Logging Admin Änderungen

Hi Marc P1,

Thank you for reaching out to the Community! 

Open a log viewer, and change the log filter to admin to see the configuration changes.

Reference screenshot: 

I'll move this thread to the Sophos (XG) Firewall Community group as it's better suited there. 

Thanks,

Hi Patel, 

Thanks for responding, but this is what I found already.

Would like to have it more detailed..

What exactly did someone change.

Not only something has been changed within a rule.

Hi Marc P1,

The configuration change would get logged in the applog.log. In the screenshot in my previous reply, I've configured Port4 with an IP address 172.16.17.1, and it generated the following log entries in the applog.log. 

Jun 04 06:59:40 Expression Value '#Port4'=~/^([^,])*$/Jun 04 06:59:40 Validate Input Data Is Successfully :::::#Port4Jun 04 06:59:40 IPSET -A hostset ip,581,0,172.16.17.1
Jun 04 06:59:40 Host updated successfully.
Jun 04 06:59:40 edit_interface request %ifreq

Thanks,

Hi Marc P1,

The configuration change would get logged in the applog.log. In the screenshot in my previous reply, I've configured Port4 with an IP address 172.16.17.1, and it generated the following log entries in the applog.log. 

Jun 04 06:59:40 Expression Value '#Port4'=~/^([^,])*$/Jun 04 06:59:40 Validate Input Data Is Successfully :::::#Port4Jun 04 06:59:40 IPSET -A hostset ip,581,0,172.16.17.1
Jun 04 06:59:40 Host updated successfully.
Jun 04 06:59:40 edit_interface request %ifreq

Thanks,

Ah ok, in applog.log

Will check this on Monday and Lett you know if this is what I am searching for :) thanks

Hi Patel,

had a look into that now and don´t see much.
checked the timestamp within the logviewer again and then moved to the applog.log

Within there searched for the exact time but there is nothing showing which value was within a Firewall rule and has been changed to.

something like:
Rule 13 - tcp-22 - updated to tcp-21