This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

utm logs

Hi Guy's,

Is there any artical on how to analyze the UTM logs? I really want to understand how the logs works and how to analyze them, i.e the top client of network usage of utm shows an public IP adress (not from ours) that has 2.5 GB http network usage. I really want to know what is this 2.5 GB data that has been genarated.

I cannot find nothing on net that explains how to analyzing the logs

Thanks

This thread was automatically locked due to age.

Parents

0 Scott_Klassen over 8 years ago

Is the entry resolved or an IP? If an IP, the first thing I'd do is a DNS lookup to see what it is. Since we know it it is HTTP traffic, check the Web Filtering log to find the transactions. You can also bring up other reports, such as top servers to see if you can correlate with the top clients information.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 AreshAreshi over 8 years ago in reply to Scott_Klassen

Hi Scott,

Thank you for the replay,

you really save me a lot of headache, now I can see where those http connection goes.
just one more question,

How aobut the none default ports? in the network usage I see an IP address that has use port 4098, how can I find out information for this connection?

Thanks
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 AreshAreshi over 8 years ago in reply to Scott_Klassen

Hi Scott,

Thank you for the replay,

you really save me a lot of headache, now I can see where those http connection goes.
just one more question,

How aobut the none default ports? in the network usage I see an IP address that has use port 4098, how can I find out information for this connection?

Thanks
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 vilic over 8 years ago in reply to AreshAreshi

Hi Aresh,

Search for "4098" term in Firewall log file (Logging & Reporting -> View Log Files);
Cancel
Vote Up 0 Vote Down

Cancel
0 AreshAreshi over 8 years ago in reply to vilic

I already tried that, but it cannot find anything!!
Cancel
Vote Up 0 Vote Down

Cancel