Extract complete Log Viewer Firewall Log

Hi Fabian_,

Thank you for reaching out to the Community! 

The log viewer simplifies the raw logs. However, you won't be able to view the logs from CLI the way they're represented in the log viewer. 

Check out the log file guide for more information:

• Log file details

Thanks,

Thank you for your answer. Is there any way to export ALL Records? Its possible to filter for all Records, but they are not displayed all and thus not exported..

Hi Fabian_,

Could you please provide a bit more detail on what do you mean by " Is there any way to export ALL Records? Its possible to filter for all Records, but they are not displayed all and thus not exported.." 

Are you trying to download all the log files from the firewall?

Thanks,

When setting the Timer Filter to "All records" and clicking the download button up top, only the actively loaded entrys are exported and not all records according to the timer filter.

When setting the Timer Filter to "All records" and clicking the download button up top, only the actively loaded entrys are exported and not all records according to the timer filter.

This is not possible via GUI. Maybe somehow with commands on CLI against the database. Logging is still missing essentials features for a business firewall after all these years. You will also notice that the eventlog viewer will not display logs older than some very few days.

Your only help will be to setup a syslog server and forward everything against it. I would not rely much on sophos central logging which you would neet to enable and license for more than 7 days of logs.