you may raise a support case to investigate the issue further.

As you are running with older version there could be chances appliance may affected with some report related issue as well which is fixed in latest version.

Example : NC-46780 [Logging Framework] Reports not being generated when Email Notification feature is enabled

Fixed in MR-8.

https://community.sophos.com/products/xg-firewall/b/blog/posts/sfos-17-5-mr8-released

Thanks Vishal for your continuous support, unfortunately, I'm not running in an HA active Passive setup and after this, I will definitely upgrade to the current version.