This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

utm logs

Hi Guy's,

Is there any artical on how to analyze the UTM logs? I really want to understand how the logs works and how to analyze them, i.e the top client of network usage of utm shows an public IP adress (not from ours) that has 2.5 GB http network usage. I really want to know what is this 2.5 GB data that has been genarated.

I cannot find nothing on net that explains how to analyzing the logs

Thanks

This thread was automatically locked due to age.

0 Scott_Klassen over 8 years ago

The top 10 lists are comiled from the raw log data. You can use www.sophos.com/.../121158.aspx , community.sophos.com/.../115634 , and community.sophos.com/.../115029 as a jumping off point. There's a few other articles in the knowledgebase as well. In reporting, you can use various reports, such as Logging & Reporting > Network Usage > Bandwidth Usage to drill in for more information.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 AreshAreshi over 8 years ago

Hi Scoot,

Thank you as Always for your reply,

I already sow those informtaions but none anserw my questions.
I want to know when for example in the network usage-bandwith usage- Top clients by service- i.e. HTTP I can see an public IP that use 3.5 GB Total network Traffic, to which interrnal web servers this traffic was pointed?

Any idea on how find the target of that 3.5 gb net traffic?

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 8 years ago

Is the entry resolved or an IP? If an IP, the first thing I'd do is a DNS lookup to see what it is. Since we know it it is HTTP traffic, check the Web Filtering log to find the transactions. You can also bring up other reports, such as top servers to see if you can correlate with the top clients information.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 AreshAreshi over 8 years ago in reply to Scott_Klassen

Hi Scott,

Thank you for the replay,

you really save me a lot of headache, now I can see where those http connection goes.
just one more question,

How aobut the none default ports? in the network usage I see an IP address that has use port 4098, how can I find out information for this connection?

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 vilic over 8 years ago in reply to AreshAreshi

Hi Aresh,

Search for "4098" term in Firewall log file (Logging & Reporting -> View Log Files);
Cancel
Vote Up 0 Vote Down

Cancel
0 AreshAreshi over 8 years ago in reply to vilic

I already tried that, but it cannot find anything!!
Cancel
Vote Up 0 Vote Down

Cancel
0 Stephen Lloyd3 over 4 years ago in reply to Scott_Klassen

Two of these links are stale. Any updated links?
Cancel
Vote Up 0 Vote Down

Cancel