Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 2381 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Extract complete Log Viewer Firewall Log

Fabian_

Hey there,

I am currently struggling to extract all entrys from the Log Viewers Firewall Section. Is there a way to find this log in the CLI? I wasnt able to find a log with all that information, and the log viewer doesnt export all the entrys..



This thread was automatically locked due to age.
  • FormerMember
    0 FormerMember

    Hi ,

    Thank you for reaching out to the Community! 

    The log viewer simplifies the raw logs. However, you won't be able to view the logs from CLI the way they're represented in the log viewer. 

    Check out the log file guide for more information:

    Thanks,

  • 0 in reply to FormerMember

    Thank you for your answer. Is there any way to export ALL Records? Its possible to filter for all Records, but they are not displayed all and thus not exported..

  • FormerMember
    0 FormerMember in reply to Fabian_

    Hi ,

    Could you please provide a bit more detail on what do you mean by " Is there any way to export ALL Records? Its possible to filter for all Records, but they are not displayed all and thus not exported.." 

    Are you trying to download all the log files from the firewall?

    Thanks,

  • 0 in reply to FormerMember

    When setting the Timer Filter to "All records" and clicking the download button up top, only the actively loaded entrys are exported and not all records according to the timer filter.

  • +1 in reply to Fabian_

    This is not possible via GUI. Maybe somehow with commands on CLI against the database. Logging is still missing essentials features for a business firewall after all these years. You will also notice that the eventlog viewer will not display logs older than some very few days.

    Your only help will be to setup a syslog server and forward everything against it. I would not rely much on sophos central logging which you would neet to enable and license for more than 7 days of logs.