attr_status value

I am examining old confd log offline of a Sophos UTM 9 image. It contains an audit trail of firewall rule changes (packet filter class ). A line with "object_changed" has values"attr_status"0" oldattr_status="1
What does this mean? Does this mean that a rule becomes disabled ? My guess would be status 0 is not active, status 1 is an active firewall rule?

Parents

0 dirkkotte 1 month ago

I would also think that this is the case.
But to be sure, I would try it.
Deactivate/activate a rule and compare the log.

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Gert Koopman 1 month ago in reply to dirkkotte

Thanks dirkkotte yes I tried that already, thing is current Sophos UTM image logs this differently already, do not see the attr_status anymore. Or if somebody has a older 9.705-3 Sophos UTM image to test with, I can do that test
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 Gert Koopman 1 month ago in reply to dirkkotte

Thanks dirkkotte yes I tried that already, thing is current Sophos UTM image logs this differently already, do not see the attr_status anymore. Or if somebody has a older 9.705-3 Sophos UTM image to test with, I can do that test
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data