Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 3 replies
  • Subscribers 29 subscribers
  • Views 11211 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Where are block rule logs stored?

MichaelGombos

 I need to recover blocked network traffic logs from about a week ago. This traffic is blocked via firewall rule. I couldn't find a clear way to get this information by the reports view in the XG 310 webpage. I found a blog post indicating these files are stored in /tmp, but there are dozen of files and I haven't found the info I need in any of them.

I just need source IP, Destination IP, Source port, and Destination port.

Thank you.



This thread was automatically locked due to age.
Parents
  • +1

    Michael,

    you have 3 options (at the moment) to find logs:

    • Live Log
    • Reports
    • Send logs to an external Syslog (like iView for example).

    This behaviour will change in v17, where there will be a section to search for logs even after the reboot.

    Regards

Reply
  • +1

    Michael,

    you have 3 options (at the moment) to find logs:

    • Live Log
    • Reports
    • Send logs to an external Syslog (like iView for example).

    This behaviour will change in v17, where there will be a section to search for logs even after the reboot.

    Regards

Children
  • 0 in reply to lferrara

    Hi lferrara,

     

    how can you make a report of a deny rule ? I have 4 deny rules and enable logging on them, you see increasing the denied traffic in the rules.

    But how to view what has hit the rule.

     

    thx

     

    jeroen

    ( i am on v17)

  • 0 in reply to Jeroenhuisveilig

    Hi Jeroen,

    in v17 if you open the logviewer you will be able to select a timeframe in the past to view stored logs.

    in the moment it is not very comfortable to view logs which are days ago.

    if you click the word "add Filter" you get a filter option for "log comp"

    if you click the little arrow next to "add Filter" you get a Time Dropdown like "10 minutes, 30 min, 4 hours, all time"

    if you select "all time" you cann scroll down to the date of choice. (you'll have a long time of scrolling if you want to go back one day)

    please be aware that Logs prior to the v17 update will not be converted / recovered because they don't exist anywhere on disk.

     

    Yours Lukas