Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 5 replies
  • Answers 2 answers
  • Subscribers 3 subscribers
  • Views 27847 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Live Logs - What filters?

btank
Curious as to what syntax can actually be provided in the "Filter:" field.
Sorry if this has been answered before, but I can't seem to find any info or guide on using the filter field.

If I try something like "Packet filter rule #1", the log just stalemates.
IP address filters work fine. Is this the only option we have with these logs? Would be nice to filter by specific firewall rules, port numbers, or allowed or dropped traffic.

Thanks,
-bt


This thread was automatically locked due to age.
  • 0

    Hi, and welcome to the User BB!

    The syntax to use is REGEX.  If you look in the actual Firewall log file, you will see that your filter term needs to be fwrule="1" instead of Packet filter rule #1.

    Also, when posting a line from the firewall log, use the line from the full Firewall log file.  Unlike the other Live Logs, the Firewall Live Log omits the details needed to analyze a problem.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    not to hijack the thread but how do you do a NOT statement?
    I've tried NOT fwrule="1" , !fwrule="1" , and -fwrule="1" but they don't seem to work
  • 0 in reply to NewImage
    Thanks BAlfson. Definitely pointed me in the right direction.
    After looking at the firewall logs though I have a few questions about some of the terms. Specifically...

    id=""
    severity=""
    sys=""
    sub=""
    (What do these terms refer to, and possible values for each?)

    proto="6"
    (assuming this is protocol, but how do you know what the value implies)

    tos="0x02"
    prec="0x00"
    (not idea what these two terms would be, or what the value itself is)

    and then for fwrule="" itself. I am seeing some values in the 60001, 60002 range when looking at the firewall log. Don't have that many rules but assuming these would be default drops? Do those numbers increase as rules get added or is the value constant? If constant and if default/built in rules what other values are there and what do they pertain to?

    Thanks for the help and quick replies thus far.
  • 0 in reply to NewImage

    I would also like to know how to to filter using a NOT. For example, show me all entries NOT including "Country blocked" OR fwrule="60019" OR id="2021" OR dstport="10181"

  • 0 in reply to btank

    This is the first I've seen your post, btank.  You want Packetfilter logfiles on the Sophos UTM - Sophos Community.

    I don't know of a way to use operators in the searches done from within WebAdmin.  If you need to use them, you'll have to go to the command line.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML