Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 6 replies
  • Subscribers 29 subscribers
  • Views 2396 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Log Viewer history

djb-sophos

Log Viewer --> Authentication. I went to search for a user to find out when the last time they connected to the VPN. When I enter the username, nothing comes up. I enter my username, and I do see about 4 entries only. It seems I only have logs for about the last 24 hours. Upon reading this article, I don't find much information about log retention other than when disk space starts filling up, it deletes logs in 50 MB chunks. So I'm guessing this person hasn't connected to the VPN in a few days, logs filled up, and there is no record of this user connecting to the VPN. 

How can I set it up to either store more logs, or output to an external source so we actually have log history of.... the past?



This thread was automatically locked due to age.
Parents
  • 0

    Logviewer follows a different approach. Its database based. It is lacking certain abilities, which are already addressed to be fixed in the future.

    For example, you cannot see how long the data is "there". On bigger appliances, it could be potentially only days / hours. 

    You cannot jump to a certain "point of time" either. 

    But Logviewer is something to "live debug" and not to "investigate later". What i mean by that, there are differences between logging and reporting. Reporting is something to answer "Who logged in the most in the last month?". Logging is something "Who is logged in now?". 

Reply
  • 0

    Logviewer follows a different approach. Its database based. It is lacking certain abilities, which are already addressed to be fixed in the future.

    For example, you cannot see how long the data is "there". On bigger appliances, it could be potentially only days / hours. 

    You cannot jump to a certain "point of time" either. 

    But Logviewer is something to "live debug" and not to "investigate later". What i mean by that, there are differences between logging and reporting. Reporting is something to answer "Who logged in the most in the last month?". Logging is something "Who is logged in now?". 

Children
No Data