Export Firewall-Log

Hello Norbert Rümelin ,

Thanks for reaching out to Sophos Community.

You can get the logs in SF as outlined on this KBA: https://support.sophos.com/support/s/article/KB-000041274?language=en_US

Regards,

Hi,

thank you. But as I mentioned I already searched within the whole /log/-directory. Not sure if the file not in the /log/ but anywhere else or the entries are not in clear-text and I cannot find them for that reason.

Regards

SFOS does not use a packetfilter.log as the conntrack collects more data. 

You could look into Central as it uses the Logviewer as an external Syslog. 

Thanks, in Central it look like what I try to archive while it just gives me 100 entries per page and is much less flexible and slower than when I could just handle the raw data.

Somehow conntrack also must store the collected data locally on the firewall mustn't it?

No, this was never implemented. What is your use case, what do you want to do? 
Customers doing that, have a syslog server in place and do there cross collection.

Your initial post is about traffic blocking: Just to make sure: Nowadays you will find most traffic / apps using Port443 - So blocking traffic based on port is likely not usable anymore - You could block it based on the port, but the most apps will do a fallback to encrypted 443. Did you check on the block firewall rules on the UTM and adapt your system? 
And what do you want to block and what not?  

We have some UTMs that seperate our client-network from several production- and server-networks.

On a new built site we now have the same - seperation between the clients to some production- and server-networks but via an XGS. As there a several applications and the mechanics of our suppliers are not deep in the network we do not always get detailed information which devices need connections on which ports. While at the same time the management makes pressure that our site does not delay the going live.

So when creating a new network we make a rule for all traffic from the new net with enabled logging and one to the net for all traffic with logging and during the implementation we filter what traffic is fetched by them to create the true rules. In the end we set the rules to blocking and all is good.

It is just pretty much in there and sometimes it is useful to cross-check a week of connections. It can be done with the log-viewer but having all exported and handled with an external tool was much more comfortable and also easier to discuss with the engeneering-teams.

We have some UTMs that seperate our client-network from several production- and server-networks.

On a new built site we now have the same - seperation between the clients to some production- and server-networks but via an XGS. As there a several applications and the mechanics of our suppliers are not deep in the network we do not always get detailed information which devices need connections on which ports. While at the same time the management makes pressure that our site does not delay the going live.

So when creating a new network we make a rule for all traffic from the new net with enabled logging and one to the net for all traffic with logging and during the implementation we filter what traffic is fetched by them to create the true rules. In the end we set the rules to blocking and all is good.

It is just pretty much in there and sometimes it is useful to cross-check a week of connections. It can be done with the log-viewer but having all exported and handled with an external tool was much more comfortable and also easier to discuss with the engeneering-teams.

So in general, this sounds like a report topic, not a logging situation. But you could do it with a syslog server, if your need requires this. 

I will give it a try if I can get what I need by the reports and/or to install a syslog server.

But still I am wondering where the firewall stores the data that is shown in the Log viewer...

The difference is: Logviewer is a database. UTM uses a live log based on the .log files. 
Logviewer can filter and resolves difference problems at the same time. 
Therefore: /log is completely separated by the logviewer. Logviewer is a database filled by the system itself and not by the data in /log. 

Ah ok, now it makes sense to me that I cannot get the file. I assume the database-scheme and a (read-only) user is nothing Sophos makes public available?