As background, I log all of my FW rules into a fwDump syslog file. This serves a number of purposes one of which being that I can use it as a backup to the GUI LogViewer.
I have observed that several log entries in the LogViewer are not visible until I add a filter for a given data-point. For example, when gathering information relating to the MAC missing "0" issue I posted earlier, I was unable to find the GUI log entries that matched those found in the syslog file. I checked the GUI side timestamps and several entries were definitely missing from the GUI. I then decided to add a filter containing the last 2-octets of the source IP address and BAM - all of the missing entries popped up. In essence, right in between the log entries that were there previously, new log entries appeared.
This is fairly easy to reproduce so you folks at Sophos should be able to test for this directly in your test labs. If you really need evidence from my system, please let me know in this thread and I can put something together.
Thanks.
This thread was automatically locked due to age.