Hello.
Sophos Firewall 18.5.1.
I recently changed every log type to log to "Central Reporting". The entire "Local reporting" column is empty. Before doing this I used to be able to go to the Sophos Firewall and click Log Viewer at the top right and view logs, almost in real time. I used this method to troubleshoot WAF errors. I have learned that having "local reporting" enabled eventually fills up the "report" partition which, according to documentation will eventually fill itself up and if it goes over 90% full, "the report database service is possibly dead" (https://support.sophos.com/support/s/article/KB-000035777).
I did a manual purge yesterday. It took 7 hours for the report partition to go from 89% to 80%. Another 10 hours later (this morning) and it's still at 80%. Not sure if that's normal or if it should drop lower.
Regardless of the report partition stuff, where are the logs now? One particular area I always went in the Log Viewer was "Web Server Protection". I can't find that anywhere in Sophos Central Reporting. All I see are "reports" and can't find recent/active logs that I'm used to seeing. Even when I click on Logs, it goes to reports. If I'm actively trying to view logs for troubleshooting where would I do that?
Obviously, since no local reporting is enabled, the Log View on the Sophos is empty.
This thread was automatically locked due to age.
