SOPHOS FIREWALL WEB FILTER OLD LOGS IN LOG VIEWER

Log Viewer
Web Filter
Add Filter
Category is Sexually Explicit

See the format of the timestamp (eg "2023-12-01")

In the Search put in date you want to look at in the same format.  eg 2023-11-26
You can get a few more days that way.  I'm not sure if it based on date or number of entries...

Hello,

I did the steps exactly as you describe but it doesn't return any rows

When I enter the category it does return records but from today and yesterday

If I go to reports, it appears that on the 27th there were attempts and they were blocked, but from there I cannot see the exact time

Hi,

some of what you are asking is limited by the disk size eg model of XG hardware and secondly by your archive settings. Though 2 days of reports does look like a disk limitation and you are running a very old version of XG if the box has not been restarted for 380 days.

Ian

Hello, 

is Sophos Firewall V19 GA. In the report section appears the web block, but in the log viewer dont. Any way to obtain the detail?

Im using a virtual Sophos Firewall Home Edition on PROXMOX

Hi,

thank you for the update. How large is the assigned disk? I cannot get my web page in logviewer to go back past approx 7 days.

If you can see the blocked attempts then you should be able to see the IP address and then search on that information.

Ian

Hello,

Yes i can see what ip tried to access the site, but i want to know the specific time / hour that appear in the log viewer, i only can see if i search it in the same day? :S there is a file that contains that data?

I have Months of data, the virtual hard drive is 100GB

You see all the details in logviewer when you search for the up.

Beginning to sound like your reporting system is corrupt.
ian

There are limitations on the live log that can cause this issue : 

https://doc.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Logs/index.html#local-logs

Basically they are the first thing to get thrown away if the log partition gets slightly full, I come across "disappearing logs" a lot.

Normally you can fall back to the other report formats available on the firewall itself, but as you've spotted there isn't a Blocked Report (for a reason I can't fathom) similar to the Custom User Report (which only reports on successful web access).

It may be too late now, but if you had your XG paired to a Central Dashboard you would have 7 days worth of log history stored there you can use to run an ad hoc report against (which is free).

You could also consider getting an Advanced Reporting license for Central that boosts the amount of data retention and gives more flexible reporting options.

Regards

There are limitations on the live log that can cause this issue : 

https://doc.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Logs/index.html#local-logs

Basically they are the first thing to get thrown away if the log partition gets slightly full, I come across "disappearing logs" a lot.

Normally you can fall back to the other report formats available on the firewall itself, but as you've spotted there isn't a Blocked Report (for a reason I can't fathom) similar to the Custom User Report (which only reports on successful web access).

It may be too late now, but if you had your XG paired to a Central Dashboard you would have 7 days worth of log history stored there you can use to run an ad hoc report against (which is free).

You could also consider getting an Advanced Reporting license for Central that boosts the amount of data retention and gives more flexible reporting options.

Regards