KPI indicator uplink state

Question

Hello ! 
 I would like to export from logs events regarding WARN-032 Interface down and WARN-033 interface up and make KPI for one year. 
 I search on all logs from UTM (Kernel, System messages, Admin notifications,..) But I can't find theses information. 
 where can I export state of interfaces up/down from Sophos UTM 9 ? 
 
 Thanks in advance and have a nice day ! 
 Thomas.

BAlfson · Answer

So, if you wanted to see the total downtime for 2017, Thomas, you would use zgrep at the command line, WinSCP to download the file to your PC, a text editor to insert [tab] characters appropriately to isolate the dates and times and then paste the edited file into a spreadsheet for analysis. 
 zgrep 'WARN-03[2,3]' /var/log/smtp/2017/*/* >/home/interface_down_up_2017.txt 
 You also could do that with the log search in WebAdmin, I think. Did that help? 
 Cheers - Bob