Log Viewer > Firewall goes back by 10 days or so. I need to retrieve Firewall logs for a period of 2 weeks starting 20 days ago.
I've learned that XG(S) do not store log files for Firewall rules.
From other posts I've also learned that I should use Sophos Firewall Manager to retrieve this data.
From other articles I've also learned that SFM has been discontinued and the functionality migrated to Sophos Central.
With that said, I am looking for guidance on how to use Central to retrieve the firewall logs as they appear in the Log Viewer.
I don't need the aggregate report. I need to see the user, the SRCIP, DSTIP, SRCPORT, DSTPOST etc etc and filter by the user and the DSTPORT.
This is all I could find and the results are worthless:
Hello there,
As Carbon15 mentioned, unless you have an Advanced Firewall Reporting license, you will only get 7 days of Free reporting.
In your central click on the arrow on the Top Right > Licensing > and search for Central Firewall Reporting.
Regards,
Hello,
As I mentioned above, we bought the Xstream Protection Bundle, which is supposed to include Central Orchestration features like 30-day CFR and CFR Advanced. Am I missing something?
Also, even if we set aside for a moment the data retention question (7days vs 30 days), I still do not see in Central where CFR produces the "more detailed" logs, even for the last 7 days.
Is there a resource that demonstrates how to pull those detailed logs in Central? I cannot find anything remotely close to the local Log Viewer on the Firewall.
Also, despite the fact that our Firewall is registered to the same Central account, I went into the Licenses as you suggested and I can see only the Endpoint Licenses listed. No Xstream bundle in there.
On the firewall itself:
Looks like the Central reporting is absolutely broken. The generated reports aren't corresponding to other data logs.
Log Viewer. Plenty of logs for Rule ID #1 DST Port = 3389
Central Reporting:
Quote